Alarm processing method, device, equipment, medium and product

Abstract

The invention provides an alarm processing method. The method comprises the following steps: acquiring a first alarm event; determining an analysis step of the first alarm event and a data query tool, and extracting key alarm data; for each analysis step, sending the key alarm data and description information of the data query tool to a first language model, and receiving query parameters output by the first language model; based on the query parameters, calling a data query tool to obtain associated data; sending the first alarm event and the associated data obtained in each analysis step to a first language model, and receiving an alarm analysis result output by the first language model; and processing the first alarm event according to the alarm analysis result. According to the method, the alarm analysis efficiency can be improved, accurate and targeted alarm processing is realized, and the safety protection capability of cloud safety products such as a cloud workload protection platform (CWPP), a cloud safety center and a container safety protection platform is further improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an alarm handling method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous development of cloud computing technology, cloud security protection products for cloud security detection have emerged. Cloud security protection products can include cloud security centers, cloud workload protection platforms (CWPP), and other products that protect workloads (such as virtual machines and containers) in cloud environments.

[0003] Cloud security protection products can detect alarm information and generate alarm events. Security operations personnel need to analyze the alarm events and then handle the alarms based on the analysis results. Usually, in the process of analyzing alarm events, security operations personnel can analyze the alarm data in the alarm information to obtain alarm analysis results, such as identifying the cause of the alarm event and determining the impact range of the alarm event, so as to handle the alarm later.

[0004] However, the above method relies heavily on human resources and has low alarm analysis efficiency. At the same time, it is difficult to obtain comprehensive alarm analysis results by analyzing the alarm data in the alarm information, and the accuracy and pertinence of alarm handling are low. Summary of the invention

[0005] The present application provides an alarm handling method. The method can improve the efficiency of alarm analysis and achieve accurate and targeted alarm handling. The present application also provides a device, an electronic device, a computer-readable storage medium, and a computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides an alarm handling method, the method comprising:

[0007] Get the first alarm event;

[0008] Determining at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step, and extracting key alarm data from the first alarm event;

[0009] For each of the analysis steps, the following steps are performed: sending the key alarm data and description information of the data query tool corresponding to the analysis step to the first language model, and receiving the query parameters output by the first language model; based on the query parameters, calling the data query tool corresponding to the analysis step to obtain associated data;

[0010] Sending the first alarm event and the associated data obtained in each of the analysis steps to the first language model, and receiving the alarm analysis result output by the first language model;

[0011] According to the alarm analysis result, the first alarm event is handled.

[0012] In a second aspect, the present application provides an alarm handling device, the device comprising:

[0013] An acquisition module, used for acquiring a first alarm event;

[0014] A determination module, configured to determine at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step, and to extract key alarm data from the first alarm event;

[0015] The analysis module is used to perform the following steps for each of the analysis steps: sending the key alarm data and description information of the data query tool corresponding to the analysis step to the first language model, and receiving the query parameters output by the first language model; based on the query parameters, calling the data query tool corresponding to the analysis step to obtain related data;

[0016] A communication module, used for sending the first alarm event and the associated data obtained in each of the analysis steps to the first language model, and receiving the alarm analysis result output by the first language model;

[0017] A handling module is used to handle the first alarm event according to the alarm analysis result.

[0018] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory so that the electronic device executes the alarm handling method in the first aspect or any implementation of the first aspect.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, wherein the instructions instruct an electronic device to execute the alarm handling method described in the first aspect or any one of the implementations of the first aspect.

[0020] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the alarm handling method described in the first aspect or any one of the implementations of the first aspect.

[0021] Based on the implementations provided in the above aspects, the present application can also be further combined to provide more implementations.

[0022] It can be seen from the above technical solutions that this application has the following advantages:

[0023] The present application provides an alarm handling method, which first obtains a first alarm event, determines at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step, and extracts key alarm data from the first alarm event. For each analysis step, the following steps are performed: sending the key alarm data and description information of the data query tool corresponding to the analysis step to a first language model, receiving query parameters output by the first language model, and based on the query parameters, calling the data query tool corresponding to the analysis step to obtain associated data, then sending the first alarm event and the associated data obtained in each analysis step to the first language model, receiving the alarm analysis result output by the first language model, and handling the first alarm event according to the alarm analysis result.

[0024] In this method, the analysis process for alarm events is divided into multiple analysis steps. In each analysis step, the key alarm data in the alarm event is used to obtain the associated data related to the alarm event, and the alarm event is analyzed together with the associated data in each analysis step. In this way, the alarm analysis results obtained are more comprehensive and rich, and accurate and targeted alarm handling is achieved. In addition, the natural language processing capabilities of the language model are used to determine the query parameters for calling the data query tool and generate the alarm analysis results, so that the analysis process for the alarm event can be automatically executed, improving the efficiency of the alarm analysis, and thus improving the security protection capabilities of cloud security products such as the Cloud Workload Protection Platform (CWPP), Cloud Security Center, and Container Security Protection Platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0026] Figure 1 A flowchart of an alarm handling method provided in an embodiment of the present application;

[0027] Figure 2 A flowchart of an alarm handling method provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of a process for establishing an alarm database provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of the structure of an alarm handling device provided in an embodiment of the present application;

[0030] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0032] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0033] With the continuous development of cloud computing technology, cloud security protection products for cloud security detection have emerged. Cloud security protection products can perform multi-faceted security detection in various operating scenarios. For example, cloud security protection products can be cloud workload protection platforms (CWPP), which can detect host security and network security. For another example, cloud security protection products can be host-based intrusion detection systems (HIDS), which can perform security detection on the behavior and status of computer systems. For another example, cloud security protection products can be endpoint detection and response (EDR), which can perform security detection on the system-level behavior of endpoints. For another example, cloud security protection products can be high-container security platforms (CSP), which can provide multi-faceted security detection for containers.

[0034] In specific implementation, cloud security protection products can detect alarm information and generate alarm events. After the alarm event is generated, security operations personnel can analyze the alarm event and handle the alarm based on the alarm analysis results.

[0035] In the related technology, security operators can analyze alarm events with the help of standard operating procedure (SOP) documents. Specifically, the SOP document records the historical analysis process for different alarm events. Security operators can filter out the historical analysis process similar to the current alarm event in the SOP document, analyze the current alarm event according to the historical analysis process, and obtain the alarm analysis result.

[0036] Typically, the alarm analysis of security operations personnel can be achieved by analyzing the alarm data in the alarm information. For example, by analyzing the alarm data in the alarm information, the cause of the alarm event can be identified, the impact scope of the alarm event can be determined, etc.

[0037] However, the above method relies heavily on human resources and has low alarm analysis efficiency. At the same time, it is difficult to obtain comprehensive alarm analysis results by analyzing the alarm data in the alarm information, and the accuracy and pertinence of alarm handling are low.

[0038] In view of this, the present application provides an alarm handling method, which first obtains a first alarm event, determines at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step, and extracts key alarm data from the first alarm event. For each analysis step, the following steps are performed: sending the key alarm data and description information of the data query tool corresponding to the analysis step to a first language model, receiving query parameters output by the first language model, and based on the query parameters, calling the data query tool corresponding to the analysis step to obtain associated data, then sending the first alarm event and the associated data obtained in each analysis step to the first language model, receiving the alarm analysis result output by the first language model, and handling the first alarm event according to the alarm analysis result.

[0039] In this method, the analysis process for alarm events is divided into multiple analysis steps. In each analysis step, the key alarm data in the alarm event is used to obtain the associated data related to the alarm event, and the alarm event is analyzed together with the associated data in each analysis step. In this way, the alarm analysis results obtained are more comprehensive and rich, and accurate and targeted alarm handling is achieved. In addition, the natural cause processing capability of the language model is used to determine the query parameters for calling the data query tool and generate the alarm analysis results, so that the analysis process for the alarm event can be automatically executed, improving the efficiency of alarm analysis.

[0040] To facilitate understanding of the technical solution provided by the embodiments of the present application, it will be described below with reference to the accompanying drawings.

[0041] See also Figure 1 The flowchart of an alarm handling method provided by an embodiment of the present application is shown, and the method specifically includes:

[0042] S101: Obtain a first alarm event.

[0043] In the embodiment of the present application, the first alarm event can be understood as any alarm event generated by the cloud security protection product. In other words, the user can use the cloud security protection product to detect the computing device or virtual operating environment, and when the computing device or virtual operating environment is abnormal, the cloud security protection product can generate the first alarm event.

[0044] Typically, the first warning event may be associated with at least one warning message. The warning message may be understood as information related to an abnormality generated by a computing device or a virtual operating environment. For example, the warning message may be information related to malware, information related to intrusion, information related to a vulnerability, and the like.

[0045] In specific implementation, the first alarm event can be generated based on an alarm rule. The alarm rule can be understood as a rule for generating an alarm event from alarm information. The cloud security protection product continuously obtains alarm information, and when at least one alarm information hits a certain alarm rule, a first alarm event is generated.

[0046] In some embodiments, the cloud security protection product may be a software system. For example, the cloud security protection product may be a software system deployed locally or on the cloud. In this case, the server provided in the embodiments of the present application for performing alarm handling may be connected to the cloud security protection product in the form of a plug-in, cloud service, etc.

[0047] S102: Determine at least one analysis step of a first alarm event and a data query tool corresponding to the at least one analysis step, and extract key alarm data from the first alarm event.

[0048] In the embodiment of the present application, the analysis step can be used as a step for analyzing the first alarm event. It can be understood that the alarm analysis usually has a certain standard process, that is, the alarm analysis can be performed in a certain logical order, and the analysis step can be understood as a step included in the standard process, or a step composed of the logical order.

[0049] The data query tool can be understood as a tool for querying data, such as software, components, cloud services, etc. for querying data. In the embodiment of the present application, the data query tool can be used to query the associated data related to the first alarm event, that is, the data query tool can be software, components, cloud services, etc. for querying the relevant data of the computing device or virtual operating environment.

[0050] In the embodiment of the present application, one analysis step may correspond to one data query tool. In other words, in each analysis step, the corresponding data query tool may be used to perform data query and obtain related data. In this way, when at least one analysis step of the first alarm event is to perform analysis on different dimensions, the corresponding data query tool may be used to obtain related data of different dimensions and types.

[0051] Normally, alarm events of the same alarm type correspond to the same alarm analysis process. In other words, alarm events of the same alarm type have the same analysis steps and the same data query tools corresponding to each analysis step. Specifically, the target alarm type of the first alarm event is identified, the alarm analysis script corresponding to the target alarm type is executed, and at least one analysis step of the first alarm event and the data query tool corresponding to the at least one analysis step are determined.

[0052] The target alarm type may be understood as the alarm type of the first alarm event, and the alarm analysis script may be understood as a script including at least one analysis step of the alarm event and a data query tool corresponding to the at least one analysis step.

[0053] Among them, a script refers to a set of instructions for controlling the operation of a computing device, which can be read and executed by the computing device. That is to say, the alarm analysis script in the embodiment of the present application includes an instruction set for splitting the alarm analysis of the target alarm type into different analysis steps and determining the data query tool corresponding to each analysis step. By providing an alarm analysis script and executing the alarm analysis script, at least one analysis step of the first alarm event and a data query tool corresponding to at least one analysis step can be automatically generated, thereby improving the efficiency and intelligence level of alarm analysis.

[0054] In some possible implementations, the alarm analysis script can be converted from a standard operating procedure (SOP) document. The SOP document is usually represented in natural language and records the process of alarm analysis by security operators. In other words, the SOP document includes alarm analysis records related to the alarm analysis process.

[0055] In the specific implementation, the SOP document is obtained and sent to the second language model so that the second language model can identify the alarm type, extract the analysis steps, determine the data query tool, and generate an alarm analysis script from the SOP document. Then, the alarm analysis script corresponding to the alarm type output by the second language model is received.

[0056] Among them, the second language model has natural language processing capabilities, can understand natural language meanings, and process different types of natural language tasks. For example, the second target model can be a deep learning model trained using text data. In an embodiment of the present application, since the SOP document is represented in natural language, the SOP document is identified and analyzed by means of the natural language processing capabilities of the language model, and the SOP document represented in natural language is converted into an alarm analysis script that can be read and executed by a computing device.

[0057] The second language model can generate an alarm analysis script based on prompt learning. Among them, prompt words can be used to guide the language model to perform specific outputs in generative tasks (such as text generation tasks, question-answering tasks, and dialogue tasks). By configuring prompt words, the language model can understand the background and requirements of the task, and the language model can handle different types of natural language processing tasks without retraining the language model, thereby increasing the scalability and flexibility of the language model.

[0058] In an embodiment of the present application, the prompt word may include content that instructs the second language model to extract analysis steps from the SOP document. For example, the prompt word may include information that instructs the second language model to extract timestamps, executing users, executing actions, platform information, operating resource objects, etc. from the SOP document, and determine the content of at least one analysis step based on the extracted information. In this way, with the help of the prompting ability of the prompt word, the second language model can convert the alarm analysis record in the SOP document into at least one analysis step.

[0059] In addition, the prompt word may also include descriptive information of different data query tools and content that instructs the second language model to determine the data query tools corresponding to each analysis step. Among them, the descriptive information of the data query tool can be understood as information describing the functions, input parameters, and output parameters of the data query tool. In this way, with the help of the prompting ability of the prompt word, the second language model can determine the data query tool corresponding to at least one analysis step based on the alarm analysis record in the SOP document, and then obtain the alarm analysis script.

[0060] In some embodiments, the SOP documents are pre-classified based on the alarm type. The second language model is used to identify and analyze SOP documents of different alarm types, and alarm analysis scripts corresponding to different alarm types can be generated. For example, the SOP documents include SOP document A of alarm type A and SOP document B of alarm type B. The second language model identifies and analyzes SOP document A of alarm type A, generates an alarm analysis script corresponding to alarm type A, and the second language model identifies and analyzes SOP document B of alarm type B, and generates an alarm analysis script corresponding to alarm type B.

[0061] In other embodiments, the SOP document is not pre-classified, that is, the SOP document includes alarm analysis records of different alarm types. The SOP document is identified and analyzed using the second language model to generate an alarm analysis script, and then the alarm analysis script is classified using the second language model to obtain alarm analysis scripts corresponding to different alarm types. For example, SOP document A includes alarm analysis records for alarm events of alarm type A and alarm analysis records for alarm events of alarm type B. The second language model identifies and analyzes SOP document A to generate an alarm analysis script, and then the second language model is used to classify the alarm analysis script according to the alarm type to obtain the alarm analysis script corresponding to alarm type A and the alarm analysis script corresponding to alarm type B.

[0062] The key alarm data in the first alarm event may be the alarm data in at least one alarm message related to the first alarm event. In an embodiment of the present application, the key alarm data may be data corresponding to a key field in at least one alarm message related to the first alarm event. For example, the key fields may include a detection time field, an operation status field, an impact range field, a detection source field, an account identification field, a security credential name field, a security credential access key (AK) field, a service name field, a service area field, a call interface field, a call interface version field, a request Internet Protocol (IP) address field, etc.

[0063] S103: For each analysis step, perform the following steps: send the key alarm data and the description information of the data query tool corresponding to the analysis step to the first language model, receive the query parameters output by the first language model, and based on the query parameters, call the data query tool corresponding to the analysis step to obtain related data.

[0064] After determining at least one analysis step of the first alarm event, each analysis step may be automatically executed according to the execution order, and associated data may be obtained in each analysis step.

[0065] In the embodiment of the present application, in each analysis step, the query parameter is determined by means of the first language model. The query parameter can be understood as the parameter value required to call the data query tool. In the embodiment of the present application, the query parameter can be extracted from the key alarm data of the first alarm event.

[0066] Similar to the second language model, the first language model has natural language processing capabilities, can understand the meaning of natural language, and process different types of natural language tasks. For example, the first target model can be a deep learning model trained using text data.

[0067] Similarly, the first language model can determine the query parameters based on the prompt learning method. The prompt word may include content that instructs the first language model to determine the query parameters from the alarm key data in combination with the description information of the data query tool. In this way, with the help of the prompt ability of the prompt word, the first language model can determine the parameter field required to call the data query tool from the description information of the data query tool, and extract the query parameters matching the parameter field from the alarm key data.

[0068] After the first language model outputs the query parameter, the data query tool is called using the query parameter to obtain the associated data related to the first alarm event. In some embodiments, the first alarm event is related to at least one of the target device, the target account, or the target business. For example, the first alarm event may be an alarm event generated after at least one of the target device, the target account, or the target business is abnormal. At this time, the associated data may include at least one of the following: a process log of the target device, an access behavior log of the target account, or business data of the target business.

[0069] That is to say, the associated data may include data related to the device, account or business involved in the first alarm event. The following is an explanation of different data query tools. When the data query tool is a tool for querying the security credential AK by account name, the query parameters may be the account name and timestamp. When the data query tool is a tool for querying the security credential AK by AK, the query parameters may be AK and timestamp. When the data query tool is a tool for querying the security credential AK by account identifier, the query parameters may be account identifier and timestamp. When the data query tool is a tool for querying the security credential AK by IP address, the query parameters may be IP address and timestamp. When the data query tool is a tool for querying the operation log from a multi-cloud system, the query parameters may be account identifier and timestamp. When the data query tool is a tool for querying the process log, the query parameters may be IP address, host identifier and timestamp. When the data query tool is a tool for querying the access behavior log, the query parameters may be host identifier, account identifier and timestamp. When the data query tool is a tool for querying business data, the query parameters may be security credential AK, business identifier and timestamp.

[0070] In this way, through different data query tools corresponding to different analysis steps, it is possible to obtain related data of different dimensions and types, and find more data related to the first alarm event, so that the related data can be combined later to more accurately determine the cause of the first alarm event and implement targeted alarm handling.

[0071] S104: Send the first alarm event and the associated data obtained in each analysis step to the first language model, and receive the alarm analysis result output by the first language model.

[0072] In the embodiment of the present application, after obtaining the associated data in each analysis step, the first alarm event is analyzed with the help of the first language model in combination with the associated data obtained in each analysis step to obtain an alarm analysis result.

[0073] Similarly, the first language model can generate an alarm analysis result based on prompt learning. Among them, the prompt word can include content that instructs the first language model to analyze the first alarm event in combination with the associated data obtained in each analysis step. In this way, with the help of the prompt ability of the prompt word, the first language model can analyze the associated data and at least one alarm information related to the first alarm event together, identify the root cause of the alarm, locate the root cause of the problem, analyze the alarm trend, identify the content that needs to be focused on, and then generate the alarm analysis result.

[0074] S105: Handle the first alarm event according to the alarm analysis result.

[0075] By analyzing the first alarm event to obtain an alarm analysis result of the first alarm event, the first alarm event can be handled in a targeted manner in combination with the content of the alarm analysis result.

[0076] In some embodiments, the alarm analysis result may include information for handling the first alarm event. Specifically, at least one treatment tool and a treatment parameter corresponding to the at least one treatment tool may be determined according to the alarm analysis result, and then, based on the treatment parameter, the at least one treatment tool is called to handle the first alarm event.

[0077] That is to say, the alarm analysis result output by the first language model includes the recommended handling method for the first alarm event, and specifically provides the handling tool required to handle the first alarm event, as well as the handling parameters for calling the handling tool. In this way, the handling tool is called using the handling parameters to realize the automatic handling of the first alarm event, thereby improving the efficiency of alarm handling. At the same time, since the alarm analysis result is generated in combination with rich, multi-dimensional associated data, the alarm handling is more accurate.

[0078] In this method, the analysis process for alarm events is divided into multiple analysis steps. In each analysis step, the key alarm data in the alarm event is used to obtain the associated data related to the alarm event, and the alarm event is analyzed together with the associated data in each analysis step. In this way, the alarm analysis results obtained are more comprehensive and rich, and accurate and targeted alarm handling is achieved. In addition, the natural cause processing capability of the language model is used to determine the query parameters for calling the data query tool and generate the alarm analysis results, so that the analysis process for the alarm event can be automatically executed, improving the efficiency of the alarm analysis, and thus improving the security protection capabilities of cloud security products such as the Cloud Workload Protection Platform (CWPP), Cloud Security Center, and Container Security Protection Platform.

[0079] The foregoing describes the alarm handling method provided in the embodiment of the present application, and the following will introduce it in conjunction with specific scenarios.

[0080] See also Figure 2 As shown in the flowchart of the alarm handling method, the server for performing alarm handling provided in the embodiment of the present application may include an alarm analyzer and an alarm handler. The alarm analyzer is used to automatically analyze alarm events, and the alarm handler is used to automatically handle alarm events.

[0081] Specifically, the second language model converts the SOP document described in natural language into an alarm analysis script that can be read and executed by a computing device based on the description information of the data query tool. When a first alarm event occurs, the alarm analyzer executes the alarm analysis script corresponding to the target alarm type of the first alarm event, determines at least one analysis step (for example, analysis step 1, analysis step 2, ...) and the data query tool corresponding to each analysis step.

[0082] For each analysis step, the alarm analyzer calls the first language model, and the first language model determines the query parameters based on the key alarm data and the description information of the data query tool corresponding to the analysis step. The alarm analyzer calls the data query tool based on the query parameters to obtain the associated data. After obtaining the associated data of each analysis step, the alarm analyzer calls the first language model, and the first language model analyzes the first alarm event based on the associated data of each analysis step to generate an alarm analysis result. The alarm analysis result may include a disposal tool and a disposal parameter corresponding to the disposal tool.

[0083] The alarm analyzer sends the alarm analysis result to the alarm handler. The alarm handler calls the corresponding handling tool based on the handling parameters to handle the first alarm event and complete the alarm handling process.

[0084] In some embodiments, Figure 2As shown, the alarm analyzer can also perform alarm analysis in combination with historical alarm data. Specifically, historical alarm data is obtained from the alarm database, wherein the historical alarm data includes alarm data of alarm events of the same alarm type as the first alarm event, and / or alarm data similar to key alarm data of the first alarm event.

[0085] The alarm database may be understood as a database including alarm data in multiple historical time periods. Usually, the alarm data in the alarm database has been processed. In other words, the alarm database may also include processing information of the alarm data in multiple historical time periods. The alarm data in the alarm database and the corresponding processing information may be stored in association.

[0086] In an embodiment of the present application, alarm data similar to the first alarm event is screened out from the alarm database, such as alarm data of alarm events of the same alarm type, or alarm data similar to key alarm data of the first alarm event. Since the historical alarm data is similar to the first alarm event and the historical alarm data has been processed by alarm, in the process of performing alarm analysis on the first alarm event, alarm analysis can also be performed in combination with the historical alarm data to further enrich the data types and data dimensions.

[0087] In a specific implementation, the first alarm event, the associated data obtained in each analysis step, and the historical alarm data are sent to the first language model, and the alarm analysis result output by the first language model is received. In this case, the prompt word may include content that instructs the first language model to analyze the first alarm event in combination with the associated data obtained in each analysis step and the historical alarm data. In this way, with the help of the prompting ability of the prompt word, the first language model can analyze the associated data, the historical alarm data, and at least one alarm information related to the first alarm event together, generate an alarm analysis result, and enhance the accuracy of the alarm analysis.

[0088] The following is an explanation of the process of establishing the alarm database. Figure 3 The flowchart of establishing an alarm database shown in the figure first obtains multiple alarm data, vectorizes the multiple alarm data, determines the vector representations corresponding to the multiple alarm data, and establishes the alarm database according to the vector representations corresponding to the multiple alarm data.

[0089] Among them, vectorization processing (embedding) can be understood as the process of converting information represented by text into information represented by vectors. For example, vectorization processing may include text segmentation of alarm data, generating alarm data blocks, embedding the alarm data blocks using vector models, generating vector representations of the alarm data blocks, and storing the vector representations of the alarm data blocks in the alarm database.

[0090] In an embodiment of the present application, the alarm data is stored in the alarm database in the form of vector representation. When the alarm analyzer retrieves historical alarm data from the alarm database, efficient retrieval can be achieved, thereby improving the efficiency of obtaining historical alarm data and further improving the efficiency of alarm analysis.

[0091] Continue to see Figure 2 The alarm analyzer can perform alarm analysis on multiple alarm events, and multiple alarm events can be arranged in the form of an alarm queue. Among them, the alarm queue can include alarm events to be processed in this alarm handling process, and this alarm handling process can be understood as an alarm handling process triggered by the first alarm event.

[0092] In a specific implementation, in response to the associated data obtained in at least one analysis step hitting an alarm rule, a second alarm event is generated, and the second alarm event is added to an alarm queue.

[0093] That is to say, in an embodiment of the present application, after a first alarm event occurs, related data can be obtained in each analysis step of analyzing the first alarm event, and the related data obtained in each analysis step can generate a new alarm event. The alarm event generated by the related data can belong to the alarm handling process with the first alarm event.

[0094] In other words, in addition to the first alarm event, the alarm queue can also include the second alarm event generated by the associated data obtained in each analysis step of the first alarm event. In this way, the associated data can be used to assist in alarm analysis on the one hand, and can be used to automatically detect other alarm events associated with the first alarm event on the other hand, speeding up the operation efficiency of cloud security protection products and ensuring the security of computing devices or virtual operating environments.

[0095] Considering that the analysis process for the first alarm event may involve more analysis steps, and each analysis step may obtain more related data, the embodiment of the present application can also add a verification operation in each analysis step. Specifically, in response to the existence of a data query tool corresponding to the first analysis step and a data query tool corresponding to the second analysis step being the same, and the query parameters in the first analysis step and the query parameters in the second analysis step being the same, the operation of calling the data query tool corresponding to the second analysis step is refused.

[0096] Among them, the first analysis step and the second analysis step are any two analysis steps in the current alarm handling process, and the second analysis step is located after the first analysis step. That is to say, after the first language model outputs the query parameter, the alarm analyzer can determine whether the data query tool and query parameter in the analysis step are consistent with the data query tool and query parameter in the analysis step that has been executed in the current alarm handling process. If they are consistent, it means that the associated data obtained in the analysis step is consistent with the associated data obtained in the analysis step that has been executed in the current alarm handling process, and then refuse to execute the operation of calling the data query tool in the analysis step to obtain the associated data, so as to avoid repeated acquisition of associated data and save computing resources.

[0097] For example, the analysis of the first alarm event includes analysis step 1 and analysis step 2. Analysis step 1 corresponds to data query tool A. In analysis step 1, the first language model outputs query parameter A. The alarm analyzer calls data query tool A based on query parameter A to obtain associated data A. Analysis step 2 corresponds to data query tool A. In analysis step 2, the first language model outputs query parameter A. The alarm analyzer determines that the data query tool corresponding to analysis step 2 is the same as the data query tool corresponding to analysis step 1, and the query parameter in analysis step 2 is also the same as the query parameter in analysis step 1. Therefore, the alarm analyzer does not perform the operation of calling the data query tool in analysis step 2.

[0098] In other examples, the alarm queue also includes a second alarm event. After completing the analysis process of the first alarm event, the alarm analyzer can analyze the second alarm event. The analysis of the second alarm event includes analysis step 3, analysis step 3 corresponds to data query tool A, and the first language model outputs query parameter A in analysis step 3. The alarm analyzer determines that the data query tool corresponding to analysis step 3 is the same as the data query tool corresponding to analysis step 1, and the query parameters in analysis step 2 are also the same as the query parameters in analysis step 1. Therefore, the alarm analyzer does not perform the operation of calling the data query tool in analysis step 3.

[0099] Furthermore, considering that the same associated data may be obtained through different query parameters or different data query tools, the embodiment of the present application may also add a data judgment operation in each analysis step. Specifically, in response to the existence of the associated data obtained in the third analysis step being the same as the associated data obtained in the fourth analysis step, the associated data obtained in the fourth analysis step is discarded.

[0100] Among them, the third analysis step and the fourth analysis step are any two analysis steps in the current alarm handling process, and the fourth analysis step is located after the third analysis step. That is to say, after the alarm analyzer calls the data query tool corresponding to a certain analysis step and obtains the associated data of the analysis step, the alarm analyzer can determine whether the associated data obtained by the analysis step is consistent with the associated data obtained in the analysis step that has been executed in the current alarm handling process. If they are consistent, the associated data obtained by the analysis step is discarded, that is, the operation of calling the data query tool in the analysis step is ignored to avoid using the same associated data to analyze the alarm event. At the same time, avoid the same associated data from generating the same alarm event, and prevent the same alarm event from being added to the alarm queue.

[0101] For example, the analysis of the first alarm event includes analysis step 1 and analysis step 2. Analysis step 1 corresponds to data query tool A. In analysis step 1, the first language model outputs query parameter A. The alarm analyzer calls data query tool A based on query parameter A to obtain associated data A. Analysis step 2 corresponds to data query tool B. In analysis step 2, the first language model outputs query parameter B. The alarm analyzer calls data query tool B based on query parameter B to obtain associated data A. The alarm analyzer determines that the associated data obtained in analysis step 2 is the same as the associated data obtained in analysis step 1. Therefore, the alarm analyzer discards the associated data obtained in analysis step 2.

[0102] In other examples, the alarm queue also includes a second alarm event. After completing the analysis process of the first alarm event, the alarm analyzer can analyze the second alarm event. The analysis of the second alarm event includes analysis step 3, analysis step 3 corresponds to data query tool C, the first language model in analysis step 3 outputs query parameter C, the alarm analyzer calls data query tool C based on query parameter C, obtains associated data A, and the alarm analyzer determines that the associated data obtained in analysis step 3 is the same as the associated data obtained in analysis step 1, so the alarm analyzer discards the associated data obtained in analysis step 3.

[0103] Combination of the above Figures 1 to 3 The alarm handling method provided in the embodiment of the present application is introduced in detail. The following will introduce the apparatus and equipment provided in the embodiment of the present application in conjunction with the accompanying drawings.

[0104] See also Figure 4 The structural diagram of the alarm handling device shown in FIG. 40 includes:

[0105] An acquisition module 401 is used to acquire a first alarm event;

[0106] A determination module 402 is used to determine at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step, and to extract key alarm data from the first alarm event;

[0107] The analysis module 403 is used to perform the following steps for each of the analysis steps: sending the key alarm data and the description information of the data query tool corresponding to the analysis step to the first language model, and receiving the query parameters output by the first language model; based on the query parameters, calling the data query tool corresponding to the analysis step to obtain the associated data;

[0108] The communication module 404 is used to send the first alarm event and the associated data obtained in each of the analysis steps to the first language model, and receive the alarm analysis result output by the first language model;

[0109] The handling module 405 is used to handle the first alarm event according to the alarm analysis result.

[0110] In some possible implementations, the determining module 402 is specifically configured to:

[0111] Identifying a target alarm type of the first alarm event;

[0112] An alarm analysis script corresponding to the target alarm type is executed to determine at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step.

[0113] In some possible implementations, the alarm analysis script is determined in the following manner:

[0114] Obtaining a standard operating procedure (SOP) document, wherein the SOP document includes an alarm analysis record represented by a natural language;

[0115] Sending the SOP document to a second language model so that the second language model identifies the alarm type, extracts the analysis steps, determines the data query tool, and generates an alarm analysis script from the SOP document;

[0116] An alarm analysis script corresponding to the alarm type and output by the second language model is received.

[0117] In some possible implementations, the first alarm event is related to at least one of a target device, a target account, or a target business;

[0118] The associated data includes at least one of the following: a process log of the target device, an access behavior log of the target account, or business data of the target business.

[0119] In some possible implementations, the apparatus 40 further includes a generating module, and the generating module is configured to:

[0120] In response to at least one of the associated data obtained in the analyzing step hitting an alarm rule, generating a second alarm event;

[0121] Add the second alarm event to the alarm queue; wherein the alarm queue includes the alarm events to be processed in the current alarm handling process.

[0122] In some possible implementations, the apparatus 40 further includes an execution module, and the execution module is configured to:

[0123] In response to the existence of a data query tool corresponding to the first analysis step that is the same as the data query tool corresponding to the second analysis step, and the query parameters in the first analysis step and the query parameters in the second analysis step are the same, refusing to execute the operation of calling the data query tool corresponding to the second analysis step; wherein the first analysis step and the second analysis step are any two analysis steps in the current alarm handling process, and the second analysis step is located after the first analysis step.

[0124] In some possible implementations, the execution module is further configured to:

[0125] In response to the existence of the same associated data obtained in the third analysis step and the associated data obtained in the fourth analysis step, the associated data obtained in the fourth analysis step is discarded; wherein the third analysis step and the fourth analysis step are any two analysis steps in the current alarm handling process, and the fourth analysis step is located after the third analysis step.

[0126] In some possible implementations, the acquisition module 401 is further configured to:

[0127] Acquire historical alarm data from an alarm database; the historical alarm data includes alarm data of alarm events of the same alarm type as the first alarm event, and / or alarm data similar to key alarm data of the first alarm event;

[0128] The communication module 404 is specifically used for:

[0129] The first alarm event, the associated data obtained in each of the analysis steps, and the historical alarm data are sent to the first language model, and an alarm analysis result output by the first language model is received.

[0130] In some possible implementations, the alarm database is established in the following manner:

[0131] Get multiple alarm data;

[0132] Performing vectorization processing on the plurality of pieces of warning data to determine vector representations corresponding to the plurality of pieces of warning data;

[0133] An alarm database is established according to the vector representations corresponding to the plurality of alarm data.

[0134] In some possible implementations, the handling module 405 is specifically used to:

[0135] determining, according to the alarm analysis result, at least one treatment tool and a treatment parameter corresponding to the at least one treatment tool;

[0136] Based on the treatment parameters, the at least one treatment tool is called to treat the first alarm event.

[0137] The alarm handling device 40 according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the alarm handling device 40 are respectively to implement Figures 1 to 3 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0138] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 4 The functions of the alarm handling device 40 in the illustrated embodiment.

[0139] Figure 5 A schematic diagram of the structure of an electronic device 500 is provided. Figure 5 As shown, the electronic device 500 includes a bus 501, a processor 502, a communication interface 503 and a memory 504. The processor 502, the memory 504 and the communication interface 503 communicate with each other via the bus 501.

[0140] The bus 501 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0141] The processor 502 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0142] The communication interface 503 is used for communicating with the outside. For example, the communication interface 503 can be used for communicating with a terminal.

[0143] The memory 504 may include a volatile memory, such as a random access memory (RAM). The memory 504 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0144] The memory 504 stores executable codes, and the processor 502 executes the executable codes to perform the aforementioned alarm handling method.

[0145] Specifically, in implementing Figure 4 In the case of the embodiment shown, and Figure 4 When each module or unit of the alarm handling device 40 described in the embodiment is implemented by software, the execution Figure 4 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 504. The processor 502 executes the program code corresponding to each unit stored in the memory 504 to execute the above-mentioned alarm handling method.

[0146] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned alarm handling method applied to the alarm handling device 40.

[0147] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0148] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0149] When the computer program product is executed by a computer, the computer executes any of the aforementioned alarm handling methods. The computer program product may be a software installation package, and when any of the aforementioned alarm handling methods is needed, the computer program product may be downloaded and executed on a computer.

[0150] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0151] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0152] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0153] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0154] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0155] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0156] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0157] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0158] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An alarm handling method, characterized in that: The method comprises: Get the first alarm event; Determining at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step, and extracting key alarm data from the first alarm event; For each of the analysis steps, the following steps are performed: sending the key alarm data and description information of the data query tool corresponding to the analysis step to the first language model, and receiving the query parameters output by the first language model; based on the query parameters, calling the data query tool corresponding to the analysis step to obtain associated data; Sending the first alarm event and the associated data obtained in each of the analysis steps to the first language model, and receiving the alarm analysis result output by the first language model; According to the alarm analysis result, the first alarm event is handled.

2. The method according to claim 1, characterized in that: The at least one analysis step for determining the first alarm event and a data query tool corresponding to the at least one analysis step include: Identifying a target alarm type of the first alarm event; An alarm analysis script corresponding to the target alarm type is executed to determine at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step.

3. The method according to claim 2, characterized in that The alarm analysis script is determined in the following manner: Obtaining a standard operating procedure (SOP) document, wherein the SOP document includes an alarm analysis record represented by a natural language; Sending the SOP document to a second language model so that the second language model identifies the alarm type, extracts the analysis steps, determines the data query tool, and generates an alarm analysis script from the SOP document; An alarm analysis script corresponding to the alarm type and output by the second language model is received.

4. The method according to claim 1, characterized in that: The first alarm event is related to at least one of a target device, a target account or a target business; The associated data includes at least one of the following: a process log of the target device, an access behavior log of the target account, or business data of the target business.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: In response to at least one of the associated data obtained in the analyzing step hitting an alarm rule, generating a second alarm event; Add the second alarm event to the alarm queue; wherein the alarm queue includes the alarm events to be processed in the current alarm handling process.

6. The method according to claim 5, characterized in that The method further comprises: In response to the existence of a data query tool corresponding to the first analysis step that is the same as the data query tool corresponding to the second analysis step, and the query parameters in the first analysis step and the query parameters in the second analysis step are the same, refusing to execute the operation of calling the data query tool corresponding to the second analysis step; wherein the first analysis step and the second analysis step are any two analysis steps in the current alarm handling process, and the second analysis step is located after the first analysis step.

7. The method according to claim 5, characterized in that The method further comprises: In response to the existence of the same associated data obtained in the third analysis step and the associated data obtained in the fourth analysis step, the associated data obtained in the fourth analysis step is discarded; wherein the third analysis step and the fourth analysis step are any two analysis steps in the current alarm handling process, and the fourth analysis step is located after the third analysis step.

8. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Acquire historical alarm data from an alarm database; the historical alarm data includes alarm data of alarm events of the same alarm type as the first alarm event, and / or alarm data similar to key alarm data of the first alarm event; The sending the first alarm event and the associated data obtained in each of the analysis steps to the first language model, and receiving the alarm analysis result output by the first language model, includes: The first alarm event, the associated data obtained in each of the analysis steps, and the historical alarm data are sent to the first language model, and an alarm analysis result output by the first language model is received.

9. The method according to claim 8, characterized in that The alarm database is established in the following manner: Get multiple alarm data; Performing vectorization processing on the plurality of pieces of warning data to determine vector representations corresponding to the plurality of pieces of warning data; An alarm database is established according to the vector representations corresponding to the plurality of alarm data.

10. The method according to any one of claims 1 to 4, characterized in that: The handling of the first alarm event according to the alarm analysis result includes: determining, according to the alarm analysis result, at least one treatment tool and a treatment parameter corresponding to the at least one treatment tool; Based on the treatment parameters, the at least one treatment tool is called to treat the first alarm event.

11. An alarm handling device, characterized in that: The device comprises: An acquisition module, used for acquiring a first alarm event; A determination module, configured to determine at least one analysis step of the first alarm event and a data query tool corresponding to the at least one analysis step, and to extract key alarm data from the first alarm event; The analysis module is used to perform the following steps for each of the analysis steps: sending the key alarm data and description information of the data query tool corresponding to the analysis step to the first language model, and receiving the query parameters output by the first language model; based on the query parameters, calling the data query tool corresponding to the analysis step to obtain related data; A communication module, used for sending the first alarm event and the associated data obtained in each of the analysis steps to the first language model, and receiving the alarm analysis result output by the first language model; A handling module is used to handle the first alarm event according to the alarm analysis result.

12. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 10.

Images