A network security alarm noise reduction method based on a transformer

Abstract

The embodiment of the application provides a network security alarm noise reduction method based on a Transformer, which comprises the following steps: acquiring alarm data, wherein the alarm data is generated by a security device in real time; inputting the alarm data into a target real alarm identification model, and confirming whether the alarm data belongs to a real alarm through the target real alarm identification model, wherein the target real alarm identification model comprises an input layer, a feature quantization layer, a target model processing layer and an output layer, and the feature quantization layer is configured to encode the dependency relationship and interaction information acquired from HTTP request and response content by using a Transformer encoder. The feature processing provided by the embodiment of the application greatly improves the understanding and representation ability of the model for alarm data, so that the model can more accurately distinguish real alarms from false alarms when classifying alarms, and the false alarm rate is reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security. Specifically, the embodiments of the present application relate to a network security alarm noise reduction method based on Transformer. Background Art

[0002] Most current network security devices generate network security alerts based on preset rules, but this approach often results in a large number of false alarms. When the number of alerts reaches a certain level, security personnel struggle to quickly and accurately identify true attack alerts from the overwhelming volume. This phenomenon is known as "alert fatigue." Alert fatigue distracts security personnel, significantly increasing the risk of missing critical threats and reducing overall security protection efficiency.

[0003] To protect their internal networks, major enterprises have deployed a variety of security devices designed to comprehensively safeguard them. These devices monitor network traffic in real time, identifying and alerting potential attacks. Security operations personnel rely on these alerts to promptly respond to and address security threats, ensuring the security and stability of the network environment.

[0004] However, existing security devices primarily rely on rule-matching models to screen and identify attack traffic. While this approach can identify attack behavior to a certain extent, the limitations and fixed nature of the rules often lead to a large number of false positives. These false positives are mostly caused by legitimate business requests being mistakenly matched as attack behavior. With the increasing complexity of network environments and the diversification of business needs, the distinction between legitimate and malicious traffic has become increasingly blurred, further exacerbating the false positive problem.

[0005] In real-world operational scenarios, security operations personnel face thousands of alerts daily. These alerts include both real attacks and a large number of false positives. The high frequency of false positives not only consumes significant manpower and time, but also significantly distracts operations personnel and increases the risk of missing important attack incidents. The presence of false positives hinders operations personnel from effectively identifying and addressing real security threats, posing a significant challenge to the company's overall security capabilities. Therefore, effectively reducing false positives and improving alert accuracy have become pressing challenges in enterprise network security operations. Summary of the Invention

[0006] The purpose of the embodiments of this application is to provide a Transformer-based network security alert denoising method. By using a Transformer encoder to process the most complex and critical parts of alert data (such as HTTP request and response content), the embodiments of this application can capture long-distance dependencies and complex interactive information in the data on a global scale. This characterization process greatly improves the model's ability to understand and represent alert data, enabling the model to more accurately distinguish between true alerts and false alarms when classifying alerts, reducing the false alarm rate.

[0007] In a first aspect, an embodiment of the present application provides a Transformer-based network security alarm noise reduction method, the method comprising: obtaining alarm data, wherein the alarm data is generated in real time by a security device; inputting the alarm data into a target real alarm recognition model, and confirming whether the alarm data is a real alarm through the target real alarm recognition model, wherein the target real alarm recognition model includes an input layer, a feature quantization layer, a target model processing layer and an output layer, and the feature quantization layer is at least configured to encode dependency relationships and interaction information obtained from HTTP request and response content.

[0008] Some embodiments of the present application improve the accuracy of the authenticity assessment results of the alarm information by introducing a Transformer encoder to encode the relevant requests and responses in the alarm information.

[0009] In some embodiments of the present application, confirming whether the alarm data is a real alarm through the target real alarm recognition model includes: preprocessing the alarm data through the input layer; quantizing the preprocessed data through the feature quantization layer to obtain a feature vector; calculating the authenticity estimation value for the alarm data through the model processing layer and the feature vector; and outputting the authenticity estimation value through the output layer.

[0010] Some embodiments of the present application process the alarm information through various layers and obtain an evaluation result on the authenticity of the alarm information.

[0011] In some embodiments of the present application, the alarm data carries an HTTP request, an HTTP response, or an HTTP URL, wherein the confirming whether the alarm data is a real alarm through the target real alarm recognition model includes: initially encoding the HTTP request, HTTP response, or HTTP URL carried by the alarm data through the Word2Vec model to obtain a word sequence; generating unique corresponding position coding information for each word in the word sequence; adding the position coding information to the word sequence to obtain a target sequence; dividing the target sequence into block vectors of the same length; and inputting the block vectors into the Transformer encoder for encoding.

[0012] Some embodiments of the present application use the Word2Vec model and Transformer encoder to encode and extract features from HTTP requests, HTTP responses, or HTTP URLs, thereby improving the accuracy of feature extraction of such information.

[0013] In some embodiments, the input layer includes: a first type of information input module, configured to input the first type of data carried by the alarm data into the corresponding encoding module; a second type of information input module, configured to input the second type of data carried by the alarm data into the corresponding encoding module; a third type of information input module, configured to input the third type of data carried by the alarm data into the corresponding encoding module; a fourth type of information input module, configured to input the fourth type of data carried by the alarm data into the corresponding encoding module; the feature quantization layer includes: a first encoding module, configured to be connected to the output end of the first type of information input module, and The first type of data is encoded using the Word2Vec model to obtain a first feature code; the second encoding module is configured to be connected to the output end of the second type of information input module, and uses the one-hot encoding model to encode the second type of data to obtain a second feature code; the third encoding module is configured to be connected to the output end of the third type of information input module, and uses the label embedding model to encode the third type of data to obtain a third feature code; the fourth encoding module is configured to be connected to the output end of the fourth type of information input module, and encodes the fourth type of data by extracting the statistical features of the fourth type of information. The first feature code is obtained by performing row encoding processing on the first splicing vector of the input through a first fully connected layer, a first normalization processing layer, an activation function and an anti-overfitting algorithm, wherein the first splicing vector is obtained by splicing the first feature code, the third feature code and the fourth feature code. The fifth feature code is obtained by performing a preprocessing operation on the fifth feature code and the second feature code after preprocessing, wherein the preprocessing includes one-dimensional convolution and normalization processing; the second processing unit is configured to process the fifth feature code through a second fully connected layer, a second normalization processing layer, an activation function and an anti-overfitting algorithm in sequence to obtain a second vector to be spliced; the third processing unit is configured to process the input target splicing vector through a third fully connected layer, a third normalization processing layer, an activation function and an anti-overfitting algorithm in sequence to obtain the authenticity assessment result of this alarm, wherein the target splicing vector is obtained by splicing the first vector to be spliced ​​and the second vector to be spliced.

[0014] Some embodiments of the present application classify, quantify, encode, and extract features of various types of data carried in alarm information, significantly improving the adequacy and accuracy of feature extraction for alarm information, thereby improving the accuracy of the obtained alarm information authenticity assessment results.

[0015] In some embodiments, before inputting the alarm data into the real alarm recognition model, the method further includes: training the model processing layer to obtain the target model processing layer; wherein, training the model processing layer to obtain the target model processing layer includes: collecting historical alarm data, wherein the historical alarm data includes attack name, HTTP request and response content; marking the historical alarm data into two types, false alarm and non-false alarm, as label data; using the feature quantization layer to quantize the historical alarm data to obtain a feature vector; using the model processing layer and the feature vector to obtain an authenticity evaluation result for the historical alarm data; using a loss function to determine the difference between the authenticity evaluation result and the corresponding label data to obtain a loss value, and determining whether to continue training based on the loss value.

[0016] Some embodiments of the present application train the model through historical alarm data.

[0017] In some embodiments, the historical alarm data includes a first category of data, a second category of data, a third category of data and a fourth category of data; wherein, the feature quantization layer is used to quantize the historical alarm data to obtain a feature vector, including: converting the text information included in the first category of data into a numerical feature vector to obtain a first feature vector; converting the second category of data into a sparse vector composed of 0 and 1 to obtain a second feature vector; mapping the third category of data into continuous numerical data to obtain a third feature vector; extracting the statistical features of the characters in the fourth category of data to obtain a fourth feature vector; and performing the following processing on the fourth category of data to obtain a fifth feature vector: encoding with a second Word2Vec model, filling with word position information and encoding with a Transformer encoder; the model processing layer and the feature vector are used to obtain the authenticity evaluation result of the historical alarm data, including: processing the second feature vector one by one through one-dimensional convolution, normalization and ReLU activation function to obtain an initial second feature vector; the first feature vector, the third feature vector and the fourth feature vector are processed. The normalized data is merged with the initial second eigenvector to obtain a first merged vector; the first merged vector is processed one by one by a fully connected layer, normalization, RLU activation function and dropout (as an anti-overfitting algorithm) to obtain a first to-be-merged vector; the fifth eigenvector is sequentially subjected to the following operations to obtain a second to-be-merged vector: average pooling, full connection processing, normalization processing, ReLU activation and Dropout operation; the first to-be-merged vector and the second to-be-merged vector are merged, and the merged result is subjected to multiple full connection processing to obtain a one-dimensional vector as the historical alarm data; wherein the first type of data is used to carry threat information, source address or destination address, the second type of data is unordered classification data, the unordered classification data includes HTTP request method, the hour of occurrence time or numerical data after binning processing, the third type of data is ordered classification data, the ordered classification data includes alarm level or confidence, the fourth type of data includes multi-character type data, the multi-character type data includes HTTP request, HTTP response or HTTP URL.

[0018] Some embodiments of the present application improve the accuracy of the evaluation results output by the trained model by fully exploiting the information carried by historical alarm information.

[0019] In some embodiments, the extracting statistical features of characters in the fourth category of data includes: counting the character length of HTTP requests and HTTP responses, counting the length of invisible characters, counting the number of times characters appear in HTTP request headers and HTTP response headers (for example, counting the number of times “,;:. / =” appear therein), and counting the number of times characters appear in HTTP request bodies and HTTP response bodies (for example, counting the number of times “=. / &” appear therein).

[0020] In a second aspect, some embodiments of the present application provide a Transformer-based network security alarm noise reduction device, the device comprising: an alarm information acquisition module, configured to obtain alarm data, wherein the alarm data is generated in real time by a security device; an alarm result authenticity prediction module, configured to input the alarm data into a target real alarm recognition model, and confirm whether the alarm data is a real alarm through the target real alarm recognition model, wherein the target real alarm recognition model includes an input layer, a feature quantization layer, a target model processing layer and an output layer, and the feature quantization layer is at least configured to use a Transformer encoder to encode the dependency and interaction information obtained from the HTTP request and response content.

[0021] In a third aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method for detecting false alarm information as described in any embodiment of the first aspect.

[0022] In a fourth aspect, some embodiments of the present application provide a computer program product, comprising computer program instructions, which, when read and executed by a processor, execute the method for detecting false alarm information as described in any one of the embodiments of the first aspect.

[0023] In a fifth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the method for detecting false alarm information as described in any one of the embodiments included in the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0025] Figure 1One of the flow charts of the method for detecting false alarm information provided in an embodiment of the present application;

[0026] Figure 2 This is a second flowchart of the method for detecting false alarm information provided in an embodiment of the present application;

[0027] Figure 3 This is an architecture diagram of a target real alarm identification model or a real alarm identification model provided in an embodiment of the present application;

[0028] Figure 4 A schematic diagram of the structure of the Transformer encoder provided in an embodiment of the present application;

[0029] Figure 5 A schematic diagram of the training process provided in an embodiment of the present application;

[0030] Figure 6 A block diagram of the apparatus for detecting false alarm information provided in an embodiment of the present application;

[0031] Figure 7 A schematic diagram of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0033] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0034] Currently, the industry generally uses a rule-based approach to detect false alarms. This approach relies on security experts to manually analyze the characteristics of false alarms and extract characteristic rules. Subsequently, when a security device generates an alarm that matches these rules, it is marked as a false alarm, preventing it from being displayed on the user interface, thereby reducing the number of false alarms.

[0035] Rule-based noise reduction methods offered by related technologies suffer from the following drawbacks: 1) Strong rule dependency and unstable results: The effectiveness of false alarm detection is entirely dependent on the quality of the rules. These rules are typically manually written, meaning that detection effectiveness is largely dependent on the security capabilities and experience of the rule writers. Improper rule writing can result in genuine security alerts being misclassified as false alarms, leading to missed alerts and jeopardizing network security. 2) Rule lag and inability to adapt to dynamic changes: Rules are often developed after false alarms have already occurred, meaning that false alarms can only be remedied after the fact. In real-world operational environments, false alarms are often caused by normal business system behavior. As business systems constantly update and evolve, the characteristics of false alarms also change, rendering older rules ineffective in addressing new false alarms. 3) High maintenance costs and resource consumption: Rule-based false alarm detection methods require constant rule updates to adapt to the ever-changing network environment and business needs. This constant rule updating not only requires significant manpower and time, but also increases operational costs and reduces overall system efficiency.

[0036] The reduction of false alarms provided by the relevant technology can be achieved in two ways: one is to improve the detection capabilities of security equipment and reduce the number of false alarms from the source; the other is to add a filtering mechanism outside the security equipment to perform secondary screening on the generated alarms to filter out false alarms. Due to the wide variety of security equipment within the enterprise, most equipment can only improve the quality of alarms by optimizing alarm rules, and cannot effectively reduce the generation of false alarms. Therefore, the embodiment of the present application chooses the second method: that is, to add a filtering layer outside the existing security equipment. When the security device generates an alarm, the method proposed in the embodiment of the present application is used to detect false alarms for the alarm. Only after it is confirmed to be a real alarm will it be displayed to the security operation personnel. This method not only improves the accuracy of the alarm, but also reduces the burden on the security team, allowing them to focus more on dealing with real security threats.

[0037] The inventors of this application discovered in their research that in the context of network security alert noise reduction, alert data is often extremely complex, especially for alerts involving web-based attacks. For these alerts, HTTP request and response data are key factors in determining alert authenticity. Furthermore, information such as the URL field, attack source IP, and destination IP also plays an important role in alert determination. However, although HTTP request and response data exist in plain text format, due to their lack of language structure, traditional encoding methods have difficulty directly converting them into valid feature vectors.

[0038] In an embodiment of the present application, the encoder part in the Transformer model is used to extract features from HTTP requests and HTTP responses in the alarm data. In this way, the embodiment of the present application can convert complex text data into high-dimensional feature vectors and combine them with other key alarm information such as URL, source IP and destination IP. Ultimately, these combined feature vectors will be input as the model processing layer (or target model processing layer) to drive the model training of the machine learning algorithm or perform alarm authenticity assessment, thereby improving the accuracy and effectiveness of alarm noise reduction.

[0039] The Transformer model is a deep learning model used in natural language processing (NLP) and other sequential data processing fields. It consists of two main components: an encoder and a decoder. The Transformer encoder converts the input sequence into a continuous representation and extracts high-quality feature vectors.

[0040] Therefore, some embodiments of this application aim to solve the problem of how to effectively reduce false alarms in alarms and improve the quality and accuracy of alarms through alarm noise reduction technology. The strength of this application is to design a deep learning model by combining Transformer technology. This model uses multiple methods to process features and can intelligently identify and filter false alarms. In this way, security operations personnel can focus their attention on real security threats, thereby significantly alleviating alarm fatigue and improving the overall effectiveness of network security protection.

[0041] Please see Figure 1 , Figure 1 The Transformer-based network security alert noise reduction method provided in some embodiments of the present application includes:

[0042] S101, obtaining alarm data, wherein the alarm data is generated in real time by a security device.

[0043] S102, input the alarm data into a target real alarm recognition model, and confirm whether the alarm data is a real alarm through the target real alarm recognition model, wherein the target real alarm recognition model includes an input layer, a feature quantization layer, a target model processing layer and an output layer, and the feature quantization layer is at least configured to use a Transformer encoder to encode the dependency and interaction information obtained from the HTTP request and response content.

[0044] It is understandable that in order to evaluate the authenticity of the alarm data, some embodiments of this application require training the real alarm recognition model to obtain the target real alarm recognition model. It is understandable that the network architecture of these two models is the same. Figure 2 As shown, the method of the embodiment of the present application includes a training phase and an application phase. In the training phase, the following steps need to be performed: collecting historical alarm data; marking alarm data; feature engineering (i.e., using Figure 3 The application phase does not include: acquiring real-time alarm data; feature engineering; using an alarm denoising model (or processing using a model processing layer); or generating true alarms (i.e., determining whether an alarm is a true alarm).

[0045] For example, in some embodiments of the present application, before inputting the alarm data into the real alarm recognition model, the method also includes: training the model processing layer to obtain the target model processing layer; wherein, training the model processing layer to obtain the target model processing layer includes: collecting historical alarm data, wherein the historical alarm data includes attack name, HTTP request and response content; marking the historical alarm data into two types, false alarm and non-false alarm, as label data; using the feature quantization layer to quantize the historical alarm data to obtain a feature vector; using the model processing layer and the feature vector to obtain an authenticity evaluation result for the historical alarm data; using a loss function to determine the difference between the authenticity evaluation result and the corresponding label data to obtain a loss value, and determining whether to continue training based on the loss value.

[0046] That is, the exemplary training phase of the embodiment of the present application includes:

[0047] 1) Collection of historical alarm data: This is the foundation of model training. In this step, it is necessary to focus on collecting key fields used for model training, such as attack names, HTTP request and response content, etc.

[0048] 2) Alarm Data Labeling: Each alarm needs to be classified and labeled according to whether it is a false alarm. If it is a false alarm, it is marked as "1"; if it is not a false alarm, it is marked as "0". These labels will serve as label data for model training.

[0049] 3) Feature Engineering: Processing is performed based on the data type. For plain text data (e.g., threat information, source address, and destination address, examples of the first category of data), the Word2Vec model is used for encoding. For unordered categorical data (e.g., HTTP request method, occurrence hour, etc., examples of the second category of data), one-hot encoding is used. For ordered categorical data (e.g., alarm level, confidence level, examples of the third category of data), label encoding is used. For numerical data (e.g., port information, alarm count), the data is first binned and converted into categorical data, and then one-hot encoding is performed. For complex character data (e.g., HTTP requests, HTTP responses, and HTTP URLs, examples of the fourth category of data), statistical features such as the number of special characters are first extracted using prior knowledge. Furthermore, Word2Vec is used for encoding, and then a Transformer encoder is used for processing. It should be noted that statistical features and data encoding are used simultaneously for training and belong to the same data level. Examples of statistical features include: counting the character length of HTTP requests and HTTP responses, counting the length of non-visible characters, counting the number of occurrences of characters such as ",;:. / =" in HTTP request headers and HTTP response headers, and counting the number of occurrences of characters such as "=. / &" in HTTP request bodies and HTTP response bodies. Examples of data encoding include: 1. Using word2Vec to encode such data to obtain intermediate data; 2. Using a Transformer encoder to process the intermediate data to obtain the final feature data. 4) Model training: After feature engineering is completed, the alarm data is converted into feature vectors that can be used for model training. This is then trained through backpropagation of the neural network to ultimately construct an effective alarm noise reduction model.

[0050] During the application phase of this embodiment, real-time alarm data is first processed using the same feature engineering process as in the training phase to generate feature vectors. These feature vectors are then fed into a trained alarm denoising model. After analysis by the model, the system can determine the authenticity of alarms, filter out false alarms, and ultimately retain only true alarm information.

[0051] The following first illustrates the process of training the real alarm recognition model to obtain the target real alarm recognition model.

[0052] Before introducing the training process, first combine Figure 3 The architecture of the real alarm recognition model is explained by way of example.

[0053] In some embodiments of the present application, the input layer of the real alarm recognition model includes:

[0054] The first type of information input module is configured to input the first type of data carried by the alarm data into the corresponding encoding module. For example, the first type of data is used to carry threat information, source address or destination address, and the corresponding first type of information input module exemplarily includes the following: Figure 3 As shown: a threat_info module, which is used to input the threat information carried by the first type of data into the corresponding encoding module; a src_address module, which is used to input the source address carried by the first type of data into the corresponding encoding module; and a dst_address module, which is used to input the destination address carried by the first data into the corresponding encoding module.

[0055] The second type of information input module is configured to input the second type of data carried by the alarm data into the corresponding encoding module. For example, the second type of data is unordered categorized data, and the unordered categorized data includes HTTP request method, the hour of occurrence time, or numerical data after binning. The corresponding second type of information input module exemplarily includes the following: Figure 3 As shown: http_method module, used to input the HTTP request method carried by the second type of data into the corresponding encoding module; time_h module, used to input the hour when the HTTP request event carried by the second type of data occurs into the corresponding encoding module; it can be understood that Figure 3 Not all submodules included in the second type of information input module are shown, and those skilled in the art can add corresponding input modules according to actual needs.

[0056] The third type of information input module is configured to input the third type of data carried by the alarm data into the corresponding encoding module. For example, the third type of data is ordered classification data, and the ordered classification data includes the alarm level or confidence level. The corresponding third type of information input module exemplarily includes the following: Figure 3 The alarm_level module shown is used to input the alarm level carried by the third type of data into the corresponding encoding module; and the confidence module is used to input the confidence data carried by the third type of data into the corresponding encoding module.

[0057] The fourth type of information input module is configured to input the fourth type of data carried by the alarm data into the corresponding encoding module. For example, the fourth type of data includes multi-character type data, and the multi-character type data includes HTTP request, HTTP response or HTTP URL. The corresponding fourth type of information input module exemplarily includes the following: Figure 3Shown are: an http_url_path module, used to input information related to the HTTP URL carried by the fourth category of data into the corresponding encoding module, an http_req module, used to input data related to the HTTP request carried by the fourth category of data into the corresponding encoding module, and an http_res module, used to input data related to the HTTP response carried by the fourth category of data into the corresponding encoding module.

[0058] The feature quantization layer includes:

[0059] The first encoding module (such as Figure 3 The Word2Vec module shown in the figure is configured to be connected to the output end of the first type of information input module, and uses the Word2Vec model to encode the first type of data to obtain a first feature code.

[0060] The second encoding module (such as Figure 3 The One Hot module shown in the figure is configured to be connected to the output end of the second type of information input module, and uses the one hot encoding model to encode the second type of data to obtain a second feature code.

[0061] The third encoding module (such as Figure 3 The Label Encoding module shown in FIG2 is configured to be connected to the output end of the third type of information input module and to encode the third type of data using a label embedding model to obtain a third feature code.

[0062] The fourth encoding module (such as Figure 3 The statistical feature extraction module shown is configured to be connected to the output end of the fourth category information input module, and to encode the fourth category data by extracting the statistical features of the fourth category information to obtain a fourth feature code;

[0063] The fifth encoding module (such as Figure 3 The modules Word2Vec and Transformer Encode shown are configured to be connected to the output end of the fourth type of information input module, and to encode the fourth type of data at least through the Word2Vec model and the Transformer encoder to obtain the fifth feature code.

[0064] The target model processing layer includes:

[0065] The first processing unit (such as Figure 3 The model processing layer shown includes an FC&Norm&Relu&Dropout), which is configured to sequentially process the first concatenated vector (such as Figure 3X1, X2, X3...X shown P ) is processed to obtain the first vector to be spliced ​​(such as Figure 3 Shown b l,1 ,b l,2 ,b l,3 ...b l,P ), wherein the first splicing vector is obtained by splicing the first feature code, the third feature code, the fourth feature code and the preprocessed second feature code, and the preprocessing includes one-dimensional convolution and normalization.

[0066] The second processing unit (such as Figure 3 The model processing layer shown includes an FC&Norm&Relu&Dropout), which is configured to sequentially process the fifth feature code (such as Figure 3 X1, X2, X3...X m ) is processed to obtain the second vector to be spliced ​​(such as Figure 3 Shown b 2,1 ,b 2,2 ,b 2,3 ...b 2,t ).

[0067] The third processing unit (such as Figure 3 The model processing layer shown includes the last FC&Norm&Relu&Dropout), which is configured to sequentially pass the third fully connected layer, the third normalization processing layer, the activation function and the anti-overfitting algorithm to the input target splicing vector (such as Figure 3 Shown b l,1 ,b l,2 ,b l,3 ...b 2,t ) to process and obtain the alarm authenticity assessment result (such as Figure 3 Shown b 4,1 ), wherein the target splicing vector is obtained by splicing the first vector to be spliced ​​and the second vector to be spliced.

[0068] Figure 3 The example also includes the Sigmod module and the output of the Real Alem real alarm and the False Alem false alarm exemplary discrimination results, that is, Figure 3 The output layer is used to output whether the alarm data is a true alarm or a false alarm.

[0069] In some embodiments of the present application, in the input layer of the model, the alarm data is first preprocessed and divided into four categories according to data characteristics: the first category data and ordinary text data (such as threat information, source address and destination address), the second category data, namely unordered categorized data (such as HTTP request method, hour of occurrence, numerical data after binning, etc.), the third category data, namely ordered categorized data (such as alarm level, confidence level) and the fourth category data, namely complex character data (such as HTTP request, HTTP response and HTTP URL).

[0070] At the feature vectorization layer, each type of data in the embodiment of the present application is processed using a corresponding encoding method. Unordered categorical data is encoded by One-Hot, and the categorical data is converted into a sparse vector consisting of 0 and 1 so that it can be input into a neural network for learning; ordinary text data is encoded by the Word2Vec model, and the text is converted into a numerical feature vector. The model captures the contextual relationship between words and learns the embedding vector of each word, thereby expressing the semantic information of the vocabulary; for ordered categorical data, label encoding is used to map it into continuous numerical data; and for complex character data, given its wide distribution of characters, the statistical features of the characters are first extracted (statistics of the character length of HTTP requests and responses, the length of non-visible characters, the number of occurrences of characters such as ,;:. / = in HTTP request headers and HTTP response headers, and the number of occurrences of =. / & in HTTP request bodies and HTTP response bodies). In addition, after encoding it using Word2Vec, it is input into the Transformer encoder to generate a high-dimensional feature vector and deeply capture the complex features and long-distance dependencies in the data.

[0071] In some embodiments of the present application, visible characters are defined as uppercase and lowercase letters, English punctuation marks, numbers, and spaces, i.e., the ASCII character range 32 to 126. Invisible characters are characters that are not within the visible character range. The method for determining their length is to traverse all individual characters in the string to be counted and count the number of invisible characters.

[0072] Combine Figure 3 In the embodiment of the present application, the model processing layer is used to perform at least the following operations on the input feature vector:

[0073] 1) Use a one-dimensional convolutional network (1D Convolution) to process one-hot encoded data. One-hot encoded data is typically high-dimensional and sparse. 1D convolution can help extract important features and reduce the data dimension. After processing, normalization is performed and the ReLU activation function is used to enhance nonlinear features.

[0074] 2) The Word2Vec-encoded data, the label-encoded data, and the extracted statistical features are normalized separately. After completion, they are concatenated and merged with the output vector of step 1) to form a new feature vector.

[0075] 3) The combined feature vector from step 2) is further processed through a fully connected layer to enable it to learn more complex relationships. It is then normalized and activated with ReLUs. To prevent overfitting and improve generalization, dropout is added.

[0076] 4) The HTTP request and response data encoded and padded by Word2Vec are passed to the Transformer encoder to obtain a new feature vector. Then, mean pooling is used to improve the generalization ability of the model.

[0077] 5) The feature vector obtained in step 4) is fully connected, normalized, ReLU activated and operated.

[0078] 6) Merge the output vectors of step 3) and step 5) and perform N times of full connection processing (including normalization, ReLU activation, Dropout, etc.).

[0079] 7) Perform a final full-connection on the output vector from step 6, outputting a vector of dimension 1. This is converted to a value between 0 and 1 using the Sigmoid function.

[0080] At the output layer, according to the output of the Sigmod function, if the result is greater than 0.5, the alarm is considered to be a false alarm; if the result is less than 0.5, the alarm is considered to be a true alarm.

[0081] The following combination Figure 4 The Transformer encoder structure used is exemplified, and the encoder includes: an input module Input Vec, an embedding module Input Embeding, a positional encoding module Positonal Encoding, a segmented embedding module Segment Embeding, and an Nx module. The Nx module exemplarily includes: a multi-head attention module Muti-headAttention, a normalization module Add&Norm, a feedforward module Feed Forward, another normalization module Add&Norm, and an output module Outputs Vec.

[0082] The input to the encoder in this embodiment is a series of word vectors. These word vectors are first passed through the Input Embedding module to map each token to a feature vector in a high-dimensional space. Since the Transformer model itself does not have the ability to process sequence data, positional encoding is required to provide information about the position of words in the sequence.

[0083] In some embodiments of the present application, position encoding is calculated using sine and cosine functions to generate a unique code for each position. This encoding method introduces different frequency combinations of sine and cosine, allowing the model to obtain valid position information based on the position of the input sequence. Specifically, the position encoding formula is as follows:

[0084]

[0085] Among them, pos represents the position in the sequence, i represents the dimension index of the embedding vector, and d model is the total dimension of the embedding vector. Through this encoding method, the model can incorporate the order information in the sequence into each feature vector, thereby better understanding and handling temporal dependencies.

[0086] After adding the positional encoding, the Transformer encoder in some embodiments of the present application further processes the feature vector through a segment embedding module, dividing the input vector into block vectors of the same length to ensure batch consistency. The encoder then processes it through an N-layer multi-head attention mechanism, residual connection and normalization, and a feed forward neural network.

[0087] The Transformer's multi-head attention mechanism simultaneously focuses on multiple locations in the input sequence, effectively capturing long-range dependencies between elements in the sequence. This mechanism performs a global analysis of the input data by computing multiple attention heads in parallel, generating richer contextual information. Combined with residual connections and normalization, this ensures stable gradient propagation, preventing model degradation and overfitting during deep learning.

[0088] After multiple layers of processing, the feature vectors are further integrated to form the model's final output. Through this structure, the Transformer encoder can provide deep feature representations for complex data patterns, significantly enhancing the model's ability to understand and process diverse input data.

[0089] It is not difficult to understand that S102 confirms whether the alarm data is a real alarm through the target real alarm recognition model, including: preprocessing the alarm data through the input layer; quantizing the preprocessed data through the feature quantization layer to obtain a feature vector; calculating the authenticity estimation value for the alarm data through the model processing layer and the feature vector; and outputting the authenticity estimation value through the output layer.

[0090] In some embodiments of the present application, the alarm data carries an HTTP request, an HTTP response, or an HTTP URL; wherein, S102 confirms whether the alarm data is a real alarm through the target real alarm recognition model, including: initially encoding the HTTP request, HTTP response, or HTTP URL carried by the alarm data through the Word2Vec model to obtain a word sequence; generating unique corresponding position coding information for each word in the word sequence; adding the position coding information to the word sequence to obtain a target sequence; dividing the target sequence into block vectors of the same length; and inputting the block vectors into the Transformer encoder for encoding.

[0091] In some embodiments of the present application, the alarm data includes a first category of data, a second category of data, a third category of data, and a fourth category of data (for the specific information carried by each of these four categories of data, please refer to the above description); wherein, the feature quantization layer is used to quantize the historical alarm data to obtain a feature vector, including: converting the text information included in the first category of data into a numerical feature vector to obtain a first feature vector; converting the second category of data into a sparse vector composed of 0 and 1 to obtain a second feature vector; mapping the third category of data into continuous numerical data to obtain a third feature vector; extracting the statistical features of the characters in the fourth category of data to obtain a fourth feature vector; and performing the following processing on the fourth category of data to obtain a fifth feature vector: encoding using the second Word2Vec model, filling with word position information, and encoding with a Transformer encoder; the model processing The method comprises the following steps: processing the second eigenvector one by one through one-dimensional convolution, normalization and ReLU activation function to obtain an initial second eigenvector; merging the normalized data of the first eigenvector, the third eigenvector and the fourth eigenvector with the initial second eigenvector to obtain a first merged vector; processing the first merged vector one by one through a fully connected layer, normalization, RLU activation function and dropout to obtain a first vector to be merged; performing the following operations on the fifth eigenvector in sequence to obtain a second vector to be merged: average pooling, full connection, normalization, ReLU activation and Dropout operation; merging the first vector to be merged and the second vector to be merged, and performing multiple full connection operations on the merged result to obtain a one-dimensional vector as the authenticity evaluation result of the training data alarm.

[0092] In one implementation, to improve the computational efficiency of the model, some embodiments of the present application use a computer equipped with at least one GPU to accelerate the model training and inference process. The parallel computing power of the GPU significantly shortens the training time of deep learning models, ensuring rapid iteration and optimization on large-scale data sets.

[0093] The training process of the model in some embodiments of the present application includes:

[0094] First, preprocessed alarm data is fed into the model for feature vectorization, converting the raw data into a numerical representation suitable for model learning. Next, the feature vectors are passed into the model for forward propagation, where they are processed layer by layer through the model's multi-layered network structure to generate a predicted output. This process, known as forward propagation, primarily aims to calculate the model's output under the current parameter settings.

[0095] After forward propagation, the predictions are compared with the true labels in the alert data. Binary Cross-Entropy (BCE) is used as the loss function to calculate the difference between the predictions and the true labels. The smaller the loss function value, the closer the model's predictions are to the true situation.

[0096] Next, the model parameters are updated based on the loss function. Specifically, the Adam optimizer is used to adjust the model parameters by calculating the gradient of the loss function with respect to each parameter. This process, called backpropagation, aims to improve the model's accuracy by continuously adjusting the parameters to minimize the loss function.

[0097] After completing a round of forward and backward propagation, the model's effectiveness is verified. If the loss function value meets the pre-set stopping criteria or reaches the expected model performance standard, model training ends and the final model parameters are saved. If it does not meet the requirements, the forward propagation calculation is repeated using the updated parameters, and the next round of training begins. This cycle is repeated until the model performance reaches the expected level.

[0098] Through the above training process, the model can continuously optimize its own parameters, thereby improving the classification and recognition capabilities of alarm data, and ultimately achieving effective distinction between real alarms and false alarms.

[0099] According to the training process described in the above example, the training process of some embodiments of the present application includes: first, historical alarm data needs to be collected. In order to ensure the accuracy and validity of the data, each piece of collected alarm data needs to be manually labeled. Specifically, for alarms triggered by real attack behaviors, they are marked as "0"; for false alarms caused by normal business activities, they are marked as "1". In this process, manual labeling is a key step, and a variety of methods can be used to improve efficiency, such as through rule matching (such as using pre-defined alarm rules) or batch search (such as automated scripts to quickly filter out alarms with similar features) and other means to ensure that data labeling is completed quickly and accurately.

[0100]

[0101] Table 1 Alarm data example

[0102] After labeling, the original data set needs to be further processed in order to be used for model training. Usually, the data set is divided into a training set and a validation set in a certain ratio (for example, 3:1). The training set is used to learn the model, and the validation set is used to evaluate the performance of the model during the training process. If the amount of data is sufficient, an independent test set can be additionally divided out to comprehensively evaluate and verify the final effect of the model after training is completed, so as to avoid overfitting and improve the generalization ability of the model. In this implementation, the example of the alarm data of the data set is shown in Table 1, which contains various types of alarm information and their corresponding labels.

[0103] After completing the data set segmentation, it is necessary to reasonably set the various hyperparameters of the model to ensure the effectiveness and stability of the training process. For the model proposed in this paper, the hyperparameters involved include the configuration of the Transformer encoder, Word2Vec model parameters, neural network structure, and other related training parameters. In this example, the specific hyperparameter settings are as follows:

[0104] 1) Transformer encoder hyperparameters:

[0105] The Transformer encoder uses an embedding dimension of 256, employs two attention heads, and has an overall network depth of two layers. To prevent excessive computational complexity or memory overflows caused by excessively long sequences being fed to the Transformer encoder at once, a segmented approach is used to break the input sequence into multiple 512-byte segments. Each segment retains the first 240 bytes of contextual information to maintain sequence continuity and semantic integrity. This segmented approach improves computational efficiency while ensuring model performance.

[0106] 2) Hyperparameters of the Word2Vec model:

[0107] The Word2Vec model uses different word vector dimensions for different feature fields: the word vector dimension of the threat information field is 16, the dimension of the source address and destination address fields is 8, the word vector dimension of the HTTP request field is 256, and the word vector dimension of the HTTP response field is 256.

[0108] 3) Hyperparameters of the neural network structure:

[0109] The neural network architecture has been redesigned to handle different types of encoded data. A 64-dimensional fully connected neural network is used to process one-hot encoded features. The feature vectors of HTTP requests and responses are encoded in 256 dimensions, as are the remaining features. After all feature vectors are combined, they are fed into a deeper neural network for further feature extraction and learning. The network structure consists of 128- and 256-dimensional fully connected layers to ensure the model has sufficient capacity to capture complex feature patterns.

[0110] 4) Other hyperparameter settings:

[0111] The initial learning rate was set to 0.008. To ensure better model convergence, a step-wise learning rate adjuster (StepLR) was used, adjusting the learning rate to 80% of the original value after each training iteration. This dynamic adjustment strategy helps maintain a high learning rate in the early stages of training to accelerate model convergence; it gradually reduces the learning rate in the later stages to avoid model oscillation as the model approaches the global optimal solution.

[0112] After completing the hyperparameter settings, the model training process begins. In some examples of this application, the validation criterion for the model's effectiveness is based on the binary cross-entropy loss value on the validation set. When the loss value no longer continues to decrease with the increase in the number of training times, it means that the model has reached a convergence state and the training process can be terminated.

[0113] To comprehensively evaluate model performance, in some examples of this application, 30% of the total dataset is allocated as a test set for independent performance testing. The data in the test set does not participate in model learning during training, ensuring that it reflects the model's performance in real-world scenarios. After model training is complete, the test set undergoes the same preprocessing steps as the training data before being fed into the model for prediction evaluation.

[0114] Test results show that the model's overall accuracy on the test set was 0.903, indicating that the model correctly identified 90.3% of all alarm samples (including real alarms and false alarms). In addition, in terms of detecting false alarms, the model's accuracy reached 0.863, which means that 86.3% of the samples the model identified as false alarms were correct. At the same time, the model's recall rate for false alarm samples was 0.808, indicating that the model was able to identify 80.8% of false alarms. In terms of the F0.5 value, a comprehensive evaluation indicator for false alarm detection, the model achieved a score of 0.862, indicating that the model pays attention to precision while also taking into account a certain recall rate.

[0115] These test results show that the model provided by the embodiments of the present application has good performance in alarm noise reduction, especially in the detection and processing of false alarm samples, showing high accuracy and reasonable recall rate, effectively reducing the interference of false alarms on safety operations.

[0116] It is not difficult to understand that the technical advantages brought about by adopting the above technical solutions provided in the embodiments of the present application include:

[0117] 1) It can significantly improve the accuracy and precision of alarm classification. The embodiments of the present application use the Transformer encoder to process the most complex and critical parts of the alarm data (such as HTTP request and response content), which can capture long-distance dependencies and complex interactive information in the data on a global scale. This characterization process greatly improves the model's ability to understand and represent alarm data, allowing the model to more accurately distinguish between real alarms and false alarms when classifying alarms, reducing the false alarm rate.

[0118] 2) The method proposed in the embodiment of the present application can improve the efficiency of alarm noise reduction. The overall structural design of the alarm noise reduction model proposed in the embodiment of the present application is reasonable. Through the combination of multiple deep learning technologies such as feature vectorization, fully connected neural network processing, pooling layer, normalization, activation function and Dropout, a hierarchical and multi-modular processing flow is formed. This structural design enables the model to efficiently process large-scale, high-dimensional alarm data, effectively reduce false alarms, while maintaining good generalization capabilities, and can cope with diverse attack types and ever-changing network environments.

[0119] 3) The implementation of the present application can reduce the workload of security operations personnel. By significantly reducing the number of false alarms, the implementation of the present application greatly reduces the workload of security operations personnel. Operations personnel no longer need to waste a lot of time and energy screening and handling false alarms, and can focus more on analyzing and responding to real security threats, thereby improving the efficiency and response speed of overall network security operations.

[0120] 4) The model in the embodiment of the present application possesses continuous learning and self-optimization capabilities. The model in the embodiment of the present application is self-learning. By continuously inputting new alarm data for training and optimization, the model can gradually improve its ability to detect new and unknown attacks. This continuous learning and self-optimization feature enables the model to maintain efficient detection and response capabilities in the face of ever-changing network environments and attack methods.

[0121] In summary, the improvements of the embodiments of the present application include: First, the Transformer encoder is used to perform feature processing on complex alarm data. One of the core innovations of the present invention is to use the Transformer encoder to perform feature processing on the most critical and complex parts of the alarm data, such as HTTP request content and HTTP response content. HTTP request and response data are usually highly unstructured, and their content often contains a large amount of noise and redundant information, which makes it difficult for traditional feature extraction methods to effectively capture the deep patterns therein. By introducing the Transformer encoder, the present invention can make full use of its powerful self-attention mechanism to capture long-distance dependencies and complex interactive information in the data on a global scale, thereby generating high-quality feature vectors. This method significantly improves the model's ability to understand and process alarm data, and effectively improves the accuracy and robustness of alarm classification. Secondly, the overall structural design of the alarm denoising model. Another innovation of the present invention lies in the overall structural design of the alarm denoising model, especially the structure of the processing layer in the model. This model adopts a multi-layer deep learning network to process multiple features in the alarm data through hierarchical processing. The model first performs corresponding feature encoding on different types of data (such as classified data, text data, ordered data, etc.), and then processes and fuses these features layer by layer through a multi-layer fully connected neural network. The internal structure of the model also includes a variety of deep learning technologies such as normalization, activation function, pooling layer and Dropout to ensure that when processing large-scale, high-dimensional alarm data, overfitting can be effectively prevented and the generalization ability of the model can be maintained. In addition, the present invention pays special attention to modularity and scalability in structural design, so that the model can flexibly adjust the configuration of each processing module according to different application scenarios and alarm data types to achieve the best noise reduction effect.

[0122] like Figure 5 As shown, the training method provided in some embodiments of the present application includes: inputting alarm data; feature vectorization; model calculation forward propagation; calculating loss (BCE Second Hospital cross entropy); directional propagation updating parameters (Adam optimizer); verifying the model effect. If it is confirmed that it does not meet the standard, returning to the model calculation forward propagation; if it is confirmed that it meets the standard, the training ends and obtains the target real alarm recognition model. The specific process can be referred to the description above, and to avoid repetition, it will not be repeated here.

[0123] Please refer to Figure 6 , Figure 6 The embodiment of the present application shows a device for network security alarm noise reduction based on Transformer. It should be understood that the device is similar to the above-mentioned Figure 1The method embodiment corresponds to the device and is capable of executing each step involved in the method embodiment. The specific functions of the device can be found in the description above; to avoid repetition, a detailed description is omitted here. The device includes at least one software functional module that can be stored in a memory in the form of software or firmware or embedded in the device's operating system. The Transformer-based network security alarm noise reduction device includes: an alarm information acquisition module 610 and an alarm result authenticity prediction module 620.

[0124] The alarm information acquisition module 610 is configured to acquire alarm data, wherein the alarm data is generated in real time by the security device.

[0125] The alarm result authenticity prediction module 620 is configured to input the alarm data into the target true alarm recognition model, and confirm whether the alarm data is a true alarm through the target true alarm recognition model, wherein the target true alarm recognition model includes an input layer, a feature quantization layer, a target model processing layer and an output layer, and the feature quantization layer is at least configured to use a Transformer encoder to encode the dependency and interaction information obtained from the HTTP request and response content.

[0126] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0127] Some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method for detecting false alarm information as described in the above embodiments can be implemented.

[0128] Some embodiments of the present application provide a computer program product, including computer program instructions, which, when read and executed by a processor, execute the method for detecting false alarm information as described in the above embodiments.

[0129] like Figure 7 As shown, some embodiments of the present application provide an electronic device 700, including a memory 710, a processor 720, and a computer program stored on the memory 710 and executable on the processor 720, wherein the processor 720 reads the program from the memory 710 through a bus 730 and executes the program to implement the method for detecting false alarm information as described in any one of the above embodiments.

[0130] Processor 720 can process digital signals and can include various computing architectures, such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, processor 720 can be a microprocessor.

[0131] The memory 710 may be used to store instructions executed by the processor 720 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 720 of the embodiment of the present disclosure may be used to execute the instructions in the memory 710 to implement Figure 1 The memory 710 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory or other memory known to those skilled in the art.

[0132] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0133] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0134] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0135] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0136] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0137] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A network security alarm noise reduction method based on Transformer, characterized by: The method comprises: Acquiring alarm data, wherein the alarm data is generated in real time by a security device; Inputting the alarm data into a target real alarm identification model, and confirming whether the alarm data is a real alarm through the target real alarm identification model, wherein the target real alarm identification model includes an input layer, a feature quantization layer, a target model processing layer, and an output layer, and the feature quantization layer is at least configured to use a Transformer encoder to encode dependency and interaction information obtained from HTTP request and response content; The confirming whether the alarm data is a real alarm by using the target real alarm identification model includes: Preprocessing the alarm data through the input layer; The pre-processed data is quantized by the feature quantization layer to obtain a feature vector; Calculating a truth estimation value for the alarm data through the model processing layer and the feature vector; Outputting the authenticity estimation value through the output layer; The input layer includes: A first type of information input module is configured to input the first type of data carried by the alarm data into a corresponding encoding module; A second type of information input module is configured to input the second type of data carried by the alarm data into a corresponding encoding module; A third type of information input module is configured to input the third type of data carried by the alarm data into a corresponding encoding module; a fourth type of information input module, configured to input the fourth type of data carried by the alarm data into a corresponding encoding module; The feature quantization layer includes: a first encoding module, configured to be connected to the output end of the first type of information input module, and to encode the first type of data using a Word2Vec model to obtain a first feature code; a second encoding module, configured to be connected to the output end of the second type of information input module and to encode the second type of data using a one-hot encoding model to obtain a second feature code; a third encoding module, configured to be connected to the output end of the third type of information input module and to encode the third type of data using a label embedding model to obtain a third feature code; a fourth encoding module, configured to be connected to the output end of the fourth type of information input module, and to encode the fourth type of data by extracting statistical features of the fourth type of information to obtain a fourth feature code; a fifth encoding module, configured to be connected to the output end of the fourth type of information input module, and to encode the fourth type of data using at least a Word2Vec model and a Transformer encoder to obtain a fifth feature code; The target model processing layer includes: a first processing unit configured to process the input first concatenated vector sequentially through a first fully connected layer, a first normalization processing layer, an activation function, and an anti-overfitting algorithm to obtain a first vector to be concatenated, wherein the first concatenated vector is obtained by concatenating the first feature code, the third feature code, the fourth feature code, and the preprocessed second feature code, wherein the preprocessing includes one-dimensional convolution and normalization; a second processing unit configured to process the fifth feature code sequentially through a second fully connected layer, a second normalization processing layer, an activation function, and an anti-overfitting algorithm to obtain a second vector to be concatenated; a third processing unit configured to process the input target splicing vector sequentially through a third fully connected layer, a third normalization processing layer, an activation function, and an anti-overfitting algorithm to obtain a current alarm authenticity assessment result, wherein the target splicing vector is obtained by splicing the first vector to be spliced ​​and the second vector to be spliced; Before inputting the alarm data into the real alarm recognition model, the method further comprises: training the model processing layer to obtain the target model processing layer; The step of training the model processing layer to obtain the target model processing layer includes: Collect historical alarm data, wherein the historical alarm data includes attack name, HTTP request and response content; Marking the historical alarm data into two types: false alarm and non-false alarm as label data; quantizing the historical alarm data using the feature quantization layer to obtain a feature vector; Obtaining an authenticity assessment result for the historical alarm data using the model processing layer and the feature vector; A loss function is used to determine the difference between the authenticity assessment result and the corresponding label data to obtain a loss value, and whether to continue training is determined based on the loss value.

2. The method according to claim 1, wherein The alarm data carries an HTTP request, an HTTP response or an HTTP URL; wherein, The confirming whether the alarm data is a real alarm by using the target real alarm identification model includes: Performing initial encoding on the HTTP request, HTTP response or HTTP URL carried in the alarm data using a Word2Vec model to obtain a word sequence; Generating unique corresponding position encoding information for each word in the word sequence; Adding the position encoding information to the word sequence to obtain a target sequence; Dividing the target sequence into block vectors of the same length; The block vector is input into the Transformer encoder for encoding.

3. The method according to claim 2, wherein The historical alarm data includes first-category data, second-category data, third-category data, and fourth-category data; wherein, The adopting the feature quantization layer to quantize the historical alarm data to obtain a feature vector includes: Converting the text information included in the first category of data into a numerical feature vector to obtain a first feature vector; Convert the second type of data into a sparse vector consisting of 0 and 1 to obtain a second eigenvector; Mapping the third type of data into continuous numerical data to obtain a third eigenvector; Extracting statistical features of characters in the fourth category of data to obtain a fourth feature vector; and The fourth type of data is processed as follows to obtain a fifth feature vector: encoded using the second Word2Vec model, filled with word position information, and encoded using the Transformer encoder; The obtaining of an authenticity assessment result for the historical alarm data by using the model processing layer and the feature vector includes: Processing the second eigenvectors one by one through one-dimensional convolution, normalization, and ReLU activation function to obtain an initial second eigenvector; Merging the data obtained by normalizing the first eigenvector, the third eigenvector, and the fourth eigenvector with the initial second eigenvector to obtain a first merged vector; Processing the first merged vectors one by one through a fully connected layer, normalization, an RLU activation function, and dropout to obtain a first vector to be merged; Performing the following operations on the fifth eigenvector in sequence to obtain a second vector to be merged: average pooling, full connection processing, normalization processing, ReLU activation and Dropout operation; Merging the first to-be-merged vector and the second to-be-merged vector, and performing multiple full-connection processes on the merged result to obtain a one-dimensional vector as the historical alarm data; Among them, the first type of data is used to carry threat information, source address or destination address, the second type of data is unordered classified data, and the unordered classified data includes HTTP request method, the hour of occurrence time or numerical data after binning processing; the third type of data is ordered classified data, and the ordered classified data includes alarm level or confidence level; the fourth type of data includes multi-character type data, and the multi-character type data includes HTTP request, HTTP response or HTTP URL.

4. A device for detecting false alarm information, characterized in that: The device comprises: an alarm information acquisition module, configured to acquire alarm data, wherein the alarm data is generated in real time by a security device; an alarm result authenticity prediction module, configured to input the alarm data into a target true alarm identification model and confirm whether the alarm data is a true alarm through the target true alarm identification model, wherein the target true alarm identification model includes an input layer, a feature quantization layer, a target model processing layer, and an output layer, and the feature quantization layer is configured to use at least a Transformer encoder to encode dependency and interaction information obtained from HTTP request and response content; The alarm result authenticity prediction module is further configured to: pre-process the alarm data through the input layer; quantize the pre-processed data through the feature quantization layer to obtain a feature vector; calculate the authenticity estimation value for the alarm data through the model processing layer and the feature vector; and output the authenticity estimation value through the output layer; The input layer includes: A first type of information input module is configured to input the first type of data carried by the alarm data into a corresponding encoding module; A second type of information input module is configured to input the second type of data carried by the alarm data into a corresponding encoding module; A third type of information input module is configured to input the third type of data carried by the alarm data into a corresponding encoding module; a fourth type of information input module, configured to input the fourth type of data carried by the alarm data into a corresponding encoding module; The feature quantization layer includes: a first encoding module, configured to be connected to the output end of the first type of information input module, and to encode the first type of data using a Word2Vec model to obtain a first feature code; a second encoding module, configured to be connected to the output end of the second type of information input module and to encode the second type of data using a one-hot encoding model to obtain a second feature code; a third encoding module, configured to be connected to the output end of the third type of information input module and to encode the third type of data using a label embedding model to obtain a third feature code; a fourth encoding module, configured to be connected to the output end of the fourth type of information input module, and to encode the fourth type of data by extracting statistical features of the fourth type of information to obtain a fourth feature code; a fifth encoding module, configured to be connected to the output end of the fourth type of information input module, and to encode the fourth type of data using at least a Word2Vec model and a Transformer encoder to obtain a fifth feature code; The target model processing layer includes: a first processing unit configured to process the input first concatenated vector sequentially through a first fully connected layer, a first normalization processing layer, an activation function, and an anti-overfitting algorithm to obtain a first vector to be concatenated, wherein the first concatenated vector is obtained by concatenating the first feature code, the third feature code, the fourth feature code, and the preprocessed second feature code, wherein the preprocessing includes one-dimensional convolution and normalization; a second processing unit configured to process the fifth feature code sequentially through a second fully connected layer, a second normalization processing layer, an activation function, and an anti-overfitting algorithm to obtain a second vector to be concatenated; a third processing unit configured to process the input target splicing vector sequentially through a third fully connected layer, a third normalization processing layer, an activation function, and an anti-overfitting algorithm to obtain a current alarm authenticity assessment result, wherein the target splicing vector is obtained by splicing the first vector to be spliced ​​and the second vector to be spliced; Before inputting the alarm data into the real alarm recognition model, the device further comprises: a module for training the model processing layer to obtain the target model processing layer; The target model processing layer module obtained by training the model processing layer is configured as follows: Collect historical alarm data, wherein the historical alarm data includes attack name, HTTP request and response content; Marking the historical alarm data into two types: false alarm and non-false alarm as label data; quantizing the historical alarm data using the feature quantization layer to obtain a feature vector; Obtaining an authenticity assessment result for the historical alarm data using the model processing layer and the feature vector; A loss function is used to determine the difference between the authenticity assessment result and the corresponding label data to obtain a loss value, and whether to continue training is determined based on the loss value.

5. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the program is executed by a processor, the method according to any one of claims 1 to 3 can be implemented.

6. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 3 is executed.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 3 can be implemented.

Images