Alarm clustering topology method and system based on multi-dimensional features

Abstract

The present invention discloses an alarm clustering topology method and system based on multidimensional features, belonging to the field of network security technology. The technical problems to be solved are poor timeliness of network alarm information processing, many repeated false alarms, and low correlation. The method comprises: collecting original alarm information; performing multi-dimensional aggregation on pre-processed alarm information based on set alarm dimensions; calculating the alarm weight of each alarm set based on the weight of each reference factor; clustering each alarm set based on the new alarm dimension; screening the alarm information of alarm convergence based on a predefined rule base; calculating the number of alarms and the sum of the alarm weights between each pair of IP node addresses, and calculating the edge thickness and color depth based on the normalized weight sum; constructing an IP node topology map and edge thickness and color depth information through a visualization tool, and drawing a topological relationship map between IP nodes; and visually displaying the alarm information.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an alarm clustering topology method and system based on multi-dimensional features. Background Art

[0002] In modern network security, various security devices, such as firewalls, website-application-level intrusion prevention systems, and situational awareness systems, generate a large number of alerts. However, the majority of these alerts are time-sensitive and require prompt processing. Due to the wide range and frequency of alerts, many alerts are repeatedly reported within a short period of time, or the same alert is mistakenly reported due to unforeseen circumstances. These duplications and false positives severely impact the work efficiency of security analysts and increase the complexity of alert processing.

[0003] Existing alert processing methods often lack effective analysis of alert correlation, making them unable to fully identify and aggregate highly correlated alerts. For example, multiple attacks from the same source or against the same target, or sustained attacks against the same target over different time periods, are often treated as independent alerts, leading to redundant and inefficient alert processing. Furthermore, existing methods struggle to provide a global perspective on attack situational awareness when faced with massive amounts of alert data, failing to help security personnel fully understand and analyze the overall cyberattack landscape.

[0004] Poor timeliness of network alarm information processing, many repeated false alarms, and low correlation are technical problems that need to be solved. Summary of the Invention

[0005] The technical task of the present invention is to address the above shortcomings and provide an alarm clustering topology method and system based on multidimensional features to solve the technical problems of poor timeliness of network alarm information processing, many repeated false alarms and low correlation.

[0006] In a first aspect, the present invention provides an alarm clustering topology method based on multidimensional features, comprising the following steps:

[0007] Data collection: Collect raw alarm information from various security devices in real time, clean and format the raw alarm information, and obtain pre-processed alarm information;

[0008] Multi-dimensional aggregation: Based on the set alarm dimensions, the pre-processed alarm information is aggregated in multiple dimensions. Alarm information with the same alarm dimension is grouped into a set, and the alarm information in the set is aggregated using the sliding window method to obtain an alarm set Tk within a series of time windows. The alarm dimensions include alarm name, alarm type, and five-tuple features. The five-tuple features include source IP node address, destination IP node address, source IP node port, destination IP node port, and protocol number.

[0009] Set weight calculation: Select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor. Calculate the alarm weight of each alarm set based on the weight of each reference factor.

[0010] Alarm convergence: New alarm dimensions are constructed by adding alarm weights and alarm times. Each alarm set is clustered based on the new alarm dimensions to form a new alarm message as the alarm convergence alarm message.

[0011] Alarm information filtering: Based on the predefined rule base, the alarm information of alarm convergence is filtered to filter out known false alarms and invalid alarms, and the filtered alarm information is obtained, and the corresponding valid alarm set is obtained;

[0012] Alarm analysis: Based on the valid alarm set, the number of alarms and the total alarm weight between each pair of IP node addresses are calculated, the total alarm weight is normalized, and the edge thickness and color depth are calculated based on the normalized total weight;

[0013] Topology map construction: Based on the source and destination IP node addresses, as well as the edge thickness and color depth in the valid alarm set, a visualization tool is used to construct an IP node topology map and edge thickness and color depth information, and draw a topological relationship diagram between IP nodes;

[0014] Alarm information visualization: Alarm information is visualized through the IP node topology diagram of the alarm dimension.

[0015] Preferably, for each alarm set, the alarm weight calculation formula is as follows:

[0016]

[0017] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0018] Preferably, filtering the alarm information of alarm convergence based on a predefined rule base includes the following steps:

[0019] Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm;

[0020] Traverse the alarm information. If the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time. If the current alarm information does not successfully match the rules in the rule base, retain the current alarm information.

[0021] Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0022] Preferably, the alarm analysis includes the following steps:

[0023] Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0024] Normalize the sum of the weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of the weights between each pair of IP node addresses The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0025]

[0026] Among them, W ij represents the sum of the weights between IP node addresses i and j, and n represents the number of alarms between IP node addresses i and j;

[0027] Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

[0028] Preferably, when constructing a topology map, the source IP node address and the destination IP node address as well as the edge thickness and color depth are stored in a data structure, and a visualization tool is used to construct an IP node topology map and edge thickness and color depth information, and a topological relationship map between IP nodes is drawn. The topological relationship map details and weight information are displayed in a visualization interface through click and zoom operations;

[0029] Correspondingly, when visualizing alarm information, the IP node topology map is visualized through the visualization interface, the changes and correlations of the alarm information are dynamically displayed by adjusting the alarm time window, and the alarm source analysis is performed based on the IP node topology map.

[0030] In a second aspect, the present invention provides an alarm clustering topology system based on multidimensional features, which is used to implement an alarm clustering topology by using an alarm clustering topology method based on multidimensional features as described in any one of the first aspects, wherein the system includes a data collection module, a multidimensional aggregation module, a set weight calculation module, an alarm convergence module, an alarm information filtering module, an alarm analysis module, a topology map construction module, and an alarm information visualization module;

[0031] The data collection module is used to perform the following operations: collect raw alarm information from various security devices in real time, and perform data cleaning and formatting operations on the raw alarm information to obtain pre-processed alarm information;

[0032] The multi-dimensional aggregation module is used to perform the following: based on the set alarm dimension, the pre-processed alarm information is aggregated in multiple dimensions, the alarm information with the same alarm dimension is formed into a set, and the alarm information in the set is aggregated through the sliding window method to obtain an alarm set Tk within a series of time windows, where the alarm dimension includes the alarm name, alarm type and five-tuple features, and the five-tuple features include the source IP node address, destination IP node address, source IP node port, destination IP node port and protocol number;

[0033] The set weight calculation module is used to perform the following: select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor;

[0034] The alarm convergence module is used to perform the following operations: construct a new alarm dimension by adding alarm weight and alarm time, cluster each alarm set based on the new alarm dimension, and form a new alarm message as the alarm convergence alarm message;

[0035] The alarm information filtering module is used to perform the following: based on the predefined rule base, the alarm information of the alarm convergence is filtered to filter out known false alarms and invalid alarms, and obtain the filtered alarm information, and correspondingly obtain the valid alarm set;

[0036] The alarm analysis module is used to perform the following operations: based on the valid alarm set, calculate the number of alarms and the sum of the alarm weights between each pair of IP node addresses, normalize the sum of the alarm weights, and calculate the edge thickness and color depth based on the normalized sum of the weights;

[0037] The topology map construction module is used to perform the following operations: construct an IP node topology map and edge thickness and color depth information using a visualization tool based on the source IP node address and destination IP node address as well as the edge thickness and color depth information in the valid alarm set, and draw a topological relationship map between the IP nodes;

[0038] The alarm information visualization module is used to perform the following: visual display of alarm information through the IP node topology diagram of the alarm dimension.

[0039] Preferably, for each alarm set, the alarm weight calculation formula is as follows:

[0040]

[0041] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0042] Preferably, the alarm information filtering module is configured to perform the following steps to filter the alarm information of alarm convergence based on a predefined rule base:

[0043] Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm;

[0044] Traverse the alarm information. If the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time. If the current alarm information does not successfully match the rules in the rule base, retain the current alarm information.

[0045] Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0046] Preferably, the alarm analysis module is configured to perform the following:

[0047] Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0048] Normalize the sum of the weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of the weights between each pair of IP node addresses The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0049]

[0050]

[0051] Among them, W ij represents the sum of the weights between IP node addresses i and j, and n represents the number of alarms between IP node addresses i and j;

[0052] Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

[0053] Preferably, when constructing a topology map, a topology map construction module is used to store the source IP node address and the destination IP node address as well as the edge thickness and color depth into a data structure, construct an IP node topology map and edge thickness and color depth information through a visualization tool, draw a topological relationship map between IP nodes, and display the topological relationship map details and weight information on the visualization interface through click and zoom operations;

[0054] Correspondingly, when visualizing alarm information, the alarm information visualization module is used to visualize the IP node topology through a visualization interface, dynamically display the changes and correlations of alarm information by adjusting the alarm time window, and perform alarm tracing analysis based on the IP node topology.

[0055] The multi-dimensional feature-based alarm clustering topology method and system of the present invention have the following advantages:

[0056] 1. In terms of the accuracy and efficiency of alarm processing, the system aggregates multi-dimensional features, including alarm name, alarm type, source address, destination address, source port, destination port, protocol number, and alarm time, effectively reducing redundant and false alarm information. Using a sliding time window method, it aggregates alarm information with the same characteristics within a set time range, significantly reducing the number of duplicate alarms and improving the efficiency and accuracy of alarm processing. Compared with existing methods that rely solely on simple feature aggregation, it can more comprehensively reflect the actual attack situation, improve the relevance of alarm information, and enhance the accuracy of processing.

[0057] 2. The effectiveness of alarm analysis is further enhanced by calculating alarm weights and drawing IP node topology maps in the alarm dimension. The calculation of alarm weights comprehensively considers factors such as alarm level, frequency, and time interval, and uses Z-score standardization to normalize the degree of correlation between IP nodes. By drawing IP node topology maps in the alarm dimension, security analysts can intuitively view the alarm correlation between IP nodes, clarify the attack source and path, and identify key nodes and key paths. Compared with the simple alarm list or simple graphical display in the existing technology, the comprehensive analysis method based on weights and topology maps can more intuitively and accurately display the overall situation of network attacks, helping security analysts to respond quickly and significantly improving network security protection.

[0058] 3. Through experimental data comparison, under the same network environment and attack conditions, the time for processing alarms was shortened by 30%, the false alarm rate was reduced by 40%, and the accuracy in attack tracing and key node identification was improved by 30%, reflecting the superior performance in alarm information processing and network security protection. Through multi-dimensional feature aggregation, weight calculation and topology map display, the accuracy, efficiency and comprehensiveness of network alarm processing were significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0060] The present invention will be further described below with reference to the accompanying drawings.

[0061] Figure 1 This is a flowchart of an alarm clustering topology method based on multidimensional features in Example 1;

[0062] Figure 2 This is an IP node topology diagram in an alarm clustering topology method based on multi-dimensional features in Example 1. DETAILED DESCRIPTION

[0063] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments given are not intended to limit the present invention. Unless there is a conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0064] The embodiments of the present invention provide an alarm clustering topology method and system based on multi-dimensional features, which are used to solve the technical problems of poor timeliness of network alarm information processing, many repeated false alarms and low correlation.

[0065] Example 1:

[0066] The present invention provides an alarm clustering topology method based on multidimensional features, which includes eight steps: data collection, multidimensional aggregation, set weight calculation, alarm convergence, alarm information filtering, alarm analysis, topology graph modeling and alarm information visualization.

[0067] Step S100: Data collection: collecting original alarm information from various security devices in real time, and performing data cleaning and formatting operations on the original alarm information to obtain pre-processed alarm information.

[0068] Step S100 collects original alarm information from various security devices (such as firewalls, intrusion detection systems, situational awareness, etc.) in real time, cleans and formats the collected alarm information, and unifies the format for subsequent processing.

[0069] Step S200 multi-dimensional aggregation: perform multi-dimensional aggregation on the pre-processed alarm information based on the set alarm dimension, form a set based on the alarm information with the same alarm dimension, and aggregate the alarm information in the set through the sliding window method to obtain an alarm set Tk within a series of time windows, where the alarm dimension includes the alarm name, alarm type and five-tuple features, and the five-tuple features include the source IP node address, destination IP node address, source IP node port, destination IP node port and protocol number.

[0070] Step S200 is multi-dimensional aggregation of alarm information. First, a preliminary integration is performed on the pre-processed alarm information data set, which includes multi-dimensional attributes such as alarm name, alarm type, source IP address and target IP address, source port number and destination port number, and protocol number, and a certain alarm time range threshold is set as the basis for analysis; the aggregation operation is based on the above multi-dimensional features, aiming to classify alarm records with the same alarm name, alarm type and five-tuple (source address, destination address, source port, destination port, protocol number) features into one category to form an independent set; next, a sliding time window method is used to achieve dynamic aggregation In this embodiment, a time window of a specific length is defined to define the analysis interval. Within each time window, alarm records that share the same aggregation characteristics within the set period are aggregated to deepen the aggregation level of the data. As time goes by, the sliding window smoothly moves backward from the starting point Tstart, with each movement being equivalent to the distance of the window length. The rolling update step is continued until the entire specified time range is completely covered. A series of continuous windows are used to provide alarm activity status in a time series. Finally, the output is a series of aggregated alarm record sets Tk within the time windows. Each set represents a comprehensive view of the alarm activity within its respective time window.

[0071] Step S300: Set weight calculation: Select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor.

[0072] In this embodiment, step S300 calculates the comprehensive weight of the alarm level, frequency of occurrence, and time interval. The three basic weight coefficients correspond to the severity of the alarm level, the density of the alarm frequency, and the closeness of the alarm time interval. These coefficients carefully weigh the impact of each evaluation aspect on the overall urgency and importance of the alarm. The specific implementation steps are as follows: each alarm is assigned a level score based on the degree of danger of the alarm, ensuring that high-risk alarms receive a significantly higher score than low-risk alarms; by counting the frequency of repeated occurrence of alarms in Tk within a specific time period, a corresponding frequency score is given, with higher scores corresponding to higher frequencies; by measuring the intervals between alarm events within Tk, short intervals receive higher interval scores because they indicate concentrated outbreaks of alarm events; the last three scores are combined with the preset weight coefficients to calculate the comprehensive weight value of each set Tk. The comprehensive consideration mechanism of this embodiment effectively highlights those sets with high alarm levels, dense frequency of occurrence, and close time intervals. These sets will receive higher weight values, thereby highlighting their importance.

[0073] As a specific implementation, for each alarm set, the alarm weight calculation formula is as follows:

[0074]

[0075] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0076] Step S400 alarm convergence: new alarm weights and alarm times are added to construct new alarm dimensions, and each alarm set is clustered based on the new alarm dimensions to form a new alarm message as alarm convergence alarm information.

[0077] In step S400 of this embodiment, each alarm set Tk is clustered to form a new alarm information, where the new alarm dimensions include alarm name, alarm type, source address, destination address, source port, destination port, protocol number, alarm weight and alarm time.

[0078] Step S500: Alarm information filtering: Based on a predefined rule base, the alarm information of the alarm convergence is filtered to filter out known false alarms and invalid alarms, and the filtered alarm information is obtained, and correspondingly, a valid alarm set is obtained.

[0079] As a specific implementation of alarm information filtering, the alarm information of alarm convergence is filtered based on a predefined rule base, including the following steps:

[0080] (1) constructing a rule base, wherein the rule base includes rules describing the invalidity or false alarm nature of the alarm;

[0081] (2) Traverse the alarm information. If the current alarm information successfully matches the invalid or false alarm rules in the rule base, the alarm information is marked as a false alarm within a certain period of time. If the current alarm information does not successfully match the rules in the rule base, the current alarm information is retained.

[0082] (3) Based on the constructed security model, the alarm information is analyzed for correlation and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0083] Step S600 alarm analysis: Based on the valid alarm set, the number of alarms between each pair of IP node addresses and the total alarm weight are calculated, the total alarm weight is normalized, and the edge thickness and color depth are calculated based on the normalized total weight.

[0084] As a specific implementation of alarm analysis, the operation includes the following steps:

[0085] (1) Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses in a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0086] (2) Normalize the sum of weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of weights W between each pair of IP node addresses ij The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0087]

[0088] Among them, W ij represents the sum of the weights between IP node addresses i and j, and n represents the number of alarms between IP node addresses i and j;

[0089] (3) Create a mapping table from the normalized weight sum to the edge thickness and color depth. Based on the normalized weight sum, determine the edge thickness and color depth between IP nodes. Higher weight sums result in thicker edges and darker colors, indicating a higher correlation between the two IPs. Add a weight mapping range to maintain visual consistency and comparability across different datasets.

[0090] In this step, the number and weight of alarms between IPs are first calculated, and then normalized to ensure comparison consistency. The thickness and color of the edges are set according to the normalized weights, so as to intuitively display the association strength and importance of IPs on the topology map.

[0091] Step S700: Topology map construction: Based on the source IP node address and destination IP node address as well as the edge thickness and color depth in the valid alarm set, an IP node topology map and edge thickness and color depth information are constructed through a visualization tool to draw a topological relationship diagram between IP nodes.

[0092] In this embodiment, when constructing the topology map, the source IP node address and the destination IP node address as well as the edge thickness and color depth are stored in a data structure. The IP node topology map and the edge thickness and color depth information are constructed through a visualization tool, and a topological relationship map between the IP nodes is drawn. The topological relationship map details and weight information are displayed in the visualization interface through click and zoom operations. Figure 2 shown.

[0093] Step S800: Alarm information visualization: Alarm information is visualized through the IP node topology diagram of the alarm dimension.

[0094] This embodiment visualizes alarm information by displaying the IP node topology through a visual interface. By adjusting the alarm time window, the changes and relevance of alarm information are dynamically displayed. Alarm source analysis is also performed based on the IP node topology to track the attack source and attack path. This identifies key nodes and critical paths in network attacks, helping security analysts quickly locate and respond to attack incidents.

[0095] The method of this embodiment aggregates and converges alarm information through multi-dimensional features, reducing redundant alarms and improving the accuracy and efficiency of alarm processing. Furthermore, by calculating alarm weights and drawing an IP node topology diagram based on the alarm dimension, it demonstrates alarm relevance, helping security analysts quickly locate and respond to attack events, comprehensively understand the overall situation of network attacks, and significantly improve network security protection.

[0096] Example 2:

[0097] The present invention provides an alarm clustering topology system based on multidimensional features, which includes a data collection module, a multidimensional aggregation module, a set weight calculation module, an alarm convergence module, an alarm information filtering module, an alarm analysis module, a topology map construction module and an alarm information visualization module.

[0098] The data collection module is used to perform the following: collect original alarm information from various security devices in real time, and perform data cleaning and formatting operations on the original alarm information to obtain pre-processed alarm information.

[0099] As a specific implementation, the data collection module is used to collect original alarm information from various security devices (such as firewalls, intrusion detection systems, situational awareness, etc.) in real time, clean and format the collected alarm information, and unify the format for subsequent processing.

[0100] The multi-dimensional aggregation module is used to perform the following: perform multi-dimensional aggregation on the pre-processed alarm information based on the set alarm dimension, form a set based on the alarm information with the same alarm dimension, and aggregate the alarm information in the set through the sliding window method to obtain an alarm set Tk within a series of time windows, where the alarm dimension includes the alarm name, alarm type and five-tuple features, and the five-tuple features include the source IP node address, destination IP node address, source IP node port, destination IP node port and protocol number.

[0101] As a specific implementation of the multi-dimensional aggregation module, the module first performs preliminary integration on the pre-processed alarm information data set, which includes multi-dimensional attributes such as alarm name, alarm type, source IP address and target IP address, source port number and destination port number, and protocol number, and sets a certain alarm time range threshold as the basis for analysis; the aggregation operation is based on the above multi-dimensional features, aiming to classify alarm records with the same alarm name, alarm type and five-tuple (source address, destination address, source port, destination port, protocol number) characteristics into one category to form an independent set; the next step is to use the sliding time window method to achieve dynamic aggregation In summary, this embodiment defines a time window of a specific length for demarcating the analysis interval. Within each time window, the alarm records that share the same aggregation characteristics within the set time period are aggregated to deepen the aggregation level of the data. As time goes by, the sliding window moves smoothly backward from the starting point Tstart, with each movement equivalent to the distance of the window length, and the rolling update steps are continued until the entire specified time range is completely covered. The alarm activity status in the time series is provided through a series of continuous windows; finally, the output is a set of aggregated alarm records Tk within a series of time windows, each set representing a comprehensive view of the alarm activity within its respective time window.

[0102] The set weight calculation module is used to perform the following: select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor.

[0103] In this embodiment, the set weight calculation module is used to calculate the comprehensive weight of the three dimensions of alarm level, frequency of occurrence, and time interval. The three basic weight coefficients correspond to the severity of the alarm level, the density of the alarm frequency, and the closeness of the alarm time interval. These coefficients carefully weigh the impact of each evaluation aspect on the overall urgency and importance of the alarm. The specific implementation steps are as follows: each alarm is assigned a level score based on the alarm's criticality, ensuring that high-risk alarms receive a significantly higher score than low-risk alarms; the frequency score is calculated by counting the recurrence frequency of alarms in Tk within a specific time period, with higher scores for higher frequencies; the interval time between alarm events in Tk is measured, and short intervals receive higher interval scores because they indicate concentrated outbreaks of alarm events; the last three scores are combined with the preset weight coefficients to calculate the comprehensive weight value of each set Tk. The comprehensive consideration mechanism of this embodiment effectively highlights sets with high alarm levels, high frequency, and close time intervals. These sets will receive higher weight values, thereby highlighting their importance.

[0104] As a specific implementation, for each alarm set, the alarm weight calculation formula is as follows:

[0105]

[0106] Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

[0107] The alarm convergence module is used to perform the following: construct a new alarm dimension by adding an alarm weight and an alarm time, cluster each alarm set based on the new alarm dimension, and form a new alarm information as the alarm convergence alarm information.

[0108] In this embodiment, the alarm convergence module clusters each alarm set Tk to form a new alarm information, where the new alarm dimensions include alarm name, alarm type, source address, destination address, source port, destination port, protocol number, alarm weight and alarm time.

[0109] The alarm information filtering module is used to perform the following: based on a predefined rule base, filter the alarm information of the alarm convergence, filter out known false alarms and invalid alarms, obtain filtered alarm information, and correspondingly obtain a valid alarm set.

[0110] As a specific implementation of the alarm information filtering module, the module is used to perform the following to filter the alarm information of alarm convergence based on the predefined rule base:

[0111] (1) constructing a rule base, wherein the rule base includes rules describing the invalidity or false alarm nature of the alarm;

[0112] (2) Traverse the alarm information. If the current alarm information successfully matches the invalid or false alarm rules in the rule base, the alarm information is marked as a false alarm within a certain period of time. If the current alarm information does not successfully match the rules in the rule base, the current alarm information is retained.

[0113] (3) Based on the constructed security model, the alarm information is analyzed for correlation and the alarm information that is not related to the actual attack and the false alarm information are removed.

[0114] The alarm analysis module is used to perform the following: based on the valid alarm set, calculate the number of alarms and the total alarm weight between each pair of IP node addresses, normalize the total alarm weight, and calculate the edge thickness and color depth based on the normalized total weight.

[0115] As a specific implementation of the alarm analysis module, this module is used to perform the following operations:

[0116] (1) Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses in a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set;

[0117] (2) Normalize the sum of weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of weights between each pair of IP node addresses The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows:

[0118]

[0119]

[0120] Among them, W ij represents the sum of the weights between IP node addresses i and j, and n represents the number of alarms between IP node addresses i and j;

[0121] (3) Create a mapping table from the normalized weight sum to the edge thickness and color depth. Based on the normalized weight sum, determine the edge thickness and color depth between IP nodes. Higher weight sums result in thicker edges and darker colors, indicating a higher correlation between the two IPs. Add a weight mapping range to maintain visual consistency and comparability across different datasets.

[0122] In the above operation, the number and weight of alarms between IPs are first calculated, then normalized to ensure comparison consistency, and the thickness and color of the edges are set according to the normalized weights, so as to intuitively display the association strength and importance of IPs on the topology map.

[0123] The topology map construction module is used to perform the following: based on the source IP node address and destination IP node address as well as the edge thickness and color depth in the valid alarm set, the IP node topology map and edge thickness and color depth information are constructed through a visualization tool to draw a topological relationship diagram between the IP nodes.

[0124] In this embodiment, when constructing a topology map, the topology map construction module is used to store the source IP node address and the destination IP node address as well as the edge thickness and color depth into a data structure, and use visualization tools to construct the IP node topology map and edge thickness and color depth information, draw a topological relationship diagram between IP nodes, and display the topology relationship diagram details and weight information on the visualization interface through click and zoom operations.

[0125] The alarm information visualization module is used to perform the following: visual display of alarm information through the IP node topology diagram of the alarm dimension.

[0126] In this embodiment, the alarm information visualization module visualizes the IP node topology through a visual interface. By adjusting the alarm time window, it dynamically displays the changes and relevance of alarm information. Alarm source analysis is also performed based on the IP node topology to track the attack source and attack path. This helps identify key nodes and critical paths in network attacks, helping security analysts quickly locate and respond to attack incidents.

[0127] The system of this embodiment can execute the method disclosed in Example 1 to construct and display an alarm clustering map.

[0128] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art will know that more embodiments of the present invention can be obtained by combining the means in the above different embodiments, and these embodiments are also within the scope of protection of the present invention.

Claims

1. An alarm clustering topology method based on multidimensional features, characterized in that: The steps include: Data collection: Collect raw alarm information from various security devices in real time, clean and format the raw alarm information, and obtain pre-processed alarm information; Multi-dimensional aggregation: Based on the set alarm dimensions, the pre-processed alarm information is aggregated in multiple dimensions. Alarm information with the same alarm dimension is grouped into a set, and the alarm information in the set is aggregated using the sliding window method to obtain an alarm set Tk within a series of time windows. The alarm dimensions include alarm name, alarm type, and five-tuple features. The five-tuple features include source IP node address, destination IP node address, source IP node port, destination IP node port, and protocol number. Set weight calculation: Select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor. Calculate the alarm weight of each alarm set based on the weight of each reference factor. Alarm convergence: New alarm dimensions are constructed by adding alarm weights and alarm times. Each alarm set is clustered based on the new alarm dimensions to form a new alarm message as the alarm convergence alarm message. Alarm information filtering: Based on the predefined rule base, the alarm information of alarm convergence is filtered to filter out known false alarms and invalid alarms, and the filtered alarm information is obtained, and the corresponding valid alarm set is obtained; Alarm analysis: Based on the valid alarm set, the number of alarms and the total alarm weight between each pair of IP node addresses are calculated, the total alarm weight is normalized, and the edge thickness and color depth are calculated based on the normalized total weight; Topology map construction: Based on the source and destination IP node addresses, as well as the edge thickness and color depth in the valid alarm set, a visualization tool is used to construct an IP node topology map and edge thickness and color depth information, and draw a topological relationship diagram between IP nodes; Alarm information visualization: Alarm information is visualized through the IP node topology diagram of the alarm dimension.

2. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: For each alarm set, the alarm weight calculation formula is as follows: Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

3. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: Filtering alarm information for alarm convergence based on a predefined rule base includes the following steps: Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm; Traverse the alarm information. If the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time. If the current alarm information does not successfully match the rules in the rule base, retain the current alarm information. Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

4. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: Alarm analysis includes the following steps: Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set; Normalize the sum of the weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of the weights W between each pair of IP node addresses ij The mean μ and standard deviation σ of The Z-score value calculated by the mean value μ and the standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows: Among them, W ij represents the sum of the weights between IP node addresses i and j, and nn represents the number of alarms between IP node addresses i and j; Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

5. The alarm clustering topology method based on multidimensional features according to claim 1 is characterized in that: When constructing a topology map, the source and destination IP node addresses, as well as the edge thickness and color depth, are stored in a data structure. A visualization tool is used to construct an IP node topology map and edge thickness and color depth information, and a topological relationship map between IP nodes is drawn. The topological relationship map details and weight information are displayed in the visualization interface through click and zoom operations. Correspondingly, when visualizing alarm information, the IP node topology map is visualized through the visualization interface, the changes and correlations of the alarm information are dynamically displayed by adjusting the alarm time window, and the alarm source analysis is performed based on the IP node topology map.

6. An alarm clustering topology system based on multi-dimensional features, characterized in that: Used to realize alarm clustering topology by an alarm clustering topology method based on multidimensional features according to any one of claims 1 to 5, the system includes a data collection module, a multidimensional aggregation module, a set weight calculation module, an alarm convergence module, an alarm information filtering module, an alarm analysis module, a topology map construction module and an alarm information visualization module; The data collection module is used to perform the following operations: collect raw alarm information from various security devices in real time, and perform data cleaning and formatting operations on the raw alarm information to obtain pre-processed alarm information; The multi-dimensional aggregation module is used to perform the following: based on the set alarm dimension, the pre-processed alarm information is aggregated in multiple dimensions, the alarm information with the same alarm dimension is formed into a set, and the alarm information in the set is aggregated through the sliding window method to obtain an alarm set Tk within a series of time windows, where the alarm dimension includes the alarm name, alarm type and five-tuple features, and the five-tuple features include the source IP node address, destination IP node address, source IP node port, destination IP node port and protocol number; The set weight calculation module is used to perform the following: select the alarm level, alarm frequency and alarm time interval as reference factors and set the weight of each reference factor, and calculate the alarm weight of each alarm set based on the weight of each reference factor; The alarm convergence module is used to perform the following operations: construct a new alarm dimension by adding alarm weight and alarm time, cluster each alarm set based on the new alarm dimension, and form a new alarm message as the alarm convergence alarm message; The alarm information filtering module is used to perform the following: based on the predefined rule base, the alarm information of the alarm convergence is filtered to filter out known false alarms and invalid alarms, and obtain the filtered alarm information, and correspondingly obtain the valid alarm set; The alarm analysis module is used to perform the following operations: based on the valid alarm set, calculate the number of alarms and the sum of the alarm weights between each pair of IP node addresses, normalize the sum of the alarm weights, and calculate the edge thickness and color depth based on the normalized sum of the weights; The topology map construction module is used to perform the following operations: construct an IP node topology map and edge thickness and color depth information using a visualization tool based on the source IP node address and destination IP node address as well as the edge thickness and color depth information in the valid alarm set, and draw a topological relationship map between the IP nodes; The alarm information visualization module is used to perform the following: visual display of alarm information through the IP node topology diagram of the alarm dimension.

7. The multi-dimensional feature-based alarm clustering topology system according to claim 6, characterized in that: For each alarm set, the alarm weight calculation formula is as follows: Among them, W Tk It represents the alarm right of the alarm set, W1 represents the weight coefficient of the alarm level, W2 represents the weight coefficient of the alarm frequency, W3 represents the weight coefficient of the alarm time interval, f represents the number of times the alarm occurs within the set range, and Δt represents the time interval between the current alarm and the previous alarm.

8. The multi-dimensional feature-based alarm clustering topology system according to claim 6, characterized in that: The alarm information filtering module is used to perform the following operations to filter the alarm information of alarm convergence based on the predefined rule base: Building a rule base, the rule base including rules describing the invalidity or false alarm nature of the alarm; Traverse the alarm information. If the current alarm information successfully matches the invalid or false alarm rules in the rule base, mark the alarm information as a false alarm within a certain period of time. If the current alarm information does not successfully match the rules in the rule base, retain the current alarm information. Based on the constructed security big model, the alarm information is analyzed for correlation, and the alarm information that is not related to the actual attack and the false alarm information are removed.

9. The multi-dimensional feature-based alarm clustering topology system according to claim 6, characterized in that: The alarm analysis module is used to perform the following: Traverse the valid alarm set, calculate the number of alarms and the sum of weights between each pair of IP node addresses, store the number of alarms and the sum of weights between each pair of IP node addresses through a data structure, and update the number of alarms and the sum of weights between each pair of IP node addresses during the traversal of the valid alarm set; Normalize the sum of the weights between each pair of IP node addresses through Z-score standardization, traverse all IP node pairs, and calculate the sum of the weights W between each pair of IP node addresses ij The mean μ and standard deviation σ of the original weight value W ij The Z-score value calculated by the mean μ and standard deviation σ is used as the normalized weight sum. The calculation formula for the normalized weight sum is as follows: Among them, W ij represents the sum of the weights between IP node addresses i and j, and n represents the number of alarms between IP node addresses i and j; Create a mapping table from the normalized weight sum to the edge thickness and color depth, and determine the edge thickness and color depth between IP nodes based on the normalized weight sum.

10. The multi-dimensional feature-based alarm clustering topology system according to claim 6, characterized in that: When constructing a topology map, the topology map construction module is used to store the source IP node address and destination IP node address, as well as the edge thickness and color depth, into a data structure. The visualization tool is used to construct the IP node topology map and the edge thickness and color depth information, and draw the topological relationship diagram between the IP nodes. The topological relationship diagram details and weight information are displayed in the visualization interface through click and zoom operations; Correspondingly, when visualizing alarm information, the alarm information visualization module is used to visualize the IP node topology through a visualization interface, dynamically display the changes and correlations of alarm information by adjusting the alarm time window, and perform alarm tracing analysis based on the IP node topology.

Images