Alarm clustering topology method and system based on multi-dimensional features

Abstract

The invention discloses an alarm clustering topology method and system based on multi-dimensional features, belongs to the technical field of network security, and aims to solve the technical problems of poor timeliness, multiple repeated false alarms and low association degree of network alarm information processing. Comprising the steps of collecting original alarm information; performing multi-dimensional aggregation on the pre-processed alarm information based on a set alarm dimension; calculating the alarm weight of each alarm set based on the weight of each reference factor; clustering each alarm set based on the new alarm dimension; screening the alarm information of alarm convergence based on a predefined rule base; calculating the alarm number and the alarm weight sum between each pair of IP node addresses, and calculating the thickness and the color depth of a side line according to the normalized weight sum; an IP node topological graph and side boundary thickness and color depth information are constructed through a visual tool, and a topological relation graph between IP nodes is drawn; and visually displaying the alarm information.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an alarm clustering topology method and system based on multi-dimensional features. Background Art

[0002] In modern network security protection, various security devices such as firewalls, website application-level intrusion prevention systems, situational awareness, etc. generate a large amount of alarm information. However, most of these alarm information are highly time-sensitive and need to be processed in a short time. Since the sources of alarm information are wide and frequent, many alarm information will be repeatedly reported in a short period of time, or the same alarm will be falsely reported due to accidental factors. These repeated and false alarm information seriously affects the work efficiency of security analysts and increases the complexity of alarm processing.

[0003] Existing alarm information processing methods usually lack effective analysis of alarm correlation and cannot fully identify and aggregate highly correlated alarm information. For example, multiple attacks from the same attack source or against the same target, or continuous attacks on the same target in different time periods, are often regarded as independent alarm information, resulting in redundancy and inefficiency in alarm processing. In addition, when faced with massive alarm data, existing methods are difficult to provide global perspective of attack situation awareness, and cannot help security personnel fully understand and analyze the overall situation of network attacks.

[0004] Poor timeliness of network alarm information processing, many repeated false alarms and low correlation are technical problems that need to be solved. Summary of the invention

[0005] The technical task of the present invention is to address the above shortcomings and provide an alarm clustering topology method and system based on multidimensional features to solve the technical problems of poor timeliness of network alarm information processing, many repeated false alarms and low correlation.

[0006] In a first aspect, the present invention provides an alarm clustering topology method based on multidimensional features, comprising the following steps:

[0007] Data collection: collect original alarm information from various security devices in real time, clean and format the original alarm information, and obtain pre-processed alarm information;

[0008] Multi-dimensional aggregation: Based on the set alarm dimension, the pre-processed alarm information is aggregated in multiple dimensions. The alarm information with the same alarm dimension is formed into a set, and the alarm information in the set is aggregated through the sliding window method to obtain an alarm set Tk within a series of time windows. The alarm dimension includes the alarm name, alarm type and five-tuple features. The five-tuple features include the source IP node address, the destination IP node address, the source IP node port, the destination IP node port and the protocol number.

[0009] Set weight calculation: select alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor;

[0010] Alarm convergence: Add alarm weight and alarm time to build a new alarm dimension. Cluster each alarm set based on the new alarm dimension to form a new alarm information as the alarm information of alarm convergence;

[0011] Alarm information filtering: Based on the predefined rule base, the alarm information of alarm convergence is filtered to filter out known false alarms and invalid alarms, and the filtered alarm information is obtained, and the corresponding valid alarm set is obtained;

[0012] Alarm analysis: Based on the valid alarm set, the number of alarms and the total alarm weight between each pair of IP node addresses are calculated, the total alarm weight is normalized, and the edge thickness and color depth are calculated based on the normalized total weight;

[0013] Topology map construction: Based on the source IP node address and destination IP node address in the valid alarm set, as well as the thickness and color depth of the edge line, the visualization tool is used to construct the IP node topology map and the edge thickness and color depth information, and the topological relationship diagram between the IP nodes is drawn;

[0014] Alarm information visualization: Alarm information is visualized through the IP node topology diagram of the alarm dimension.

[0015] Preferably, for each alarm set, the alarm weight calculation formula is as follows:

[0016]

[0017] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0018] Preferably, the alarm information of alarm convergence is screened based on a predefined rule base, comprising the following steps:

[0019] Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm;

[0020] Traverse the alarm information, if the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time, if the current alarm information does not successfully match the rules in the rule base, retain the current alarm information;

[0021] Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0022] Preferably, the alarm analysis includes the following steps:

[0023] Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0024] Normalize the sum of weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of weights between each pair of IP node addresses The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0025]

[0026] Among them, W ij represents the sum of weights between IP node address i and IP node address j, and n represents the number of alarms between IP node address i and IP node address j;

[0027] Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

[0028] Preferably, when constructing a topology map, the source IP node address and the destination IP node address as well as the thickness and color depth of the edge are stored in a data structure, and a topology map of the IP nodes and the information of the thickness and color depth of the edge are constructed through a visualization tool, a topology map between the IP nodes is drawn, and the details and weight information of the topology map are displayed in a visualization interface through click and zoom operations;

[0029] Correspondingly, when the alarm information is visualized, the IP node topology map is visualized through the visualization interface, the changes and relevance of the alarm information are dynamically displayed by adjusting the alarm time window, and the alarm source tracing analysis is performed based on the IP node topology map.

[0030] In a second aspect, the present invention provides an alarm clustering topology system based on multidimensional features, which is used to realize the alarm clustering topology by using an alarm clustering topology method based on multidimensional features as described in any one of the first aspects, wherein the system includes a data collection module, a multidimensional aggregation module, a set weight calculation module, an alarm convergence module, an alarm information filtering module, an alarm analysis module, a topology map construction module, and an alarm information visualization module;

[0031] The data collection module is used to perform the following: collect original alarm information from various security devices in real time, and perform data cleaning and formatting operations on the original alarm information to obtain pre-processed alarm information;

[0032] The multi-dimensional aggregation module is used to perform the following: based on the set alarm dimension, the pre-processed alarm information is aggregated in multiple dimensions, the alarm information with the same alarm dimension is formed into a set, and the alarm information in the set is aggregated by the sliding window method to obtain an alarm set Tk within a series of time windows, where the alarm dimension includes the alarm name, the alarm type and the five-tuple feature, and the five-tuple feature includes the source IP node address, the destination IP node address, the source IP node port, the destination IP node port and the protocol number;

[0033] The set weight calculation module is used to perform the following: select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor;

[0034] The alarm convergence module is used to perform the following: add alarm weights and alarm times to construct new alarm dimensions, cluster each alarm set based on the new alarm dimensions, and form a new alarm message as alarm information for alarm convergence;

[0035] The alarm information filtering module is used to perform the following: based on the predefined rule base, the alarm information of the alarm convergence is filtered, and known false alarms and invalid alarms are filtered out to obtain the filtered alarm information, and correspondingly obtain the valid alarm set;

[0036] The alarm analysis module is used to perform the following: based on the valid alarm set, calculate the number of alarms between each pair of IP node addresses and the sum of alarm weights, normalize the sum of alarm weights, and calculate the edge thickness and color depth according to the normalized sum of weights;

[0037] The topology map construction module is used to perform the following: construct an IP node topology map and edge thickness and color depth information through a visualization tool according to the source IP node address and the destination IP node address and the edge thickness and color depth information in the valid alarm set, and draw a topology relationship map between IP nodes;

[0038] The alarm information visualization module is used to perform the following: visualize the alarm information through the IP node topology diagram of the alarm dimension.

[0039] Preferably, for each alarm set, the alarm weight calculation formula is as follows:

[0040]

[0041] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0042] Preferably, the alarm information filtering module is used to perform the following steps to filter the alarm information of alarm convergence based on a predefined rule base:

[0043] Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm;

[0044] Traverse the alarm information, if the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time, if the current alarm information does not successfully match the rules in the rule base, retain the current alarm information;

[0045] Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0046] Preferably, the alarm analysis module is used to perform the following:

[0047] Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0048] Normalize the sum of weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of weights between each pair of IP node addresses The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0049]

[0050]

[0051] Among them, W ij represents the sum of weights between IP node address i and IP node address j, and n represents the number of alarms between IP node address i and IP node address j;

[0052] Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

[0053] Preferably, when constructing a topology map, a topology map construction module is used to store the source IP node address and the destination IP node address as well as the edge thickness and color depth into a data structure, construct an IP node topology map and edge thickness and color depth information through a visualization tool, draw a topology relationship map between IP nodes, and display the topology relationship map details and weight information in a visualization interface through click and zoom operations;

[0054] Correspondingly, when the alarm information is visualized, the alarm information visualization module is used to visualize the IP node topology map through a visualization interface, dynamically display the changes and relevance of the alarm information by adjusting the alarm time window, and perform alarm tracing analysis based on the IP node topology map.

[0055] The multi-dimensional feature-based alarm clustering topology method and system of the present invention have the following advantages:

[0056] 1. In terms of the accuracy and efficiency of alarm processing, the multi-dimensional features including alarm name, alarm type, source address, destination address, source port, destination port, protocol number and alarm time are aggregated to effectively reduce redundant and false alarm information. The sliding time window method is used to aggregate the alarm information with the same features within the set time range, which greatly reduces the number of repeated alarms and improves the efficiency and accuracy of alarm processing. Compared with the existing method of aggregating only simple features, it can more comprehensively reflect the actual attack situation and improve the relevance of alarm information and the accuracy of processing;

[0057] 2. The effect of alarm analysis is further enhanced by calculating the alarm weight and drawing the IP node topology map of the alarm dimension. The calculation of the alarm weight comprehensively considers factors such as the alarm level, frequency and time interval, and uses Z-score standardization to normalize the correlation between IP nodes. By drawing the IP node topology map of the alarm dimension, security analysts can intuitively view the alarm correlation between IP nodes, clarify the attack source and path, and identify key nodes and key paths. The comprehensive analysis method based on weights and topology maps can more intuitively and accurately display the overall situation of network attacks compared with the simple alarm list or simple graphic display in the existing technology, helping security analysts to respond quickly and significantly improving the network security protection effect;

[0058] 3. Through the comparison of experimental data, under the same network environment and attack conditions, the time for processing alarms was shortened by 30%, the false alarm rate was reduced by 40%, and the accuracy in attack tracing and key node identification was improved by 30%, reflecting the superior performance in alarm information processing and network security protection. Through multi-dimensional feature aggregation, weight calculation and topology map display, the accuracy, efficiency and comprehensiveness of network alarm processing were significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0060] The present invention is further described below in conjunction with the accompanying drawings.

[0061] Figure 1 This is a flowchart of an alarm clustering topology method based on multidimensional features in Example 1;

[0062] Figure 2 This is an IP node topology diagram in Example 1, an alarm clustering topology method based on multi-dimensional features. DETAILED DESCRIPTION

[0063] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0064] The embodiments of the present invention provide an alarm clustering topology method and system based on multi-dimensional features, which are used to solve the technical problems of poor timeliness of network alarm information processing, many repeated false alarms and low correlation.

[0065] Embodiment 1:

[0066] The present invention discloses an alarm clustering topology method based on multi-dimensional features, which comprises eight steps: data collection, multi-dimensional aggregation, set weight calculation, alarm convergence, alarm information filtering, alarm analysis, topology graph modeling and alarm information visualization.

[0067] Step S100: Data collection: collecting original alarm information from various security devices in real time, and performing data cleaning and formatting operations on the original alarm information to obtain pre-processed alarm information.

[0068] Step S100 collects original alarm information from various security devices (such as firewalls, intrusion detection systems, situational awareness, etc.) in real time, cleans and formats the collected alarm information, and unifies the format for subsequent processing.

[0069] Step S200 multi-dimensional aggregation: perform multi-dimensional aggregation on the pre-processed alarm information based on the set alarm dimension, form a set based on the alarm information with the same alarm dimension, and aggregate the alarm information in the set through the sliding window method to obtain an alarm set Tk within a series of time windows, wherein the alarm dimension includes the alarm name, alarm type and five-tuple features, and the five-tuple features include the source IP node address, the destination IP node address, the source IP node port, the destination IP node port and the protocol number.

[0070] Step S200 alarm information multi-dimensional aggregation, first, perform preliminary integration on the pre-processed alarm information data set, which includes multi-dimensional attributes such as alarm name, alarm type, source IP address and target IP address, source port number and destination port number, and protocol number, and set a certain alarm time range threshold as the basis for analysis; the aggregation operation is based on the above multi-dimensional features, aiming to classify alarm records with the same alarm name, alarm type and five-tuple (source address, destination address, source port, destination port, protocol number) features into one category to form an independent set; next, use the sliding time window method to achieve dynamic aggregation In this embodiment, a time window of a specific length is defined to define the analysis interval. In each time window, the alarm records that share the same aggregation features in the set time period are aggregated to deepen the aggregation level of the data. As time goes by, the sliding window moves smoothly backward from the starting point Tstart, and each movement is equivalent to the distance of the window length. The rolling update step is continued until the entire specified time range is completely covered, and the alarm activity situation in the time series is provided through a series of continuous windows; finally, the output is a set of aggregated alarm records Tk in a series of time windows, and each set represents a comprehensive view of the alarm activity in its respective time window.

[0071] Step S300: Set weight calculation: select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor.

[0072] In step S300 of this embodiment, the comprehensive weight is calculated from the three dimensions of alarm level, frequency of occurrence and time interval. The three basic weight coefficients correspond to the severity of the alarm level, the density of the alarm frequency and the tightness of the alarm time interval. These coefficients weigh the impact of each evaluation aspect on the overall alarm urgency and importance. The specific implementation steps are as follows: assign a level score to each alarm according to the degree of danger of the alarm, ensuring that high-risk alarms receive a score significantly higher than low-risk alarms; by counting the frequency of repeated occurrence of alarms in Tk within a specific time period, a corresponding frequency score is given, and the higher the frequency, the higher the score; by measuring the interval time of alarm events inside Tk, short time intervals obtain higher time interval scores because they indicate concentrated outbreaks of alarm events; the last three scores are combined with the preset weight coefficients to calculate the comprehensive weight value of each set Tk. The comprehensive consideration mechanism of this embodiment effectively highlights those sets with high alarm levels, dense frequency of occurrence and compact time intervals. These sets will obtain higher weight values, thereby highlighting their importance.

[0073] As a specific implementation, for each alarm set, the alarm weight calculation formula is as follows:

[0074]

[0075] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0076] Step S400: Alarm convergence: New alarm weights and alarm times are added to construct new alarm dimensions, and each alarm set is clustered based on the new alarm dimensions to form a new alarm message as alarm convergence alarm message.

[0077] In step S400 of this embodiment, each alarm set Tk is clustered to form a new alarm information, wherein the new alarm dimensions include alarm name, alarm type, source address, destination address, source port, destination port, protocol number, alarm weight and alarm time.

[0078] Step S500: Alarm information filtering: based on a predefined rule base, the alarm information of alarm convergence is screened, known false alarms and invalid alarms are filtered out, and filtered alarm information is obtained, and correspondingly, a valid alarm set is obtained.

[0079] As a specific implementation of alarm information filtering, the alarm information of alarm convergence is filtered based on a predefined rule base, including the following steps:

[0080] (1) constructing a rule base, wherein the rule base includes rules describing the invalidity or false alarm nature of the alarm;

[0081] (2) traversing the alarm information, if the current alarm information successfully matches the invalid or false alarm rules in the rule base, the alarm information is marked as a false alarm within a certain period of time; if the current alarm information does not successfully match the rules in the rule base, the current alarm information is retained;

[0082] (3) Based on the constructed security model, the alarm information is analyzed for correlation and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0083] Step S600 alarm analysis: based on the valid alarm set, the number of alarms between each pair of IP node addresses and the sum of alarm weights are calculated, the sum of alarm weights is normalized, and the edge thickness and color depth are calculated according to the normalized sum of weights.

[0084] As a specific implementation of alarm analysis, the operation includes the following steps:

[0085] (1) traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0086] (2) The sum of the weights between each pair of IP node addresses is normalized through Z-score standardization, and all IP node pairs are traversed to calculate the sum of the weights W between each pair of IP node addresses. ij The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0087]

[0088] Among them, W ij represents the sum of weights between IP node address i and IP node address j, and n represents the number of alarms between IP node address i and IP node address j;

[0089] (3) Create a mapping table from the normalized weight sum to the edge thickness and color depth. Determine the edge thickness and color depth between IP nodes based on the normalized weight sum. The higher the weight sum, the thicker the edge and the darker the color, indicating a higher correlation between the two IPs. Add a weight mapping range to maintain consistency and comparability of visual effects across different datasets.

[0090] In this step, the number and weight of alarms between IPs are first calculated, and then normalized to ensure comparison consistency. The thickness and color of the edges are set according to the normalized weights, so as to intuitively display the association strength and importance of IPs on the topology map.

[0091] Step S700 topology map construction: According to the source IP node address and destination IP node address as well as the edge thickness and color depth in the valid alarm set, an IP node topology map and edge thickness and color depth information are constructed through a visualization tool to draw a topological relationship diagram between IP nodes.

[0092] In this embodiment, when constructing the topology map, the source IP node address and the destination IP node address as well as the edge thickness and color depth are stored in a data structure, and the IP node topology map and edge thickness and color depth information are constructed through a visualization tool, and a topological relationship map between IP nodes is drawn. The topological relationship map details and weight information are displayed in the visualization interface through click and zoom operations. Figure 2 shown.

[0093] Step S800: Alarm information visualization: Alarm information is visualized through an IP node topology diagram in the alarm dimension.

[0094] When visualizing alarm information in this embodiment, the IP node topology map is visualized through the visualization interface, the changes and relevance of alarm information are dynamically displayed by adjusting the alarm time window, and alarm source tracing analysis is performed based on the IP node topology map to track the attack source and attack path. Identify the key nodes and key paths in network attacks to help security analysts quickly locate and respond to attack events.

[0095] The method of this embodiment aggregates and converges alarm information through multi-dimensional features, reduces redundant alarms, and improves the accuracy and efficiency of alarm processing. At the same time, by using the calculated alarm weight and drawing the IP node topology diagram of the alarm dimension, the alarm correlation is displayed, helping security analysts to quickly locate and respond to attack events, fully understand the overall situation of network attacks, and significantly improve the network security protection effect.

[0096] Embodiment 2:

[0097] The present invention discloses an alarm clustering topology system based on multidimensional features, comprising a data collection module, a multidimensional aggregation module, a set weight calculation module, an alarm convergence module, an alarm information filtering module, an alarm analysis module, a topology map construction module and an alarm information visualization module.

[0098] The data collection module is used to perform the following: collect original alarm information from various security devices in real time, and perform data cleaning and formatting operations on the original alarm information to obtain pre-processed alarm information.

[0099] As a specific implementation, the data collection module is used to collect original alarm information from various security devices (such as firewalls, intrusion detection systems, situational awareness, etc.) in real time, clean and format the collected alarm information, and unify the format for subsequent processing.

[0100] The multi-dimensional aggregation module is used to perform the following: perform multi-dimensional aggregation on the pre-processed alarm information based on the set alarm dimension, form a set based on the alarm information with the same alarm dimension, and aggregate the alarm information in the set through the sliding window method to obtain an alarm set Tk within a series of time windows, where the alarm dimension includes the alarm name, alarm type and five-tuple features, and the five-tuple features include the source IP node address, destination IP node address, source IP node port, destination IP node port and protocol number.

[0101] As a specific implementation of the multi-dimensional aggregation module, the module first performs a preliminary integration of the pre-processed alarm information data set, which includes multi-dimensional attributes such as alarm name, alarm type, source IP address and target IP address, source port number and destination port number, and protocol number, and sets a certain alarm time range threshold as the basis for analysis; the aggregation operation is based on the above multi-dimensional features, aiming to classify alarm records with the same alarm name, alarm type and five-tuple (source address, destination address, source port, destination port, protocol number) characteristics into one category to form an independent set; the next step is to use the sliding time window method to achieve dynamic aggregation In summary, this embodiment defines a time window of a specific length for demarcating the analysis interval. In each time window, the alarm records that share the same aggregation features in the set time period are summarized to deepen the aggregation level of the data. As time goes by, the sliding window moves smoothly backward from the starting point Tstart, and each movement is equivalent to the distance of the window length. The rolling update steps are continued until the entire specified time range is completely covered, and the alarm activity status in the time series is provided through a series of continuous windows; finally, the output is a set of aggregated alarm records Tk in a series of time windows, and each set represents a comprehensive view of the alarm activity in its respective time window.

[0102] The set weight calculation module is used to perform the following: select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor.

[0103] In this embodiment, the set weight calculation module is used to calculate the comprehensive weight from the three dimensions of alarm level, frequency of occurrence and time interval. The three basic weight coefficients correspond to the severity of the alarm level, the density of the alarm frequency and the tightness of the alarm time interval. These coefficients weigh the impact of each evaluation aspect on the overall alarm urgency and importance. The specific implementation steps are as follows: assign a level score to each alarm according to the degree of danger of the alarm, ensuring that high-risk alarms receive a significantly higher score than low-risk alarms; by counting the frequency of repeated occurrence of alarms in Tk within a specific time period, a corresponding frequency score is given, and the higher the frequency, the higher the score; by measuring the interval time of alarm events inside Tk, short time intervals obtain higher time interval scores because they indicate the concentrated outbreak of alarm events; the last three scores are combined with the preset weight coefficients to calculate the comprehensive weight value of each set Tk. The comprehensive consideration mechanism of this embodiment effectively highlights those sets with high alarm levels, dense frequency of occurrence and compact time intervals. These sets will obtain higher weight values, thereby highlighting their importance.

[0104] As a specific implementation, for each alarm set, the alarm weight calculation formula is as follows:

[0105]

[0106] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0107] The alarm convergence module is used to perform the following: add alarm weights and alarm times to construct new alarm dimensions, cluster each alarm set based on the new alarm dimensions, and form a new alarm message as alarm information for alarm convergence.

[0108] In this embodiment, the alarm convergence module clusters each alarm set Tk to form a new alarm information, where the new alarm dimensions include alarm name, alarm type, source address, destination address, source port, destination port, protocol number, alarm weight and alarm time.

[0109] The alarm information filtering module is used to perform the following: based on a predefined rule base, the alarm information of alarm convergence is filtered, known false alarms and invalid alarms are filtered out, and the filtered alarm information is obtained, and correspondingly, a valid alarm set is obtained.

[0110] As a specific implementation of the alarm information filtering module, the module is used to perform the following to filter the alarm information of alarm convergence based on a predefined rule base:

[0111] (1) constructing a rule base, wherein the rule base includes rules describing the invalidity or false alarm nature of the alarm;

[0112] (2) traversing the alarm information, if the current alarm information successfully matches the invalid or false alarm rules in the rule base, the alarm information is marked as a false alarm within a certain period of time; if the current alarm information does not successfully match the rules in the rule base, the current alarm information is retained;

[0113] (3) Based on the constructed security model, the alarm information is analyzed for correlation and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0114] The alarm analysis module is used to perform the following: based on the valid alarm set, calculate the number of alarms and the sum of alarm weights between each pair of IP node addresses, normalize the sum of alarm weights, and calculate the edge thickness and color depth based on the normalized sum of weights.

[0115] As a specific implementation of the alarm analysis module, this module is used to perform the following operations:

[0116] (1) traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0117] (2) The sum of the weights between each pair of IP node addresses is normalized through Z-score standardization, and all IP node pairs are traversed to calculate the sum of the weights between each pair of IP node addresses. The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0118]

[0119]

[0120] Among them, W ij represents the sum of weights between IP node address i and IP node address j, and n represents the number of alarms between IP node address i and IP node address j;

[0121] (3) Create a mapping table from the normalized weight sum to the edge thickness and color depth. Determine the edge thickness and color depth between IP nodes based on the normalized weight sum. The higher the weight sum, the thicker the edge and the darker the color, indicating a higher correlation between the two IPs. Add a weight mapping range to maintain consistency and comparability of visual effects across different datasets.

[0122] In the above operation, the number and weight of alarms between IPs are first calculated, and then normalized to ensure comparison consistency. The thickness and color of the edge are set according to the normalized weight, so as to intuitively display the association strength and importance of the IP on the topology map.

[0123] The topology construction module is used to perform the following: based on the source IP node address and destination IP node address as well as the edge thickness and color depth in the valid alarm set, the IP node topology map and edge thickness and color depth information are constructed through a visualization tool to draw a topological relationship diagram between IP nodes.

[0124] When constructing a topology map in this embodiment, the topology map construction module is used to store the source IP node address and the destination IP node address as well as the edge thickness and color depth into a data structure, and construct the IP node topology map and the edge thickness and color depth information through a visualization tool, draw a topological relationship diagram between the IP nodes, and display the topological relationship diagram details and weight information on the visualization interface through click and zoom operations.

[0125] The alarm information visualization module is used to perform the following: visualize the alarm information through the IP node topology diagram of the alarm dimension.

[0126] When the alarm information is visualized in this embodiment, the alarm information visualization module is used to visualize the IP node topology map through a visualization interface, dynamically display the changes and relevance of the alarm information by adjusting the alarm time window, and perform alarm source tracing analysis based on the IP node topology map to track the attack source and attack path. Identify the key nodes and key paths in network attacks to help security analysts quickly locate and respond to attack events.

[0127] The system of this embodiment can execute the method disclosed in Example 1 to construct and display an alarm clustering map.

[0128] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. An alarm clustering topology method based on multidimensional features, characterized in that: The steps include: Data collection: collect original alarm information from various security devices in real time, clean and format the original alarm information, and obtain pre-processed alarm information; Multi-dimensional aggregation: Based on the set alarm dimension, the pre-processed alarm information is aggregated in multiple dimensions. The alarm information with the same alarm dimension is formed into a set, and the alarm information in the set is aggregated through the sliding window method to obtain an alarm set Tk within a series of time windows. The alarm dimension includes the alarm name, alarm type and five-tuple features. The five-tuple features include the source IP node address, the destination IP node address, the source IP node port, the destination IP node port and the protocol number. Set weight calculation: select alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor; Alarm convergence: Add alarm weight and alarm time to build a new alarm dimension. Cluster each alarm set based on the new alarm dimension to form a new alarm information as the alarm information of alarm convergence; Alarm information filtering: Based on the predefined rule base, the alarm information of alarm convergence is filtered to filter out known false alarms and invalid alarms, and the filtered alarm information is obtained, and the corresponding valid alarm set is obtained; Alarm analysis: Based on the valid alarm set, the number of alarms and the total alarm weight between each pair of IP node addresses are calculated, the total alarm weight is normalized, and the edge thickness and color depth are calculated based on the normalized total weight; Topology map construction: Based on the source IP node address and destination IP node address in the valid alarm set, as well as the thickness and color depth of the edge line, the visualization tool is used to construct the IP node topology map and the edge thickness and color depth information, and the topological relationship diagram between the IP nodes is drawn; Alarm information visualization: Alarm information is visualized through the IP node topology diagram of the alarm dimension.

2. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: For each alarm set, the alarm weight calculation formula is as follows: Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

3. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: The alarm information of alarm convergence is filtered based on the predefined rule base, including the following steps: Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm; Traverse the alarm information, if the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time, if the current alarm information does not successfully match the rules in the rule base, retain the current alarm information; Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

4. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: Alarm analysis includes the following steps: Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set; The sum of weights between each pair of IP node addresses is normalized through Z-score standardization, and all IP node pairs are traversed to calculate the sum of weights W between each pair of IP node addresses. ij The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows: Among them, W ij represents the sum of weights between IP node address i and IP node address j, and nn represents the number of alarms between IP node address i and IP node address j; Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

5. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: When constructing the topology map, the source IP node address and the destination IP node address as well as the thickness and color depth of the edge are stored in a data structure. The IP node topology map and the edge thickness and color depth information are constructed through a visualization tool, and the topology relationship map between the IP nodes is drawn. The topology relationship map details and weight information are displayed in the visualization interface through click and zoom operations; Correspondingly, when the alarm information is visualized, the IP node topology map is visualized through the visualization interface, the changes and relevance of the alarm information are dynamically displayed by adjusting the alarm time window, and the alarm source tracing analysis is performed based on the IP node topology map.

6. An alarm clustering topology system based on multi-dimensional features, characterized in that: Used to realize alarm clustering topology by an alarm clustering topology method based on multidimensional features as described in any one of claims 1 to 5, the system includes a data collection module, a multidimensional aggregation module, a set weight calculation module, an alarm convergence module, an alarm information filtering module, an alarm analysis module, a topology map construction module and an alarm information visualization module; The data collection module is used to perform the following: collect original alarm information from various security devices in real time, and perform data cleaning and formatting operations on the original alarm information to obtain pre-processed alarm information; The multi-dimensional aggregation module is used to perform the following: based on the set alarm dimension, the pre-processed alarm information is aggregated in multiple dimensions, the alarm information with the same alarm dimension is formed into a set, and the alarm information in the set is aggregated by the sliding window method to obtain an alarm set Tk within a series of time windows, where the alarm dimension includes the alarm name, the alarm type and the five-tuple feature, and the five-tuple feature includes the source IP node address, the destination IP node address, the source IP node port, the destination IP node port and the protocol number; The set weight calculation module is used to perform the following: select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor; The alarm convergence module is used to perform the following: add alarm weights and alarm times to construct new alarm dimensions, cluster each alarm set based on the new alarm dimensions, and form a new alarm message as alarm information for alarm convergence; The alarm information filtering module is used to perform the following: based on the predefined rule base, the alarm information of the alarm convergence is filtered, and known false alarms and invalid alarms are filtered out to obtain the filtered alarm information, and correspondingly obtain the valid alarm set; The alarm analysis module is used to perform the following: based on the valid alarm set, calculate the number of alarms between each pair of IP node addresses and the sum of alarm weights, normalize the sum of alarm weights, and calculate the edge thickness and color depth according to the normalized sum of weights; The topology map construction module is used to perform the following: construct an IP node topology map and edge thickness and color depth information through a visualization tool according to the source IP node address and the destination IP node address and the edge thickness and color depth information in the valid alarm set, and draw a topology relationship map between IP nodes; The alarm information visualization module is used to perform the following: visualize the alarm information through the IP node topology diagram of the alarm dimension.

7. The alarm clustering topology system based on multidimensional features according to claim 6 is characterized in that: For each alarm set, the alarm weight calculation formula is as follows: Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

8. The alarm clustering topology system based on multidimensional features according to claim 6, characterized in that: The alarm information filtering module is used to perform the following operations to filter the alarm information of alarm convergence based on a predefined rule base: Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm; Traverse the alarm information, if the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time, if the current alarm information does not successfully match the rules in the rule base, retain the current alarm information; Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

9. The alarm clustering topology system based on multidimensional features according to claim 6, characterized in that: The alarm analysis module is used to perform the following: Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set; The sum of weights between each pair of IP node addresses is normalized through Z-score standardization, and all IP node pairs are traversed to calculate the sum of weights W between each pair of IP node addresses. ij The mean μ and standard deviation σ of ij The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows: Among them, W ij represents the sum of weights between IP node address i and IP node address j, and n represents the number of alarms between IP node address i and IP node address j; Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

10. The alarm clustering topology system based on multidimensional features according to claim 6, characterized in that: When constructing a topology map, the topology map construction module is used to store the source IP node address and the destination IP node address as well as the edge thickness and color depth into a data structure, and to construct the IP node topology map and the edge thickness and color depth information through a visualization tool, draw a topology relationship map between IP nodes, and display the topology relationship map details and weight information in the visualization interface through click and zoom operations; Correspondingly, when the alarm information is visualized, the alarm information visualization module is used to visualize the IP node topology map through a visualization interface, dynamically display the changes and relevance of the alarm information by adjusting the alarm time window, and perform alarm tracing analysis based on the IP node topology map.

Images