Alarm data classification processing method and device for low-frequency high-risk attack alarm identification

Abstract

The application provides an alarm data classification processing method and device for low-frequency high-risk attack alarm identification, which comprises the following steps: determining the importance of each alarm set based on attack frequency and alarm danger level, cyclically traversing the first attack service attribute of each alarm set in the attack set to obtain a target alarm set with the highest importance, and taking the first attack service attribute of the target alarm set as the second attack service attribute of the attack set; performing incremental sorting on the attack set with the same source IP address and destination IP address according to the start time attribute to obtain an attack sequence; sorting the target attack subsequence with a length greater than a preset length in the attack sequence according to the attack stage attribute and the second attack service attribute of the intrusion alarm to obtain a target attack subsequence; and performing classification processing on the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets, thereby improving the accuracy and reliability of attack identification.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data classification processing, and in particular to an alarm data classification processing method and device for low-frequency high-risk attack alarm identification. BACKGROUND

[0002] With the continuous development of information technology, network security has become the focus of attention of various organizations and individuals. Advanced persistent threat (APT) attacks pose a great challenge to network security defense. APT attacks are usually covert and persistent, and can bypass normal defense mechanisms to monitor and penetrate target systems for a long time, resulting in serious information leakage and system paralysis. Therefore, how to timely and effectively detect and respond to APT attacks has become an important issue in the field of network security today. In the face of APT attacks, timely and accurate discovery of intrusion behavior is crucial to network security.

[0003] However, intrusion detection systems (IDS) often generate a large amount of alarm data, which contains a large amount of noise and redundant information. Applying statistical methods to analyze such alarm data processing has certain risks, such as low-frequency but high-risk attack alarm data being easily filtered, resulting in insufficient attack identification accuracy, which poses a great challenge to security and operation personnel. SUMMARY

[0004] The present application provides an alarm data classification processing method and device for low-frequency high-risk attack alarm identification, to solve the defects in the prior art that applying statistical methods to analyze such alarm data processing has certain risks, such as low-frequency but high-risk attack alarm data being easily filtered, resulting in insufficient attack identification accuracy.

[0005] The present application provides an alarm data classification processing method for low-frequency high-risk attack alarm identification, comprising the following steps:

[0006] processing the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes source IP address, source port number, destination IP address, destination port number, intrusion alarm time and alarm signature attribute;

[0007] Based on the standard intrusion alarm data, determine the attack frequency of each alarm set, and based on the attack frequency and alarm danger level, determine the importance of each alarm set, loop through the first attack service attribute of each alarm set in the attack set, get the target alarm set with the highest importance, and take the first attack service attribute of the target alarm set as the second attack service attribute of the attack set;

[0008] sorting attack sets with the same source IP address and destination IP address in ascending order by the start time attribute to obtain an attack sequence, and determining an attack subsequence based on the attack sequence;

[0009] The target attack subsequences in the attack sequence whose length is greater than a preset length are sorted according to the attack phase attribute and the second attack service attribute of the intrusion alarm to obtain the target attack subsequences, and the target attack subsequences are classified using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets.

[0010] According to the present invention, an alarm data classification and processing method for identifying low-frequency, high-risk attack alarms is provided, wherein the importance of each alarm set is determined based on the attack frequency and the alarm danger level, including:

[0011] The importance of each alarm set is determined based on the following formula:

[0012]

[0013] in, Indicates the importance of each alarm set, Indicates the attack frequency, Indicates the alarm danger level.

[0014] According to the present invention, an alarm data classification processing method for identifying low-frequency high-risk attack alarms is provided, wherein the attack frequency of each alarm set is determined based on the standard intrusion alarm data, including:

[0015] Performing repeated alarm filtering on the standard intrusion alarm data to obtain filtered intrusion alarm data;

[0016] Dividing the filtered intrusion alarm data according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data;

[0017] The candidate intrusion alarm data are grouped based on the source IP address and the destination IP address to obtain grouped intrusion alarm data, and the attack frequency of each alarm set is determined based on the grouped intrusion alarm data and a first preset time duration.

[0018] According to the present invention, an alarm data classification and processing method for identifying low-frequency high-risk attack alarms is provided, wherein the standard intrusion alarm data is subjected to repeated alarm filtering to obtain filtered intrusion alarm data, including:

[0019] query the same source IP address, source port number, destination IP address, destination port number, alarm signature attribute and attack service attribute in the standard intrusion alarm data, and the time of the intrusion alarm is within the second preset time length alarm data;

[0020] Based on the alarm data, determine the filtered intrusion alarm data.

[0021] According to the alarm data, determine the filtered intrusion alarm data.

[0022] According to the alarm data, determine the filtered intrusion alarm data.

[0023] The original intrusion alarm data is processed into standard intrusion alarm data, including:

[0024] Based on the original source IP address, determine the source IP address of the standard intrusion alarm data;

[0025] Based on the original destination IP address, determine the destination IP address of the standard intrusion alarm data;

[0026] Based on the original source port number, determine the source port number of the standard intrusion alarm data;

[0027] Based on the original destination port number, determine the destination port number of the standard intrusion alarm data;

[0028] Based on the timestamp, determine the time of the intrusion alarm of the standard intrusion alarm data;

[0029] Based on the descriptive signature, determine the alarm signature attribute of the standard intrusion alarm data.

[0030] The application also provides a kind of alarm data classification processing device for low-frequency high-risk attack alarm identification, including following unit:

[0031] Processing unit, for processing original intrusion alarm data into standard intrusion alarm data;The standard intrusion alarm data includes source IP address, source port number, destination IP address, destination port number, the time of intrusion alarm and alarm signature attribute;

[0032] The traversal unit is configured to determine attack frequencies of each alarm set based on the standard intrusion alarm data, determine importance of the alarm set based on the attack frequencies and alarm danger levels, and traverse attack service attributes of the alarm set in the attack set in a loop to obtain a target alarm set with the highest importance, and take the attack service attributes of the target alarm set as the attack service attributes of the attack set.

[0033] The determination unit is configured to sort attack sets with the same source IP address and destination IP address in ascending order according to start time attributes to obtain an attack sequence, and determine an attack subsequence based on the attack sequence.

[0034] The classification processing unit is configured to sort a target attack subsequence with a length greater than a preset length in the attack sequence according to attack stage attributes and attack service attributes of intrusion alarms to obtain the target attack subsequence, and perform classification processing on the target attack subsequence using a suffix-based probabilistic deterministic finite automaton to obtain importance of different attack sets.

[0035] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the alarm data classification processing method for low-frequency high-risk attack alarm recognition when executing the program.

[0036] The application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and the computer program implements the alarm data classification processing method for low-frequency high-risk attack alarm recognition when executed by a processor.

[0037] The application further provides a computer program product including a computer program, and the computer program implements the alarm data classification processing method for low-frequency high-risk attack alarm recognition when executed by a processor.

[0038] The alarm data classification processing method and device for low-frequency high-risk attack alarm recognition provided by the application, on the one hand, determines attack frequencies of each alarm set based on standard intrusion alarm data, determines importance of the alarm set based on the attack frequencies and alarm danger levels, and classifies alarms using importance based on a statistical method, so that low-frequency high-risk alarm is not filtered out, and the precision and effect of attack recognition detection are improved; on the other hand, a suffix-based probabilistic finite state automaton model is used to extract context time relationships between attack sequences, optimize attack sequence classification, and use a high-severity attack stage at the end of an attack subsequence (ESS) to reversely learn a suffix model to determine which attacks finally lead to a high-severity attack stage, identify importance of different attack sets, and further improve the accuracy and reliability of attack recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 This is one of the flow charts of the alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention.

[0041] Figure 2 Schematic diagram of the change of attack frequency over time provided by the present invention.

[0042] Figure 3 Schematic diagram of the S-PDFA main model for attack identification for alarm classification provided by the present invention.

[0043] Figure 4 It is a schematic diagram of the S-PDFA receiver model for attack identification for alarm classification provided by the present invention.

[0044] Figure 5 It is a schematic diagram of the success rate of attack service identification of the CCDC dataset provided by the present invention.

[0045] Figure 6 This is a schematic diagram of the CPTC 2018 data attack service identification success rate provided by the present invention.

[0046] Figure 7 This is the second flow diagram of the alarm data classification processing for low-frequency high-risk attack alarm identification provided by the present invention.

[0047] Figure 8 It is a structural diagram of the alarm data classification processing device for low-frequency high-risk attack alarm identification provided by the present invention.

[0048] Figure 9 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0050] Currently, many data mining and machine learning techniques have emerged in the field of intrusion detection, such as clustering analysis, anomaly detection, deep learning, etc. These techniques have achieved certain results in the field of intrusion detection, but there are still some challenges in analyzing intrusion alert data for APT attacks.

[0051] Figure 1 is one of the flowcharts of the alert data classification processing method for low-frequency high-risk attack alert identification provided by the application, as shown in Figure 1 The method comprises steps 110, 120, 130 and 140.

[0052] Step 110, processing the original intrusion alert data into standard intrusion alert data; the standard intrusion alert data comprises source IP address, source port number, destination IP address, destination port number, intrusion alert time and alert signature attribute.

[0053] Specifically, the original intrusion alert data can be obtained, and the original intrusion alert data can be processed into standard intrusion alert data. It can be understood that the original intrusion alert data generally comprises original source IP address src_ip, original destination IP address dst_ip, original source port number src_port and original destination port number dst_port, timestamp, descriptive signature signature and some protocol specific fields, etc. The application embodiments are not limited to this.

[0054] Considering that different intrusion alert formats are different, in order to facilitate subsequent processing, the first step is to process the complex intrusion alert data into a unified format , that is, standard intrusion alert data.

[0055] Further, the source IP address of the standard intrusion alert data can be determined based on the original source IP address; the destination IP address of the standard intrusion alert data can be determined based on the original destination IP address; the source port number of the standard intrusion alert data can be determined based on the original source port number; the destination port number of the standard intrusion alert data can be determined based on the original destination port number; the intrusion alert time of the standard intrusion alert data can be determined based on the timestamp; finally, the alert signature attribute of the standard intrusion alert data can be determined based on the descriptive signature.

[0056] That is, each alert is iterated to read the required information, src_ip is the source IP address, src_port is the source port number, dst_ip is the destination IP address, and dst_port is the destination port number. The four attributes can be directly read from the original intrusion alert data. dt is the time of the intrusion alert, which can be directly obtained from the timestamp attribute of the original intrusion alert data. sign is the alert signature attribute, which is read from the signature attribute of the original intrusion alert data.

[0057] After the first step, the format of the original intrusion alert data is simplified, the processed alert format is uniform, and a large number of useless attributes are deleted, and the remaining information is the information required for subsequent processing. The above process belongs to the original alert label generation method for APT attacks.

[0058] Step 120, based on the standard intrusion alert data, determining the attack frequency of each alert set, and based on the attack frequency and the alert danger level, determining the importance of each alert set, iterating through the first attack service attribute of each alert set in the attack set, obtaining the target alert set with the highest importance, and taking the first attack service attribute of the target alert set as the second attack service attribute of the attack set.

[0059] Specifically, after obtaining the standard intrusion alert data, the attack frequency of each alert set can be determined based on the standard intrusion alert data.

[0060] Since the importance of each alert set is related to the attack frequency and the alert danger level of the alert set, the importance of the alert set can be calculated according to the attack frequency frequency and the alert danger level of each alert set in the attack set.

[0061] Based on the following formula, the importance of each alert set is determined:

[0062]

[0063] Wherein, represents the importance of each alert set, represents the attack frequency, represents the alert danger level.

[0064] Then, after obtaining the imp attribute of different kinds of alert sets in an attack set, the first attack service attribute tServe of each alert set in the attack set is looped to obtain the target alert set with the highest importance imp, and the first attack service attribute tServe of the target alert set is taken as the second attack service attribute mServe of the attack set. The above process belongs to the classification optimization method for identifying low-frequency high-risk level alerts.

[0065] Step 130, the attack sets with the same source IP address and destination IP address are incrementally sorted according to the starting time attribute to obtain an attack sequence, and based on the attack sequence, an attack subsequence is determined.

[0066] Specifically, different attack sets are obtained through the previous steps, and the attack sets with the same source IP address src_ip and destination IP address dst_ip are incrementally sorted according to the starting time attribute st to obtain an attack sequence EpisodeSequence, i.e. ES.

[0067] Subsequently, ES is partitioned into alert subsequences. First, find the attack set with a more serious mcat attribute (attack phase attribute of intrusion alert) than the attack set following it in ES, and mark the former as A and the latter as B. Then, A is regarded as the end of an attack sequence, and B is regarded as the beginning of a new attack set. After such splitting, the original ES is divided into multiple subsets, i.e. attack subsequences EpisodeSubSequence, abbreviated as ESS. The multiple ESS obtained through such repeated splitting ensure that the alert starting time st attribute and the attack phase mcat attribute of each element are incrementally sorted.

[0068] Step 140, the target attack subsequence with a length greater than a preset length in the attack sequence is sorted according to the attack phase attribute of the intrusion alert and the second attack service attribute to obtain a target attack subsequence, and the target attack subsequence is classified by using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets.

[0069] Specifically, in order to identify the importance of different attack sets, embodiments of the present application select to use a suffix-based probabilistic deterministic finite automaton for classification. A suffix-based probabilistic deterministic finite automaton (S-PDFA) reversely learns a suffix model to determine which attack sets eventually lead to a high severity attack phase. Attack sequences in the ESS obtained by previous operations are taken, each different ESS mcat (attack phase attribute of the intrusion alert) and mService (second attack service attribute) are arranged in the original order, and then the S-PDFA model is generated according to the following steps:

[0070] (1) First, use a red square to represent the same root node that all S-PDFAs have.

[0071] (2) Loop through the first different (mcat, mServe) split path in the trace to get different states, and each same (mcat, mServe) is a path to the same state, represented by a circle. Add two numbers in each square and circle and separate them with #, the left number is the state sequence number, and the right number is the state quantity.

[0072] (3) Mark the state quantity of the same parent node with the most child nodes with red, and mark other nodes with blue. Each path is an (mcat, mServe) pair.

[0073] (4) Loop through the first, second, third, … (mcat, mServe) pair of the trace to generate child nodes and get the complete S-PDFA.

[0074] In the generated S-PDFA, all nodes are collected to get the receiver model, and the remaining nodes form the main model. The red state in the S-PDFA model generated by this method is a state with a relatively high probability, and the blue state is a state with a relatively low probability. In this way, different attack sets are classified, and the attack set represented by the red state is important, and the attack set represented by the blue state is less important. The above process belongs to the attack identification S-PDFA model generation method for alert classification.

[0075] It can be understood that the embodiment of the application improves the accuracy and efficiency of intelligent detection of APT intrusion by deeply analyzing the behavior mode and attack path of APT attack, effectively clustering alarms based on attack stage extraction, and classifying attack stages based on the S-PDFA model, reduces the work burden of security operation personnel, and provides an important reference for formulating more effective network security defense strategies.

[0076] The method provided by the embodiment of the application, on the one hand, determines the attack frequency of each alarm set based on standard intrusion alarm data, and determines the importance of each alarm set based on the attack frequency and the alarm danger level, which is different from the statistical method of classifying and processing alarms based on importance, ensures that low-frequency high-danger-level alarms are not filtered out, and improves the precision and effect of attack identification and detection; on the other hand, a suffix-based probabilistic finite state automaton model is used to extract the context time relationship between attack sequences, optimize attack sequence classification, and use a suffix model to determine which attacks ultimately lead to high-severity attack stages by reverse learning that high-severity attack stages are at the end of ESS, identify the importance of different attack sets, and further improve the accuracy and reliability of attack identification.

[0077] Based on the above embodiment, the determination of the attack frequency of each alarm set based on the standard intrusion alarm data in step 120 comprises:

[0078] In step 121, the standard intrusion alarm data is filtered to obtain filtered intrusion alarm data.

[0079] In step 122, the filtered intrusion alarm data is divided according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data.

[0080] In step 123, the candidate intrusion alarm data is grouped based on the source IP address and the destination IP address to obtain grouped intrusion alarm data, and the attack frequency of each alarm set is determined based on the grouped intrusion alarm data and a first preset time length.

[0081] Specifically, after obtaining the standard intrusion alarm data, the standard intrusion alarm data can be filtered to obtain filtered intrusion alarm data.

[0082] Then, the filtered intrusion alarm data is divided according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data.

[0083] That is, the alert data after the above step of deduplication still needs further processing, which is to divide the attack phase of the intrusion alert here, and consider that the attack phase of the alert is from low severity attack phase to high severity attack phase step by step, and the attack phase of the intrusion alert is represented by mcat. The attack phase mcat can be obtained by mapping the sign alert signature, and there is a mapping table from sign to mcat.

[0084] According to the port of the victim computer attacked, the attacked service can be inferred, that is, the specific attack service of the attacker is mapped from the destination port number dst_port, and the dst_port attribute is mapped to the attack service attribute. The attack service attribute is represented by tserve.

[0085] After the above operation, the label sign of the alert and the victim port dst_port are mapped to the attributes required for subsequent processing. At this time, the attributes of each alert are: The above process belongs to the alert data preprocessing method based on attack phase and label mapping.

[0086] This step extracts the context correlation between the intrusion alert data, which needs to process the intrusion alert data into the form of attack sequence.

[0087] Here, the perspective of source IP address and target IP address aggregation is selected to process the discrete candidate intrusion alert data into attack sequences: this perspective can show the individual interaction between the unique attacker and the victim. The alert sequence is a list of alert windows between the unique attacker and the victim. On this basis, an attribute of an attack set episode is defined as: Where st and et are the start time and end time of an attack activity, mcat is the attack phase of the attack, and mServe is the most important service attacked in the attack.

[0088] Group the intrusion alert data obtained in the previous step according to the source IP address, target IP address and attack phase. The intrusion alert data in the group have the same src_ip, dst_ip, mcat attributes, and different dt, tServe attributes. Calculate the attack frequency of the alert in the unit time in the first preset time length (the first preset time length is 2.5 min) to obtain the attack frequency attribute frequency of the alert. At this time, for the alert set with the same src_ip, dst_ip, tServe, mcat attributes and different dt in the unit time, the following attributes are obtained: .

[0089] Here, the start of the attack frequency is considered to be the start of an attack activity, and the attack frequency is considered to be the end of an attack activity. The alert obtained in the previous step is grouped and traversed for each group, and is divided into multiple attack sets episodes according to the rise and fall of the attack frequency. At this time, the attributes of each attack set are: , st is the time when the attack frequency starts to rise, et is the time when the attack frequency falls to the lowest point, mcat is the common attack phase, and mServe represents the second attack service attribute of the attack set. The above process belongs to the alert data classification method of the low-frequency high-risk level alert attack phase matching.

[0090] Based on the above embodiment, step 121 includes:

[0091] Step 1211, query the same source IP address, source port number, destination IP address, destination port number, alert signature attribute and attack service attribute in the standard intrusion alert data, and the time of the intrusion alert is within the second preset time length of the alert data;

[0092] Step 1212, based on the alert data, determine the filtered intrusion alert data.

[0093] Specifically, the data processed in the previous step also needs to filter all repeated alert data occurring within 1 second interval, that is, traverse all alert data, find out the alert data with the same source IP address sIP, source port number dIP, destination IP address sPort, destination port number dPort, alert signature attribute sign and attack service attribute mcat, and the time difference of the intrusion alert time attribute is within the second preset time length (the second preset time length is 1 second), only keep the first occurrence of the alert, which can be expressed by the following formula:

[0094]

[0095]

[0096]

[0097] Wherein, sIP, dIP, sPort, dPort, sign and mcat represent the Chinese translation of source IP address, source port number, destination IP address, destination port number, alert signature attribute and attack service attribute, respectively.

[0098] Based on the above embodiment, the alert danger level is obtained by mapping the attack phase attribute and the first attack service attribute of the intrusion alert; the attack phase attribute is obtained by mapping the alert signature attribute.

[0099] In particular, a danger level of the alert is mapped based on an attack stage attribute mcat of the intrusion alert and a first attack service attribute tServe, the attack stage attribute mcat is mapped based on an alert signature attribute sign, and there is a mapping table of sign to mcat.

[0100] Based on any of the above embodiments, the intrusion alert data generated by IDS in the dataset CPTC-2018 has the following approximate format:

[0101] {'preview': False, 'offset': 486,'result': {'_raw': '{"timestamp":"2017-11-04T22:22:53.083381+0000","flow_id":2204912691514208,"in_iface":"eth0","event_type":"alert","src_ip":"10.0.254.32","src_port":42083,"dest_ip":"10.0.0.224","dest_port":44

[0102] 5,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2102465,"rev":9,"signature":"GPL NETBIOS SMB-DS IPC$ share access","category":"Generic Protocol Command Decode","severity":3},"app_proto":"smb","payload":"AAAARP9TTUJ1AAAAABgBKA

[0103] AAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAAAAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8\\ / Pz8A","stream":0,"packet":"CkM93FziCvjIXXn2CABFAAB8xelAAEAGYZIKAP4gCgAA4KRjAb1wC0htGoHRKYAYAPUTbwAAAQEICuA8j\\ / ICD1okAAAARP9TTUJ1AAAAABgBKAAAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAA

[0104] AAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8\ / Pz8A","packet_info":{"linktype":1}}', '_time': '2017-11-04T18:22:53.083-0400', 'alert.action': 'allowed', 'alert.category': 'Generic Protocol Command Decode', 'alert.gid': '1', 'alert.rev': '9', 'alert.sev

[0105] erity': '3', 'alert.signature': 'GPL NETBIOS SMB-DS IPC$ shareaccess', 'alert.signature_id': '2102465', 'app_proto':'smb', 'date_hour': '22', 'date_mday': '4', 'date_minute': '22', 'date_month': 'november', 'date_second': '53', 'date_wday': '

[0106] saturday', 'date_year': '2017', 'date_zone': '0', 'dest_ip': '10.0.0.224', 'dest_port': '445', 'event_type': 'alert', 'eventtype': 'nix-all-logs', 'flow_id': '2204912691514208', 'host': 'kalivdi02-n9.nationals.vdi.gothamelections.com', 'in_ifac

[0107] e': 'eth0', 'index': 'ids', 'linecount': '1', 'packet': 'CkM93FziCvjIXXn2CABFAAB8xelAAEAGYZIKAP4gCgAA4KRjAb1wC0htGoHRKYAYAPUTbwAAAQEICuA8j / ICD1okAAAARP9TTUJ1AAAAABgBKAAAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAAAAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8 / Pz8A',

[0108] 'packet_info.linktype': '1', 'payload': 'AAAARP9TTUJ1AAAAABgBKAAAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAAAAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8 / Pz8A', 'proto': 'TCP', 'punct': '{"":"--::.+","":,"":"","":"","":"...","":,"":"..."','region': 'National','sc

[0109] hool': 'Stanford University','source': ' / var / log / suricata / alert-json.log','sourcetype':'suricata:alert','splunk_server':'splidx1','src_ip': '10.0.254.32','src_port': '42083','stream': '0', 'team': 'NationalTeam 9', 'timeendpos': '45',

[0110] 'timestamp': '2017-11-04T22:22:53.083381+0000', 'timestartpos': '14'}}

[0111] Alerts in the dataset are uniformly processed into this format

[0112] The data obtained by the previous step has many repeated alarms, and the alarms are the same in the attributes src_ip, src_port, dst_ip, dst_port and sign except that the dt attribute is different within 1s. This step filters all repeated alarms occurring within 1s and only keeps the first alarm. Next, the mcat attribute is obtained, and mcat can be mapped by sign, for example:

[0113] ('10.0.254.30',59481,'10.0.0.23',3306,'ETPOLICYSuspiciousinboundtomySQLport3306',datetime.datetime(2017,11,4,12,47,44,63121,tzinfo=datetime.timezone.utc),6)

[0114] From the foregoing analysis, the intrusion alarm is uniformly processed into the same format Where sIP and sPort are '10.0.254.30', 59481. dst_ip, dst_port are '10.0.0.23', 3306, and sign is 'ETPOLICYSuspiciousinboundtomySQLport3306'.

[0115] Table 1. sign to mcat mapping table

[0116]

[0117] The sign attribute is put into table 1 for lookup, and the corresponding attack stage mcat is MicroAttackStage.VULN_DISC.

[0118] According to table 2, the attack stage ID corresponding to MicroAttackStage.VULN_DISC is 6, and the last attribute of the example is obtained.

[0119] Table 2. Attack stage

[0120]

[0121] Here, the attacker's specific attack service can be mapped from dst_port and represented by tServe.

[0122] Figure 2 is a schematic diagram of the attack frequency changing with time provided by the application, as Figure 2As shown, the alarms are grouped according to the source IP, target IP and attack stage, and the frequency of these alarms is shown in the graph over time. The horizontal axis represents the alarm time in 2.5 minutes, and the vertical axis represents the alarm frequency. For example, Figure 2 As shown, Figure 2 This shows the change in the frequency of intrusion alert data for attacks from source IP 10.0.254.206 against victim IP 10.0.0.20 over time. An attack sequence begins with a scanning attack, where the severity of the attack phase (i.e., the mcat attribute) is low but the frequency is very high. After this, a high-severity attack phase is performed, and the frequency begins to decrease. An attack will cause the frequency of intrusion alerts to rise first and then fall. From this, we can reversely infer that the rise in the frequency of intrusion alerts over time marks the beginning of an attack, and the fall to the bottom marks the end of an attack. Figure 2 The alarm frequency of the part from time 0.0 to 7.0 starts to rise from 0.0, which indicates that this is the beginning of an attack set. The alarm frequency drops to a low point at 7.0, which indicates that this is the end of an attack set. The intrusion alarm data from time 0.0 to 7.0 is an attack set. Similarly, the part from time 9.0 to 13.0 is also an attack set.

[0123] Then the attack set ES is divided into ESS and modeled using S-PDFA:

[0124] Take the attack sequences with a length greater than 3 from the ESS obtained in the previous operation, study the mcat and mService attributes of each element, and arrange the mcat and mService of each different ESS in the original order, for example:

[0125] hostD|httpserD|unknownvulnD|mysql

[0126] hostD|remoteware-clserD|unknownvulnD|mysql

[0127] hostD|wap-wspserD|unknownvulnD|mysql

[0128] hostD|httpserD|unknownvulnD|mysql

[0129] hostD|unknownserD|unknownvulnD|mysql

[0130] bfCred|pop3sserD|unknownvulnD|mysql

[0131] hostD | httpserD | unknownvulnD | mysql

[0132] serD | unknownvulnD | mysqlserD | unknownvulnD | mysql

[0133] serD | unknownvulnD | mysqlserD | unknownvulnD | mysql

[0134] serD | unknownvulnD | mysqlserD | unknownvulnD | mysql

[0135] serD | unknownvulnD | mysqlhostD | us-cliserD | unknownvulnD | mysql

[0136] serD | unknownvulnD | mysqlserD | unknownvulnD | mysql

[0137] serD | unknownvulnD | mysqlserD | unknownvulnD | mysql

[0138] serD | unknownvulnD | mysqlserD | unknownvulnD | mysql

[0139] bfCred | pop3sserD | ag-swimvulnD | mysql

[0140] serD | unknownvulnD | mysqlhostD | http

[0141] serD | unknownvulnD | mysqlhostD | unknownserD | unknownvulnD | mysql

[0142] serD | unknownvulnD | mysqlhostD | httpserD | unknownvulnD | mysql

[0143] vulnD | mysqlhostD | remoteware-clserD | unknownvulnD | mysql

[0144] serD | unknownvulnD | mysqlserD | unknownvulnD | mysql

[0145] serD | unknown vulnD | mysql serD | unknown vulnD | mysql

[0146] serD | unknown vulnD | mysql serD | unknown vulnD | mysql

[0147] serD | unknown vulnD | mysql serD | unknown vulnD | mysql

[0148] serD | unknown vulnD | mysql hostD | etl service mgr serD | unknown vulnD | mysql

[0149] serD | unknown vulnD | mysql hostD | http serD | unknown vulnD | mysql

[0150] serD | unknown vulnD | mysql serD | unknown vulnD | mysql

[0151] exfil | http infoD | http vulnD | http hostD | http

[0152] dManip | http rPrivEsc | http ACE | http

[0153] exfil | http infoD | http vulnD | http hostD | http

[0154] dManip | http rPrivEsc | http ACE | http | http ACE | http

[0155] Each line in the example represents an ESS, the elements of the ESS are separated by spaces, and then the mcat attribute in the element is placed on the left of the | symbol, and the mService attribute is placed on the right of the | symbol, and then the S-PDFA model is generated.

[0156] Figure 3 is a schematic diagram of an alarm classification-oriented attack identification S-PDFA main model provided by the application, Figure 4 is a schematic diagram of an alarm classification-oriented attack identification S-PDFA receiver model provided by the application, as Figure 3 , Figure 4 indicated, the main model generated by using the above ESS is as shown in Figure 3 , and the receiver model is as Figure 4 .

[0157] To demonstrate the superiority of the proposed intrusion alert data classification and processing method for APT attacks in generating attack models accurately, an experiment was conducted to compare the algorithm's convergence and effectiveness. The comparison experiment groups included: a statistical intrusion alert processing method, which classified alerts and then filtered the most frequent ones to generate an alert set; and a random intrusion alert processing method, which classified alerts and then randomly filtered the alerts to generate an alert set. Experiments were conducted using these different selection strategies.

[0158] Figure 5 This is a schematic diagram of the success rate of attack service identification using the CCDC dataset provided by the present invention. Figure 6 This is a schematic diagram of the CPTC 2018 data attack service identification success rate provided by the present invention, as shown in Figure 5 、 Figure 6 The figure shows a comparison of the attack service identification success rate of the intrusion alarm processing method for low-frequency, high-risk level alarms and the other two methods. After analyzing multiple experimental results, it is not difficult to find that the intrusion alarm processing method for low-frequency, high-risk level has a higher attack service identification success rate than the randomly selected intrusion alarm processing method and the statistical-based intrusion alarm processing method.

[0159] The method provided by the embodiments of the present invention is based on cluster analysis of intrusion alert data to improve the detection and response efficiency of APT attacks. By performing cluster analysis on intrusion alert data, potential APT attack patterns and behavioral characteristics can be discovered, thereby more accurately identifying and locating potential threats.

[0160] Figure 7 This is the second flow chart of the alarm data classification process for low-frequency high-risk attack alarm identification provided by the present invention, such as Figure 7 As shown, the embodiment of the present invention designs an intrusion alarm data classification and processing method, which is mainly divided into four steps: a method for generating original alarm labels for APT attacks, a method for preprocessing alarm data based on attack stages and label mapping, a method for classifying alarm data for attack stage matching of low-frequency and high-risk level alarms, and a method for generating an S-PDFA model for attack identification for alarm classification.

[0161] The following describes the alarm data classification and processing device for low-frequency high-risk attack alarm identification provided by the present invention. The alarm data classification and processing device for low-frequency high-risk attack alarm identification described below and the alarm data classification and processing method for low-frequency high-risk attack alarm identification described above can be referenced to each other.

[0162] Based on any of the above embodiments, Figure 8FIG. 1 is a schematic diagram of the structure of the alarm data classification processing device for low-frequency high-risk attack alarm identification provided by the present invention. Figure 8 As shown, the device includes:

[0163] Processing unit 810, configured to process the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes source IP address, source port number, destination IP address, destination port number, intrusion alarm time and alarm signature attributes;

[0164] A traversal unit 820 is configured to determine the attack frequency of each alarm set based on the standard intrusion alarm data, and determine the importance of each alarm set based on the attack frequency and the alarm danger level, and traverse the attack service attributes of each alarm set in the attack set to obtain a target alarm set with the highest importance, and use the attack service attributes of the target alarm set as the attack service attributes of the attack set;

[0165] a determining unit 830 configured to sort attack sets with the same source IP address and destination IP address in ascending order according to a start time attribute to obtain an attack sequence, and determine an attack subsequence based on the attack sequence;

[0166] The classification processing unit 840 is used to sort the target attack subsequences in the attack sequence whose length is greater than a preset length according to the attack stage attribute and the attack service attribute of the intrusion alarm to obtain the target attack subsequences, and use a suffix-based probabilistic deterministic finite automaton to classify the target attack subsequences to obtain the importance of different attack sets.

[0167] The device provided by the embodiment of the present invention, on the one hand, determines the attack frequency of each alarm set based on standard intrusion alarm data, and determines the importance of each alarm set based on the attack frequency and the alarm danger level. Different from the statistical method of classifying and processing alarms by importance, it ensures that low-frequency and high-danger level alarms are not screened out, thereby improving the accuracy and effectiveness of attack identification and detection; on the other hand, it uses a suffix-based probabilistic finite state automaton model to extract the contextual time relationship between attack sequences, optimizes the attack sequence classification, and uses the fact that the high-severity attack stage is at the end of the ESS to reversely learn a suffix model to determine which attacks ultimately lead to the high-severity attack stage, identify the importance of different attack sets, and further improve the accuracy and reliability of attack identification.

[0168] Based on any of the above embodiments, the traversal unit 820 is specifically configured to:

[0169] The importance of each alarm set is determined based on the following formula:

[0170]

[0171] wherein, represents an importance degree of each alarm set, represents an attack frequency, represents an alarm danger level.

[0172] According to any one of the above embodiments, the traversal unit 820 is specifically configured to:

[0173] The repeated alarm filtering unit is configured to perform repeated alarm filtering on the standard intrusion alarm data to obtain filtered intrusion alarm data.

[0174] The division unit is configured to divide the filtered intrusion alarm data according to attack stages of the intrusion alarms to obtain candidate intrusion alarm data.

[0175] The attack frequency determination unit is configured to group the candidate intrusion alarm data based on the source IP address and the destination IP address to obtain grouped intrusion alarm data, and determine the attack frequency of each alarm set based on the grouped intrusion alarm data and a first preset time length.

[0176] According to any one of the above embodiments, the repeated alarm filtering unit is specifically configured to:

[0177] query alarm data with the same source IP address, source port number, destination IP address, destination port number, alarm signature attribute and attack service attribute in the standard intrusion alarm data, and with the time of the intrusion alarm within a second preset time length.

[0178] The alarm data is determined to be the filtered intrusion alarm data based on the alarm data.

[0179] According to any one of the above embodiments, the alarm danger level is obtained by mapping an attack stage attribute and a first attack service attribute of the intrusion alarm; and the attack stage attribute is obtained by mapping the alarm signature attribute.

[0180] According to any one of the above embodiments, the original intrusion alarm data includes an original source IP address, an original destination IP address, an original source port number, an original destination port number, a timestamp, a descriptive signature and a protocol-specific field.

[0181] The processing unit 810 is specifically configured to:

[0182] determine the source IP address of the standard intrusion alarm data based on the original source IP address.

[0183] determine the destination IP address of the standard intrusion alarm data based on the original destination IP address.

[0184] determine the source port number of the standard intrusion alert data based on the original source port number;

[0185] determine the destination port number of the standard intrusion alert data based on the original destination port number;

[0186] determine the time of the intrusion alert of the standard intrusion alert data based on the time stamp;

[0187] determine the alert signature attribute of the standard intrusion alert data based on the descriptive signature.

[0188] Figure 9 is a structural schematic diagram of an electronic device provided by the present application, as Figure 9 shown, the electronic device can include: a processor (processor) 910, a communications interface (communications interface) 920, a memory (memory) 930 and a communications bus 940, wherein the processor 910, the communications interface 920, the memory 930 complete the communication between each other through the communications bus 940. The processor 910 can call the logic instruction in the memory 930 to execute the alarm data classification processing method for low-frequency high-risk attack alarm identification, the method comprising: processing the original intrusion alert data into standard intrusion alert data; the standard intrusion alert data includes source IP address, source port number, destination IP address, destination port number, time of intrusion alert and alarm signature attribute; based on the standard intrusion alert data, determine the attack frequency of each alarm set, and based on the attack frequency and the alarm danger level, determine the importance of each alarm set, loop through the first attack service attribute of each alarm set in the attack set, get the target alarm set with the highest importance, and take the first attack service attribute of the target alarm set as the second attack service attribute of the attack set; sort the attack sequence according to the starting time attribute of the attack set with the same source IP address and destination IP address, and determine the attack subsequence based on the attack sequence; sort the target attack subsequence according to the attack stage attribute and the second attack service attribute of the intrusion alert in the attack sequence with a length greater than a preset length, get the target attack subsequence, and use the suffix-based probabilistic deterministic finite automaton to classify and process the target attack subsequence, get the importance of different attack sets.

[0189] In addition, the logic instructions in the memory 930 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0190] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor, so that the computer can execute the alarm data classification processing method for low-frequency high-risk attack alarm recognition provided by the above-mentioned method, which comprises: processing the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data comprises source IP address, source port number, destination IP address, destination port number, intrusion alarm time and alarm signature attribute; based on the standard intrusion alarm data, the attack frequency of each alarm set is determined, and based on the attack frequency and the alarm danger level, the importance of each alarm set is determined, the first attack service attribute of each alarm set in the attack set is looped and traversed, the target alarm set with the highest importance is obtained, and the first attack service attribute of the target alarm set is taken as the second attack service attribute of the attack set; the attack set with the same source IP address and destination IP address is sorted in ascending order according to the start time attribute, an attack sequence is obtained, and based on the attack sequence, an attack subsequence is determined; the target attack subsequence with a length greater than a preset length in the attack sequence is sorted according to the attack stage attribute and the second attack service attribute of the intrusion alarm, a target attack subsequence is obtained, and the target attack subsequence is classified and processed by using a suffix-based probabilistic deterministic finite automaton, so as to obtain the importance of different attack sets.

[0191] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the alert data classification processing method for low-frequency high-risk attack alert identification provided by the above method, the method comprising: processing original intrusion alert data into standard intrusion alert data; the standard intrusion alert data comprising source IP address, source port number, destination IP address, destination port number, intrusion alert time and alert signature attribute; determining the attack frequency of each alert set based on the standard intrusion alert data, and determining the importance of each alert set based on the attack frequency and the alert danger level, and cyclically traversing the first attack service attribute of each alert set in the attack set to obtain a target alert set with the highest importance, and taking the first attack service attribute of the target alert set as the second attack service attribute of the attack set; incrementally sorting the attack set with the same source IP address and destination IP address according to the start time attribute to obtain an attack sequence, and determining an attack subsequence based on the attack sequence; sorting the target attack subsequence with a length greater than a preset length in the attack sequence according to the attack phase attribute and the second attack service attribute of the intrusion alert to obtain a target attack subsequence, and performing classification processing on the target attack subsequence using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets.

[0192] The apparatus embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0193] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus necessary universal hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0194] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. An alarm data classification processing method for low-frequency high-risk attack alarm identification, characterized in that, The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets.

2. The alarm data classification processing method for low-frequency high-risk attack alarm recognition according to claim 1, characterized in that, The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. ； wherein, represents the importance of each alert set, represents the attack frequency, represents the alert danger level.

3. The alarm data classification processing method for low-frequency high-risk attack alarm recognition according to claim 1, characterized in that, The application relates to a method for processing original intrusion alert data into standard intrusion alert data, determining attack frequencies of each alert set based on the standard intrusion alert data, determining importance degrees of the alert sets based on the attack frequencies and alert danger levels, cyclically traversing first attack service attributes of the alert sets in an attack set to obtain a target alert set with the highest importance degree, taking the first attack service attributes of the target alert set as second attack service attributes of the attack set, incrementally sorting attack sets with the same source IP address and destination IP address according to a start time attribute to obtain an attack sequence, determining attack subsequences based on the attack sequence, sorting attack subsequences with lengths greater than a preset length in the attack sequence according to an attack stage attribute of an intrusion alert and the second attack service attribute to obtain a target attack subsequence, and classifying the target attack subsequence by using a suffix-based probabilistic deterministic finite automaton to obtain importance degrees of different attack sets. ​ ​ ​ 4. The alarm data classification processing method for low-frequency high-risk attack alarm recognition according to claim 3, characterized in that, ​ ​ ​ 5. The alarm data classification processing method for low-frequency high-risk attack alarm recognition according to any one of claims 1 to 4, characterized in that, ​ 6. The alarm data classification processing method for low-frequency high-risk attack-oriented alarm identification according to any one of claims 1 to 4, characterized in that, ​ ​ ​ ​ ​ determining the destination port number of the standard intrusion alert data based on the original destination port number; determining the time of the intrusion alert of the standard intrusion alert data based on the time stamp; determining the alert signature attribute of the standard intrusion alert data based on the descriptive signature.

7. An alarm data classification processing device for low-frequency high-risk attack alert recognition, characterized by, comprising: a processing unit configured to process original intrusion alert data into standard intrusion alert data; the standard intrusion alert data comprising a source IP address, a source port number, a destination IP address, a destination port number, a time of an intrusion alert, and an alert signature attribute; a traversal unit configured to determine an attack frequency of each alert set based on the standard intrusion alert data, and determine an importance of the each alert set based on the attack frequency and an alert danger level, and cyclically traverse an attack service attribute of the each alert set in an attack set to obtain a target alert set with the highest importance, and take the attack service attribute of the target alert set as the attack service attribute of the attack set; a determination unit configured to sort attack sets with the same source IP address and destination IP address in ascending order according to a start time attribute to obtain an attack sequence, and determine an attack sub-sequence based on the attack sequence; a classification processing unit configured to sort attack sub-sequences with a length greater than a preset length in the attack sequence according to an attack stage attribute and an attack service attribute of an intrusion alert to obtain a target attack sub-sequence, and perform classification processing on the target attack sub-sequence using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the alert data classification processing method for low-frequency high-risk attack alert recognition according to any one of claims 1 to 6. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the alert data classification processing method for low-frequency high-risk attack alert recognition according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the alert data classification processing method for low-frequency high-risk attack alert recognition according to any one of claims 1 to 6.

Images