Alarm data processing method and device, electronic equipment and storage medium

Abstract

The invention relates to an alarm data processing method and device, electronic equipment and a storage medium, and relates to the technical field of security. The method comprises the following steps: acquiring target alarm data; according to a preset local large model and / or a preset local knowledge base, determining whether desensitization processing needs to be performed on the target alarm data; in response to determining that desensitization processing needs to be carried out on the target alarm data, desensitizing the target alarm data to obtain target desensitized data; analyzing the target desensitization data by using the online large model, and determining an analysis result; and outputting prompt information according to the analysis result and the target alarm data. According to the method and the device, the data can be desensitized before the data is analyzed by using the online large model, so that the security of the alarm data is ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an alarm data processing method, device, electronic device and storage medium. Background Art

[0002] In today's rapidly developing field of cybersecurity, the application of big model technology has become an emerging trend. The impetus behind this trend comes from two main observations. First, the rapid development of big model technology has shown significant advantages in the analysis and processing capabilities of security alerts compared to traditional security equipment and manual analysis methods. These big models can not only provide faster analysis results, but also achieve higher levels of accuracy and analysis depth, significantly reducing the reliance on human resources of security experts.

[0003] However, the application of large models is not without challenges. The large models currently on the market are mainly divided into two categories: open source large models and commercial large models. Although open source large models are easy to obtain, their huge number of parameters places extremely high demands on hardware resources, especially GPU resources, which limits their application in resource-constrained environments. In contrast, commercial large models, such as ChatGPT4 and its future iterations, although they have obvious advantages in intelligence and can analyze and process more complex security incidents, their usage costs and the risk of privacy leakage are factors that need to be seriously considered. In this context, a significant problem emerges: how to safely use online large models to enhance the analysis capabilities of local security alerts without sacrificing data privacy protection. Summary of the invention

[0004] Embodiments of the present application provide an alarm data processing method, device, electronic device, and storage medium.

[0005] In a first aspect, an embodiment of the present application provides an alarm data processing method, including: obtaining target alarm data; determining whether it is necessary to desensitize the target alarm data based on a preset local big model and / or a preset local knowledge base; in response to determining that the target alarm data needs to be desensitized, desensitizing the target alarm data to obtain target desensitized data; analyzing the target desensitized data using an online big model to determine the analysis results; and outputting prompt information based on the analysis results and the target alarm data.

[0006] In the second aspect, an embodiment of the present application provides an alarm data processing device, including: an acquisition unit, configured to acquire target alarm data; a judgment unit, configured to determine whether it is necessary to desensitize the target alarm data according to a preset local big model and / or a preset local knowledge base; a desensitizing unit, configured to desensitize the target alarm data in response to determining that the target alarm data needs to be desensitized, so as to obtain target desensitized data; an analysis unit, configured to analyze the target desensitized data using an online big model and determine an analysis result; and an output unit, configured to output prompt information according to the analysis result and the target alarm data.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, a bus, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the alarm data processing method described in the first aspect is implemented.

[0008] In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the alarm data processing method as described in the first aspect.

[0009] By applying the technical solution of the present application, after acquiring the target alarm data, it is possible to determine whether the target alarm data needs to be desensitized in combination with the local large model and / or the local knowledge base. If necessary, the target alarm data can be desensitized to obtain the target desensitized data. Then, the target desensitized data can be analyzed using the online large model to determine the analysis results. Finally, the prompt information is output using the analysis results and the target alarm data. The data can be desensitized before being analyzed using the online large model, thereby ensuring the security of the alarm data.

[0010] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present application. Figure 1 An exemplary system architecture diagram in which an embodiment of the alarm data processing method of the present application can be applied; Figure 2 A flowchart of an embodiment of the alarm data processing method of the present application; Figure 3 A flowchart of another embodiment of the alarm data processing method of the present application; Figure 4 A schematic diagram of the structure of an embodiment of an alarm data processing device of the present application; Figure 5 A schematic structural diagram of an embodiment of an electronic device of the present application. DETAILED DESCRIPTION

[0012] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0013] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0014] In the absence of conflict, the embodiments in this application and the features in the embodiments may be combined with each other.

[0015] In order to make the technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0016] Figure 1 An exemplary system architecture 100 is shown to which an embodiment of the alarm data processing method or alarm data processing device of the present application can be applied.

[0017] like Figure 1 As shown, the system architecture 100 may include security devices 101, 102, terminal device 103, network 104 and server 105. The network 104 is used to provide a medium for communication links between the security devices 101, 102, the terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0018] The security devices 101 and 102 may be various devices for ensuring network security, such as firewalls, vulnerability scanners, etc. The security devices 101 and 102 may generate alarm data during operation, and may send the alarm data to the terminal device 103 at a fixed time or frequency. The alarm data may include various types of data, such as vulnerability data, total data, etc.

[0019] The terminal device 103 can filter, analyze, desensitize, etc. the received alarm data, and output the processing results, or send them to the server 105. The terminal device 103 can be installed with various communication client applications, such as browser applications, data processing applications, etc.

[0020] The server 105 may be any server that processes the alarm data sent by the terminal device 103. The server 105 may call a large model to analyze the alarm data and feed back the analysis result to the terminal device 103.

[0021] It should be noted that the alarm data processing method provided in the embodiment of the present application is generally executed by the terminal device 103. Accordingly, the alarm data processing device is generally disposed in the terminal device 103.

[0022] It should be understood that Figure 1 The number of security devices, terminal devices, networks and servers in the embodiment is only for illustration. Any number of security devices, terminal devices, networks and servers may be provided according to implementation requirements.

[0023] Figure 2 FIG. 2 shows a process 200 of an embodiment of the alarm data processing method of the present application. Figure 2 As shown, the alarm data processing method of this embodiment may include the following steps: Step 201, obtaining target alarm data.

[0024] In this embodiment, the execution subject of the alarm data processing method (for example Figure 1 The terminal device 103 shown in the figure can obtain the target alarm data in various ways. For example, the alarm data can be obtained from various security devices, or from a cloud platform for storing alarm data. The execution subject can perform various processes on the obtained alarm data, such as screening processing, deduplication processing, etc. The processed alarm data is used as the target alarm data.

[0025] Step 202: Determine whether it is necessary to perform desensitization processing on the target alarm data according to a preset local large model and / or a preset local knowledge base.

[0026] After obtaining the target alarm data, the preset local large model and / or the preset local knowledge base can be used to judge the target alarm data. Here, the preset local large model can refer to an algorithm for screening the target alarm data through some preset rules, which can be obtained through deep learning. In order to make the large model run smoothly locally, a smaller model can be used, that is, a model with a parameter amount less than a preset value.

[0027] The local large model can be used to filter the target alarm data. If the target alarm data contains data that meets a certain condition, it is determined that the target alarm data needs to be desensitized. For example, if the target alarm data contains numbers that are consistent with the ID card number, it is considered that the target alarm data needs to be desensitized.

[0028] In addition, the target alarm data can also be analyzed using the local knowledge base. The local knowledge base contains processing solutions for different types of alarm data. If the data types in the target alarm data are all included in the data types targeted in the local knowledge base, then for the target alarm data, a processing solution can be determined from the local knowledge base, so that the target alarm data does not need to be further processed.

[0029] Furthermore, the local large model can be combined with the local knowledge base to analyze the target alarm data. Specifically, after the analysis of the local large model, the data that needs to be desensitized can be determined. The data that needs to be desensitized is then analyzed through the local knowledge base to determine whether there is a processing solution for the data that needs to be desensitized. If there is, there is no need to desensitize the target alarm data.

[0030] Step 203, in response to determining that the target alarm data needs to be desensitized, the target alarm data is desensitized to obtain target desensitized data.

[0031] If the target alarm data needs to be desensitized through analysis of the local large model and / or local knowledge base, desensitization can be achieved in a variety of ways. Specifically, if the sensitive data is character data such as ID card number, mobile phone number, etc., the sensitive data in the target alarm data can be replaced with a preset string. If the sensitive data is a picture, the picture can be mosaiced. If the sensitive data is internal asset data, a mark or prompt can be placed next to the internal asset data.

[0032] After desensitizing the target alarm data in a variety of ways, the target desensitized data can be obtained.

[0033] Step 204: Analyze the target desensitized data using the online large model to determine the analysis results.

[0034] After desensitizing the target alarm data, the target desensitized data can be analyzed using the online large model. The online large model here can be a model with a large number of parameters. Since its operation has high hardware requirements, it can be run in the cloud. The execution entity can upload the target desensitized data to the cloud for analysis by the online large model. The online large model can include multiple algorithms to analyze each data in the target desensitized data, determine the alarm type and the corresponding processing method.

[0035] Step 205: output prompt information according to the analysis result and the target alarm data.

[0036] After obtaining the analysis results fed back by the online large model, the prompt information can be combined with the target alarm data to output. For example, according to the above analysis results, the data corresponding to the analysis results can be highlighted in the target alarm data. Alternatively, the analysis results can be added to a specified part of the target alarm data. The above prompt information can include the highlighted part, and can also include the added target alarm data.

[0037] The alarm data processing method provided by the above-mentioned embodiment of the present application can determine whether it is necessary to desensitize the target alarm data after acquiring the target alarm data, in combination with the local large model and / or the local knowledge base. If necessary, the target alarm data can be desensitized to obtain the target desensitized data. Then, the target desensitized data can be analyzed using the online large model to determine the analysis results. Finally, the prompt information is output using the analysis results and the target alarm data. The data can be desensitized before the data is analyzed using the online large model, thereby ensuring the security of the alarm data.

[0038] Continue to see Figure 3 , which shows a process 300 of another embodiment of the alarm data processing method according to the present application. Figure 3 As shown, the method in this embodiment may include the following steps: Step 301, collect alarm data from a plurality of preset safety devices; filter the collected alarm data to obtain target alarm data.

[0039] With the improvement of the security system, there are a large number of security devices. The alarm data generated by the security devices every day is massive. At the same time, there are also a large number of repeated alarms, etc. It is necessary to filter out the core alarms through strategies for subsequent large-scale online model call analysis. In this embodiment, alarm data can be collected from multiple preset security devices. Then, the collected alarm data is screened to obtain the target alarm data.

[0040] When filtering, you can select a certain type of alarm data as the target alarm data. For example, the attack status in the alarm data is successful, the attacker is an internal IP, and the specified dangerous alarm type (server discovers Webshell) is used as the target alarm data. Alternatively, you can perform custom aggregation on the alarm data collected by each security device to obtain the target alarm data. For example, you can pre-configure custom aggregation fields, such as host security logs, and you can configure the same alarm triggered by the same host and the same process to be aggregated and deduplicated.

[0041] Step 302, in response to the target alarm data including data of the at least one data type, adding a prompt word matching the data type to the target alarm data; and determining whether the target alarm data needs to be desensitized based on the prompt word included in the target alarm data.

[0042] In this embodiment, the local big model includes at least one data type and prompt words matching each data type. By using the local big model to analyze the target alarm data, it can be determined whether the target alarm data contains data of the above data types. If so, it can be determined whether the target alarm data needs to be desensitized based on the prompt words corresponding to the above data types. For example, for data of the type of internal asset data, the prompt word "This is internal asset data" can be added after this type of data, so that the subsequent online big model can be used to understand the data and improve the accuracy of the analysis results. For example, if the target alarm data contains data of the type of malware communication traffic, the prompt word "Please analyze based on the complete alarm information to see if the alarm is a junk software alarm with no actual harm. If not or cannot be analyzed, please return true, otherwise return false".

[0043] After determining the prompt words in the target alarm data, it can be determined whether the target alarm data needs to be desensitized based on the prompt words. Specifically, the prompt words can be subjected to natural language processing (NLP) to determine the semantics of the prompt words. If the prompt words indicate that further analysis is required, the target alarm data needs to be desensitized. If the prompt words indicate that further analysis is not required, the target alarm data does not need to be desensitized.

[0044] It should be noted that the local large model may include one large model or multiple large models, and the functions of each large model may be the same or different.

[0045] Step 303, determining whether the preset local knowledge base includes cases that match the target alarm data; in response to determining that the preset local knowledge base includes cases that match the target alarm data and there is no data of unmatched cases in the target alarm data, determining that the target alarm data does not need to be desensitized.

[0046] In this embodiment, the target alarm data can also be analyzed using the local knowledge base. Specifically, the target alarm data can be compared with the local knowledge base. If the local knowledge base includes cases that match the target alarm data, and there is no data of unmatched cases in the target alarm data, it can be considered that all cases of the target alarm data can be fully obtained through the local knowledge base, and there is no need to perform desensitization processing on the target alarm data.

[0047] In some specific practices, the local knowledge base may store the alarm data and the corresponding cases in the form of vectors. When using the local knowledge base for analysis, the vector corresponding to the target alarm data may be first determined. Then, by calculating the similarity between the vectors, the case matching the target alarm data is determined in the local knowledge base.

[0048] In some optional implementations of this embodiment, before desensitizing the target alarm data, the following steps may be included: Figure 3 The following steps not shown in FIG. 1 are as follows: adding the matched cases to the target alarm data.

[0049] In this implementation, the case corresponding to the alarm data can be added to the target alarm data, so that when the subsequent online large model processes the target alarm data, it can refer to the above case, thereby providing an analysis result with higher accuracy.

[0050] Step 304, using a preset local large model to analyze the target alarm data to determine whether the target alarm data contains encoded data or ciphertext data; in response to determining that the target alarm data contains encoded data, decoding the encoded data; in response to determining that the target alarm data contains ciphertext data, decrypting the ciphertext data; in response to determining that the decoding is successful and the decryption is successful, determining the target desensitized data based on the data obtained after decoding and decryption.

[0051] After determining that the target alarm data needs to be desensitized, the local large model can be used to desensitize the target alarm data. Specifically, it can be determined first whether there is coded data or ciphertext data in the target alarm data. Specifically, it can be determined whether there is coded data or ciphertext data in the target alarm data according to the characteristics of the coded data or the characteristics of the ciphertext data.

[0052] If there is coded data, the coded data can be decoded. Specifically, the AIAgent decoding process can be called during decoding, and its built-in BASE64 and other mainstream codec Aiagent large models can be judged and called independently.

[0053] If there is ciphertext data, the ciphertext data can be decrypted using a decryption algorithm. Specifically, the decryption algorithm can be pre-agreed.

[0054] If the encoded data is decoded successfully and the ciphertext data is decrypted successfully, the target desensitized data can be determined based on the data obtained after decoding and the data obtained after decryption.

[0055] In some optional implementations of this embodiment, data that has not been successfully decoded or decrypted can be output for technicians to view. In this way, the technicians can manually desensitize the encoded data or ciphertext data.

[0056] Step 305: Update the preset type of data in the target alarm data according to the preset security asset database to obtain initial desensitized data.

[0057] Security data desensitization is different from traditional desensitization. A typical example is corporate IP information. If all IP formats are directly desensitized, it will be difficult to judge whether our host is attacked by someone or the host is attacking externally during the subsequent analysis. This is one scenario. Another example is account information. If an internal account list is not provided, it is difficult for the desensitization rule to confirm whether the request contains our account data. Based on the above scenario, a security asset database can be established in advance, and domain names, IP addresses, accounts, email addresses and other data can be connected or entered for use by desensitization rules. It should be noted that each asset type in the asset library can specify a virtual asset range for subsequent desensitization. Specifically, the target alarm data can be compared with the data in the security asset database. If the target alarm data includes security asset data, the above security asset data can be replaced with preset prompt words, or the above security asset data can be marked.

[0058] In specific practice, desensitization rules can be used for desensitization. The desensitization rules here can include regular expressions that match mobile phone numbers. This type of desensitization generally does not affect the scenario of security alarm analysis. For asset data such as IP, you can configure rules for asset desensitization. That is, when asset data is matched in security alarm data, it is automatically replaced with preset data. For example, if a specified IP or network segment is matched, it is automatically replaced with the virtual asset range defined by the asset library. The asset network segment can be 123.0.0.0 / 24, and the virtual asset network segment can be 122.0.0.0 / 24. At this time, a virtual address is automatically selected from 122.0.0.0 / 24, for example, 123.0.0.1 is replaced with 122.0.0.1. It can be understood that the virtual address here is not a real address. After completion, it can be marked in the context of the security alarm data to indicate the type of the replaced data. For example, it can be marked as "122.0.0.1 is an internal asset". This will not affect the subsequent large model analysis and will not leak real internal sensitive information.

[0059] Step 306: Desensitize the sensitive information in the prompt word list included in the target alarm data according to the preset prompt word list to obtain target desensitized data.

[0060] After desensitizing the data in the above steps, the local large model can be used again for verification. During the verification, a preset prompt word list can be used. Through the prompt word list, it can be checked whether the target alarm data also includes sensitive information in the prompt word list. If yes, continue with the desensitization process. If not, the desensitization process is completed and the target desensitized data is obtained. For example, the prompt word can be: Please analyze whether the above alarm contains sensitive information such as user ID card, telephone number, and home address.

[0061] Step 307: Analyze the target desensitized data using the online large model to determine the analysis results.

[0062] The online large model can analyze the target desensitized data and determine the alarm data therein. Through the above analysis, the non-alarm data in the target alarm data can be screened out to obtain the alarm data with security risks.

[0063] Step 308, determining each alarm information according to the analysis result; determining the original alarm information corresponding to each alarm information; and outputting prompt information according to each alarm information and the original alarm information.

[0064] After obtaining the analysis results, each alarm information can be determined. Then, the original alarm information corresponding to each alarm information can be determined from the target alarm data. Finally, each alarm information and the original alarm information can be combined and output. At the same time, prompt information can also be output. The prompt information is used to prompt the user to view the alarm data and the corresponding original alarm data, and can also prompt the user the type of alarm data, etc.

[0065] Step 309, obtaining processing information of the alarm information; and updating a preset local knowledge base according to the processing information.

[0066] After the alarm information is determined, the processing information of the alarm information can also be obtained. Then, the local knowledge base can be optimized according to the above alarm information and processing information. Specifically, the alarm information and processing information can be vectorized, and then the vectors can be stored in the local knowledge base.

[0067] In some specific practices, alarm information of a type not included in the local knowledge base may be selected and added to the local knowledge base.

[0068] The alarm data processing method provided by the above-mentioned embodiment of the present application can combine the advantages of low cost, security and controllability of local low-parameter large models, and at the same time, after processing sensitive data and providing rich context, it can safely call the Internet online big model to conduct in-depth research and analysis on complex security incidents, fully ensuring high performance and high security, and effectively solving the problem that sensitive security incidents are difficult to analyze using highly intelligent commercial Internet big models.

[0069] Further references Figure 4 As an implementation of the methods shown in the above figures, the present application provides an embodiment of an alarm data processing device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0070] like Figure 4 As shown, the alarm data processing device 400 of this embodiment includes: an acquisition unit 401, a judgment unit 402, a desensitization unit 403, an analysis unit 404 and an output unit 405.

[0071] The acquisition unit 401 is configured to acquire target alarm data.

[0072] The judgment unit 402 is configured to determine whether it is necessary to perform desensitization processing on the target warning data according to a preset local large model and / or a preset local knowledge base.

[0073] The desensitizing unit 403 is configured to, in response to determining that the target alarm data needs to be desensitized, desensitize the target alarm data to obtain target desensitized data.

[0074] The analysis unit 404 is configured to analyze the target desensitized data using an online large model to determine an analysis result.

[0075] The output unit 405 is configured to output prompt information according to the analysis result and the target alarm data.

[0076] In addition, in the technical solution of the present application, an electronic device is also proposed.

[0077] Figure 5 A schematic structural diagram of an electronic device provided in one embodiment of the present application is shown.

[0078] like Figure 5 As shown, the electronic device may include a processor 501, a memory 502, a bus 503, and a computer program stored in the memory 502 and executable on the processor 501, wherein the processor 501 and the memory 502 communicate with each other via the bus 503. The steps of implementing the above method when the processor 501 executes the computer program include, for example: obtaining target warning data; determining whether it is necessary to perform desensitization processing on the target warning data according to a preset local large model and / or a preset local knowledge base; in response to determining that it is necessary to perform desensitization processing on the target warning data, desensitizing the target warning data to obtain target desensitized data; analyzing the target desensitized data using the online large model to determine the analysis result; and outputting prompt information according to the analysis result and the target warning data.

[0079] In addition, in one embodiment of the present application, a non-transitory computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented, for example, including: obtaining target alarm data; determining whether it is necessary to desensitize the target alarm data according to a preset local big model and / or a preset local knowledge base; in response to determining that the target alarm data needs to be desensitized, desensitizing the target alarm data to obtain target desensitized data; analyzing the target desensitized data using an online big model to determine the analysis results; and outputting prompt information based on the analysis results and the target alarm data.

[0080] In summary, in the technical solution of the present application, after obtaining the target alarm data, it is determined whether the target alarm data needs to be desensitized in combination with the local large model and / or the local knowledge base. If necessary, the target alarm data can be desensitized to obtain the target desensitized data. Then, the target desensitized data can be analyzed using the online large model to determine the analysis results. Finally, the prompt information is output using the analysis results and the target alarm data. The data can be desensitized before the data is analyzed using the online large model, thereby ensuring the security of the alarm data.

[0081] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for processing alarm data, comprising: Obtain target warning data; Determine whether it is necessary to perform desensitization processing on the target warning data according to a preset local large model and / or a preset local knowledge base; In response to determining that the target alarm data needs to be desensitized, desensitizing the target alarm data to obtain target desensitized data; Analyze the target desensitized data using an online large model to determine the analysis results; Output prompt information according to the analysis result and the target alarm data.

2. The method according to claim 1, wherein: The obtaining of target warning data includes: Collect alarm data from multiple preset safety devices; The collected alarm data are screened to obtain the target alarm data.

3. The method according to claim 1, wherein: The local big model includes at least one data type and prompt words matching each data type; The determining whether it is necessary to perform desensitization processing on the target warning data according to the preset local large model and / or the preset local knowledge base includes: In response to the target alarm data including data of the at least one data type, adding a prompt word matching the data type to the target alarm data; According to the prompt words included in the target warning data, it is determined whether the target warning data needs to be desensitized.

4. The method according to claim 1, wherein: The determining whether it is necessary to perform desensitization processing on the target warning data according to the preset local large model and / or the preset local knowledge base includes: Determining whether the preset local knowledge base includes a case matching the target alarm data; In response to determining that the preset local knowledge base includes cases matching the target alarm data and that no data of unmatched cases exists in the target alarm data, it is determined that desensitization processing does not need to be performed on the target alarm data.

5. The method according to claim 4, wherein: Before desensitizing the target warning data, the method further includes: The matched case is added to the target alarm data.

6. The method according to claim 1, wherein: The desensitizing the target warning data to obtain the target desensitized data includes: Analyzing the target warning data using a preset local large model to determine whether the target warning data contains coded data or ciphertext data; In response to determining that the target warning data contains coded data, decoding the coded data; In response to determining that the target alarm data contains ciphertext data, decrypting the ciphertext data; In response to determining that the decoding is successful and the decryption is successful, the target desensitized data is determined based on the data obtained after the decoding and decryption.

7. The method according to claim 6, wherein: The method further comprises: In response to determining that the decoding is not successful or the decryption is not successful, the encoded data or the ciphertext data is output.

8. The method according to claim 3, wherein: The desensitizing the target warning data to obtain the target desensitized data includes: According to a preset security asset database, data of a preset type in the target alarm data is updated to obtain the initial desensitized data.

9. The method according to claim 1, wherein: The desensitizing the target warning data to obtain the target desensitized data includes: According to a preset prompt word list, the sensitive information in the prompt word list included in the target alarm data is desensitized to obtain target desensitized data.

10. The method according to claim 1, wherein: Outputting prompt information according to the analysis result and the target warning data includes: Determine each alarm information according to the analysis result; Determining original alarm information corresponding to each of the alarm information; Output prompt information according to the various alarm information and the original alarm information.

11. The method according to claim 1, wherein: The method further comprises: Obtaining processing information of the warning information; The preset local knowledge base is updated according to the processing information.

12. An alarm data processing device, comprising: an acquisition unit, configured to acquire target warning data; A judgment unit is configured to determine whether it is necessary to perform desensitization processing on the target warning data according to a preset local large model and / or a preset local knowledge base; a desensitizing unit configured to, in response to determining that the target alarm data needs to be desensitized, desensitize the target alarm data to obtain target desensitized data; An analysis unit is configured to analyze the target desensitized data using an online large model to determine an analysis result; The output unit is configured to output prompt information according to the analysis result and the target alarm data.

13. An electronic device comprising a memory, a processor, a bus, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the alarm data processing method according to any one of claims 1 to 11 is implemented.

14. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the alarm data processing method according to any one of claims 1 to 11 is implemented.

Images