Alarm event sorting method and device, equipment and storage medium

Abstract

The invention discloses an alarm event sorting method and device, equipment and a storage medium. The method comprises the steps of determining a target device node and an associated device node corresponding to an alarm event according to obtained address information in the alarm event; the associated device node is a device node having an association relationship with the target device node; determining a target importance degree according to the importance degree of the target device node and the importance degree of the associated device node; determining a severity degree and a confidence degree corresponding to the alarm event according to the alarm event; and performing weighted calculation on the target importance degree, the severity degree and the confidence coefficient to determine a sorting value corresponding to the alarm event, and sorting the alarm event according to the sorting value. According to the method provided by the invention, the processing efficiency of the alarm events is improved through priority ranking of the alarm events which better meet actual operation requirements.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and storage medium for sorting alarm events. Background Art

[0002] As cyber attacks become more frequent and complex, security devices generate a large number of security alerts every day, which poses a great challenge to security operators. In order to filter out high-threat alerts from a large number of alerts, ensure that limited security team resources can be focused on the most critical and urgent alerts, and then efficiently allocate resources and reduce risk losses, it is necessary to prioritize security alerts, improve the efficiency of alert event processing, and ensure the security of the organization and the stable operation of the business.

[0003] In the prior art, the priority of alarm events is usually sorted according to their event types, and the alarm events corresponding to the event types that have a greater impact on security equipment or economic losses are processed first. However, the network environment is constantly changing and complex, and the priority sorting only by the event type of alarm events does not meet the actual operation requirements, resulting in low efficiency in the processing of alarm events. Summary of the invention

[0004] Based on the above problems, the present application provides a method, device, equipment and storage medium for sorting alarm events, the purpose of which is to improve the processing efficiency of alarm events by sorting the alarm event priorities that better meets actual operating needs.

[0005] The embodiments of the present application disclose the following technical solutions:

[0006] In a first aspect, the present application provides a method for sorting alarm events, comprising:

[0007] According to the address information in the acquired alarm event, determine the target device node and the associated device node corresponding to the alarm event; the associated device node is a device node that has an associated relationship with the target device node;

[0008] Determine the target importance according to the importance of the target device node and the importance of the associated device nodes;

[0009] Determine the severity and confidence level of the alarm event according to the alarm event;

[0010] By performing weighted calculation on the target importance, severity and confidence, the ranking value corresponding to the alarm event is determined, and the alarm events are sorted according to the ranking value.

[0011] According to the address information obtained in the alarm event, the target device node and the associated device node corresponding to the alarm event are determined. Then, according to the importance of the target device node and the importance of the associated device node, the target importance is determined, taking into account the network location of the target device node and the contextual connectivity in actual operation, and improving the accuracy of the importance assessment dimension assignment. Then, according to the alarm event, the severity and confidence corresponding to the alarm event are determined, taking into account the actual handling of the alarm event and the possibility of the alarm event actually occurring, and improving the accuracy of the impact dimension and possibility dimension assignment of the alarm event. Finally, by weighted calculation of the target importance, severity and confidence, the ranking value corresponding to the alarm event is determined, and the alarm event is sorted according to the ranking value, realizing the sorting of the alarm event priority that is more in line with the actual operation needs, thereby improving the processing efficiency of the alarm event.

[0012] Optionally, the method as described above, determining the target device node and the associated device node corresponding to the alarm event according to the address information in the acquired alarm event, includes:

[0013] According to the address information, determine the target device node corresponding to the alarm event;

[0014] Determine the associated device nodes corresponding to the target device nodes from the network information topology map; the network information topology map is a connectivity map between different device nodes; the associated device nodes are downstream nodes of the target device nodes. By accurately identifying the associated device nodes associated with the target device nodes, the importance of the target device nodes in the actual operation process can be further analyzed to improve the accuracy of alarm event sorting.

[0015] Optionally, in the method described above, determining the associated device node corresponding to the target device node from the network information topology map includes:

[0016] The network information topology graph is analyzed by using the graph reachability algorithm to obtain the indirect influence subgraph corresponding to the target device node; the indirect influence subgraph is used to describe the association relationship between the target device node and the associated device nodes;

[0017] According to the indirect impact subgraph, the associated device nodes that have an associated relationship with the target device node are determined, thereby improving the accuracy of the determination of the associated device nodes.

[0018] Optionally, in the method described above, the associated device node includes a first associated device node and a second associated device node, the association relationship between the first associated device node and the target device node is stronger than the association relationship between the second associated device node and the target device node, and the target importance is determined according to the importance of the target device node and the importance of the associated device node, including:

[0019] According to the device classification information of the target device node corresponding to the address information queried from the configuration management information base, the importance of the target device node is determined in the device classification mapping library; the device classification information corresponding to different device nodes is stored in the configuration management information base, and the importance of different device classifications is stored in the device classification mapping library;

[0020] Based on the device classification information corresponding to the first associated device node, determining the importance corresponding to the first associated device node in the device classification mapping library;

[0021] Based on the device classification information corresponding to the second associated device node, determining the importance corresponding to the second associated device node in the device classification mapping library;

[0022] According to the importance corresponding to the target device node, the importance corresponding to the first associated device node and the importance corresponding to the second associated device node, the target importance corresponding to the target device node is calculated, and the importance of the target device node and its associated device nodes is more accurately evaluated, thereby improving the accuracy of alarm event sorting.

[0023] Optionally, the method described above, determining the severity and confidence level corresponding to the alarm event according to the alarm event, includes:

[0024] Determine the severity of the alarm event based on the severity level of the alarm type in the alarm event, the execution information and the disposal information in the alarm event;

[0025] The confidence of the alarm event is determined based on the initial alarm confidence, the dependent vulnerability information in the alarm event, and the port information in the alarm event, so that the severity and confidence of the alarm event can be evaluated more comprehensively and accurately, thereby improving the accuracy and reliability of the alarm event sorting results.

[0026] Optionally, the method described above, determining the severity of the alarm event according to the severity level of the alarm type in the alarm event, the execution information and the handling information in the alarm event, includes:

[0027] According to the severity level of the alarm type, a basic value corresponding to the severity level of the alarm is determined from the alarm classification and grading information base; the alarm classification and grading information base stores the severity levels and corresponding basic values ​​corresponding to different alarm types;

[0028] Determine the alarm severity value of the alarm event according to the execution information; the execution information is used to indicate whether the alarm event has been successfully executed;

[0029] Determine the alarm impact value of the alarm event according to the disposal information; the disposal information is used to indicate whether the alarm event has been disposed of;

[0030] The basic value, the alarm severity value, and the alarm impact value are multiplied to obtain the severity of the alarm event, thereby improving the accuracy of the assessment of the alarm severity.

[0031] Optionally, the method described above, determining the confidence of the alarm event according to the initial alarm confidence in the alarm event, the dependency vulnerability information in the alarm event, and the port information in the alarm event, includes:

[0032] When it is determined that there is an associated alarm within the preset time range corresponding to the alarm event, a confidence enhancement coefficient corresponding to the alarm event is determined;

[0033] According to the vulnerability information that the alarm event depends on and the port information corresponding to the alarm event, the confidence confirmation coefficient corresponding to the alarm event is determined;

[0034] The initial alarm confidence, the confidence enhancement coefficient and the confidence confirmation coefficient are multiplied to obtain the confidence of the alarm event, thereby improving the accuracy of the confidence.

[0035] Optionally, the method described above determines the ranking value corresponding to the alarm event by weighted calculation of the target importance, severity and confidence, and sorts the alarm events according to the ranking value, including:

[0036] Normalize the target importance, severity and confidence respectively to obtain importance score, severity score and confidence score respectively;

[0037] Multiply the importance score, severity score and confidence score to obtain the ranking value corresponding to the alarm event;

[0038] Alarm events are sorted according to their corresponding sorting values, taking into account multiple dimensions of alarm events, so as to more accurately assess the importance of the alarm events and improve the accuracy of alarm event priority sorting.

[0039] In a second aspect, the present application provides a device for sorting alarm events, comprising:

[0040] The device node determination module is used to determine the target device node and the associated device node corresponding to the alarm event according to the address information in the acquired alarm event; the associated device node is the device node that has an associated relationship with the target device node;

[0041] The importance determination module is used to determine the target importance according to the importance of the target device node and the importance of the associated device nodes;

[0042] The alarm severity and confidence determination module is used to determine the severity and confidence of the alarm event according to the alarm event;

[0043] The priority determination module is used to determine the ranking value corresponding to the alarm event by performing weighted calculation on the target importance, severity and confidence, and to sort the alarm events according to the ranking value.

[0044] In a third aspect, the present application provides an electronic device, the device comprising: a processor, and a memory communicatively connected to the processor;

[0045] Memory stores computer-executable instructions;

[0046] The processor executes the computer-executable instructions stored in the memory to implement the method for sorting alarm events described in any one of the above embodiments.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method for sorting alarm events described in any of the above embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0049] Figure 1 A flowchart of an embodiment of a method for sorting alarm events provided in an embodiment of the present application;

[0050] Figure 2A A flowchart of another embodiment of a method for sorting alarm events provided in an embodiment of the present application;

[0051] Figure 2B This is an example of an indirect impact subgraph corresponding to the target device node in this embodiment;

[0052] Figure 3 A flowchart of another embodiment of a method for sorting alarm events provided in an embodiment of the present application;

[0053] Figure 4A A flowchart of another embodiment of a method for sorting alarm events provided in an embodiment of the present application;

[0054] Figure 4BA flowchart of another embodiment of a method for sorting alarm events provided in an embodiment of the present application;

[0055] Figure 5 A flowchart of another embodiment of a method for sorting alarm events provided in an embodiment of the present application;

[0056] Figure 6 A schematic diagram of the structure of an embodiment of a device for sorting alarm events provided by the present application;

[0057] Figure 7 A schematic structural diagram of an embodiment of an electronic device provided in the present application. DETAILED DESCRIPTION

[0058] As described above, current network attacks are becoming increasingly frequent and complex, and security devices generate massive security alerts every day, which poses a huge challenge to security operators.

[0059] After research, the inventors proposed a method, device, equipment and storage medium for sorting alarm events to solve the technical problem that the prior art only sorts the priorities of alarm events by event type, which does not meet the actual operation requirements and leads to low efficiency in processing alarm events.

[0060] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0061] See also Figure 1 , which is a flow chart of an embodiment of a method for sorting alarm events provided by an embodiment of the present application. Figure 1 As shown, the method includes:

[0062] S101: Determine a target device node and associated device nodes corresponding to the alarm event according to address information in the acquired alarm event.

[0063] The associated device node is a device node that has an associated relationship with the target device node.

[0064] In this embodiment, the address information in the acquired alarm event is extracted, and the address information is the location information of the target device node, such as the destination IP or MAC address. For example, the target device node is S. The specific information of the target device node S is queried from the Configuration Management Database (CMDB). For example, the target device node S is a common server, terminal, or database. Then, by calculating the connection relationship of each device node in the asset network connectivity topology diagram, the associated device node corresponding to the target device node S is determined, such as associated device node A, associated device node B, associated device node C, ..., associated device node F.

[0065] S102: Determine the target importance according to the importance of the target device node and the importance of the associated device nodes.

[0066] In this embodiment, the importance of the target device node S is determined in the device classification mapping library based on the device classification information of the target device node S corresponding to the address information queried from the CMDB. The importance of the first associated device node is determined in the device classification mapping library based on the device classification information corresponding to the first associated device node. The importance of the second associated device node is determined in the device classification mapping library based on the device classification information corresponding to the second associated device node. The target importance of the target device node is calculated based on the importance of the target device node, the importance of the first associated device node, and the importance of the second associated device node.

[0067] S103: Determine the severity and confidence level of the alarm event according to the alarm event.

[0068] In this embodiment, according to the alarm type and severity level of the alarm event, the basic value corresponding to the severity level of the alarm event is determined from the alarm classification and grading information library; then, the execution information and disposal information of the alarm event are respectively assigned values, and the corresponding alarm severity value and alarm impact value are obtained. The obtained alarm severity value and alarm impact value are multiplied with the basic value for fusion to determine the severity corresponding to the alarm event. Then, according to the initial alarm confidence in the alarm event, the vulnerability information on which the alarm event depends, and the port information corresponding to the alarm event, a judgment and assignment are made, and then calculation is performed based on the assigned values ​​to determine the confidence of the alarm event.

[0069] S104: Determine the ranking value corresponding to the alarm event by performing weighted calculation on the target importance, severity and confidence, and sort the alarm events according to the ranking value.

[0070] In this embodiment, the target importance, severity and confidence are normalized respectively to obtain an importance score, a severity score and a confidence score, and the importance score, the severity score and the confidence score are multiplied to obtain a ranking value corresponding to the alarm event; the alarm events are then sorted according to the obtained ranking value.

[0071] In this embodiment, the target device node and the associated device node corresponding to the alarm event are determined based on the address information in the acquired alarm event. Then, the target importance is determined based on the importance of the target device node and the importance of the associated device node. The network location of the target device node and the contextual connectivity in actual operation are taken into consideration, thereby improving the accuracy of the importance assessment dimension assignment. Then, the severity and confidence corresponding to the alarm event are determined based on the alarm event. The actual handling of the alarm event and the possibility of the alarm event actually occurring are taken into consideration, thereby improving the accuracy of the alarm event impact dimension and possibility dimension assignment. Finally, by weighted calculation of the target importance, severity, and confidence, the ranking value corresponding to the alarm event is determined, and the alarm event is sorted according to the ranking value, thereby achieving a ranking of the alarm event priority that is more in line with actual operation requirements, thereby improving the processing efficiency of the alarm event.

[0072] See also Figure 2A , which is a flow chart of another embodiment of a method for sorting alarm events provided by an embodiment of the present application. Figure 2A As shown, based on the above embodiment, a specific implementation of "determining the target device node and the associated device node corresponding to the alarm event according to the address information in the acquired alarm event" in S101 includes:

[0073] S1011: Determine the target device node corresponding to the alarm event according to the address information.

[0074] In this embodiment, positioning is performed according to the address information of the alarm event in the alarm event, and the target device node corresponding to the alarm event is determined and recorded as S.

[0075] S1012: Determine an associated device node corresponding to the target device node from the network information topology map.

[0076] The network information topology diagram is a connectivity diagram between different device nodes; the associated device node is a downstream node of the target device node.

[0077] In this embodiment, a graph reachability algorithm is used to analyze the network position of the target device node in the network information topology graph and its contextual connectivity, so as to determine the indirect influence subgraph corresponding to the target device node, and to determine the associated device nodes that have an associated relationship with the target device node based on the indirect influence subgraph.

[0078] In this embodiment, the target device node corresponding to the alarm event is determined based on the address information, so that the occurrence point of the alarm event can be quickly determined; then the associated device node corresponding to the target device node is determined from the network information topology map, and by accurately identifying the associated device nodes associated with the target device node, the importance of the target device node in the actual operation process can be further analyzed, thereby improving the accuracy of the alarm event sorting.

[0079] Further, based on the above embodiment, a specific implementation of "determining the associated device node corresponding to the target device node from the network information topology map" in S1012 includes:

[0080] The graph reachability algorithm is used to analyze the network information topology graph and obtain the indirect impact subgraph corresponding to the target device node.

[0081] The indirect impact subgraph is used to describe the association relationship between the target device node and the associated device node.

[0082] In this embodiment, based on the graph reachability algorithm, such as the Floyd-Warshall algorithm, the Thorup algorithm, and the Kameda algorithm, etc. Taking the Floyd-Warshall algorithm as an example, with the target device node as the center, according to the relationship of each device node in the network information topology graph, the graph reachability algorithm is applied to find all nodes that can be reached from the target device node and extract these nodes and the connection relationship between them to form an indirect influence subgraph.

[0083] According to the indirect impact subgraph, the associated device nodes that have an associated relationship with the target device node are determined.

[0084] In this embodiment, if Figure 2B As shown, according to the obtained indirect influence subgraph, it is determined that the associated device nodes reachable through 1 hop with the target device node S as the center are associated device node A, associated device node B and associated device node C; the associated device nodes reachable through 2 hops are associated device node D, associated device node E, associated device node F and associated device node G.

[0085] In this embodiment, the network information topology graph is analyzed by using the graph reachability algorithm to obtain the indirect influence subgraph corresponding to the target device node, which clearly shows the location of the target device node in the network and its association with other nodes. Then, based on the indirect influence subgraph, the device node that has an association relationship with the target device node is determined, thereby improving the accuracy of determining the associated device node.

[0086] See also Figure 3 , which is a flow chart of another embodiment of a method for sorting alarm events provided by an embodiment of the present application. Figure 3 As shown, based on the above embodiment, the associated device node includes a first associated device node and a second associated device node, and the association relationship between the first associated device node and the target device node is stronger than the association relationship between the second associated device node and the target device node. A specific implementation of "determining the target importance according to the importance of the target device node and the importance of the associated device node" in S102 includes:

[0087] S1021: Determine the importance of the target device node in the device classification mapping library according to the device classification information of the target device node corresponding to the address information queried from the configuration management information library.

[0088] The configuration management information library stores the device classification information corresponding to different device nodes, and the device classification mapping library stores the importance levels corresponding to different device classifications.

[0089] In this embodiment, based on the device classification information of the target device node preset in the configuration management information library, the importance corresponding to the target device node S is determined in the device classification mapping library and recorded as Vs.

[0090] S1022: Based on the device classification information corresponding to the first associated device node, determine the importance corresponding to the first associated device node in the device classification mapping library.

[0091] In this embodiment, the first associated device node is an associated device node reachable by one hop, and if the target device node S is compromised, the first associated device node will be further affected. For example, the first associated device node includes associated device node A, associated device node B, and associated device node C. Based on the device classification corresponding to the first associated device node, the importance Va corresponding to the associated device node A, the importance Vb corresponding to the associated device node B, and the importance Vc corresponding to the associated device node C are determined from the device classification mapping library.

[0092] S1023: Based on the device classification information corresponding to the second associated device node, determine the importance corresponding to the second associated device node in the device classification mapping library.

[0093] In this embodiment, the second associated device node is an associated device node that can be reached in 2 hops. If the second associated device node is compromised, it will further affect the second associated device node. For example, the second associated device nodes include associated device node D, associated device node E, associated device node F, and associated device node G. Based on the device classification corresponding to the second associated device node, the importance levels Vd corresponding to associated device node D, Ve corresponding to associated device node E, Vf corresponding to associated device node F, and Vg corresponding to associated device node G are determined from the device classification mapping library.

[0094] S1024: Calculate the target importance level corresponding to the target device node based on the importance level corresponding to the target device node, the importance level corresponding to the first associated device node, and the importance level corresponding to the second associated device node.

[0095] In this embodiment, for example, the indirect influence attenuation factor for 1 hop is set to k (0 < k < 1), and the indirect influence attenuation factor for 2 hops is k 2 . Based on the importance level corresponding to the first associated device node, the indirectly affected degrees of the first associated device nodes are calculated as Va / k, Vb / k, and Vc / k respectively. Based on the importance level corresponding to the second associated device node, the indirectly affected degrees of the second associated device nodes are calculated as Vd / k 2 , Ve / k 2 , Vf / k 2 , Vg / k 2 .

[0096] Therefore, the target importance level of the target device node S is expressed as:

[0097]

[0098] Or,

[0099]

[0100] Where, is the associated device node that can be reached in 1 hop in the indirect influence subgraph G corresponding to the target device node S; is the associated device node that can be reached in 2 hops in the indirect influence subgraph G corresponding to the target device node S.

[0101] In this embodiment, the importance of the target device node is determined in the device classification mapping library based on the device classification information of the target device node corresponding to the address information queried from the configuration management information library; the importance of the first associated device node is determined in the device classification mapping library based on the device classification information corresponding to the first associated device node; the importance of the second associated device node is determined in the device classification mapping library based on the device classification information corresponding to the second associated device node; the target importance of the target device node is calculated based on the importance of the target device node, the importance of the first associated device node, and the importance of the second associated device node, so as to more accurately evaluate the importance of the target device node and its associated device nodes, thereby improving the accuracy of alarm event sorting.

[0102] See also Figure 4A , which is a flow chart of another embodiment of a method for sorting alarm events provided by an embodiment of the present application. Figure 4A As shown, based on the above embodiment, a specific implementation of "determining the severity and confidence level corresponding to the alarm event according to the alarm event" in S103 includes:

[0103] S1031: Determine the severity of the alarm event according to the severity level of the alarm type in the alarm event, the execution information and the handling information in the alarm event.

[0104] In this embodiment, according to the alarm type and severity level of the alarm event, the basic value corresponding to the severity level of the alarm event is determined from the alarm classification and grading information library. For example, if the alarm event is an attack using the configuration defects of the information system through the network or other technical means, then the execution information of the alarm event at this time is that the severity of the successful attack is higher than the severity of the unsuccessful attack, and then the actual alarm severity value of the alarm event is determined. Then, according to the disposal information of the alarm event, if the attack path of the alarm event has been eliminated or cut off, then the alarm impact of the alarm event at this time is lower than the alarm impact of the attack path of the alarm event, and then the actual alarm impact value of the alarm event is determined. Then, the obtained basic value, alarm severity value and alarm impact value are combined to further calculate the severity of the alarm event.

[0105] S1032: Determine the confidence of the alarm event according to the initial alarm confidence in the alarm event, the dependency vulnerability information in the alarm event, and the port information in the alarm event.

[0106] In this embodiment, if the alarm event has an associated alarm within a certain time range, the confidence enhancement coefficient corresponding to the alarm event is determined based on the associated alarm information. Then, the confidence confirmation coefficient corresponding to the alarm event is determined based on the vulnerability information on which the alarm event depends and the port information corresponding to the alarm event. The initial alarm confidence, confidence enhancement coefficient, and confidence confirmation coefficient are multiplied to obtain the confidence of the alarm event.

[0107] In this embodiment, the severity of the alarm event is determined based on the alarm type and severity level, execution information and disposal information in the alarm event; the confidence of the alarm event is determined based on the initial alarm confidence in the alarm event, the vulnerability information on which the alarm event depends, and the port information corresponding to the alarm event, so that the severity and confidence of the alarm event can be evaluated more comprehensively and accurately, thereby improving the accuracy and reliability of the alarm event sorting results.

[0108] Further, based on the above embodiment, a specific implementation of "determining the severity of the alarm event according to the severity level of the alarm type in the alarm event, the execution information and the handling information in the alarm event" in S1031 includes:

[0109] According to the severity level of the alarm type, a basic value corresponding to the severity level of the alarm is determined from the alarm classification and grading information library.

[0110] Among them, the alarm classification and grading information library stores the severity levels and corresponding basic values ​​corresponding to different alarm types.

[0111] In this embodiment, for example, based on the alarm type and severity level information in the alarm event, a basic value of the severity of the current alarm event is determined from the alarm classification and grading information library and is recorded as C.

[0112] An alarm severity value of the alarm event is determined based on the execution information.

[0113] The execution information is used to indicate whether the alarm event has been successfully executed.

[0114] In this embodiment, whether the alarm event is successfully executed is determined by the execution success information in the alarm event, and the alarm severity value is recorded as M. If the alarm event is successfully executed, the alarm severity value M=1; if the alarm event is not successfully executed, the alarm severity value M=0.

[0115] If the alarm event does not contain information on whether the execution is successful, the judgment can be made based on the cross-correlation of contextual conditions such as the vulnerability and port that the alarm event depends on. If the vulnerability or port conditions required by the alarm event are met, M = 1; if the vulnerability or port conditions required by the alarm event are not met, M = 0.

[0116] The alarm impact value of the alarm event is determined based on the handling information.

[0117] The handling information is used to indicate whether the alarm event has been handled.

[0118] In this embodiment, whether the alarm event has been handled is determined by the information of whether the alarm event has been handled, which is recorded as P. If the alarm event has been handled, P=0. If the alarm event has not been handled, it is obtained whether the same alarm in the same security firewall within the preset time range has been handled. If it has been handled, the alarm impact value P of the alarm event is 0; if it has not been handled, the alarm impact value P of the alarm event is 1.

[0119] The base value, the alarm severity value, and the alarm impact value are multiplied to obtain the severity of the alarm event.

[0120] In this embodiment, a multiplication operation is performed according to the base value C, the alarm severity value M, and the alarm impact value P to obtain the severity of the alarm event, which is expressed as C×M×P.

[0121] In this embodiment, according to the alarm type and severity level, a basic value corresponding to the alarm severity level is determined from the alarm classification and grading information library; the alarm severity value of the alarm event is determined according to the execution information; the alarm impact value of the alarm event is determined according to the handling information; the basic value, the alarm severity value and the alarm impact value are multiplied to obtain the severity of the alarm event, thereby improving the accuracy of the alarm severity assessment.

[0122] See also Figure 4B , which is a flow chart of another embodiment of a method for sorting alarm events provided by an embodiment of the present application. Figure 4B As shown, based on the above embodiment, a specific implementation of "determining the confidence of the alarm event according to the initial alarm confidence in the alarm event, the dependent vulnerability information in the alarm event, and the port information in the alarm event" in S1032 includes:

[0123] S10321: When it is determined that there is an associated alarm within a preset time range corresponding to the alarm event, a confidence enhancement coefficient corresponding to the alarm event is determined.

[0124] In this embodiment, for example, when it is determined that there is an associated alarm within the preset time range of 30 minutes corresponding to the alarm event, the confidence enhancement coefficient corresponding to the alarm event is determined. Among them, associated alarms can include alarm events of the same alarm type, alarm events of different alarm types but confirmed by the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) to belong to the previous and subsequent attack stages, and the same alarm events under the same security firewall.

[0125] Specifically, for example, based on the alarm time point of the current alarm event, if the same alarm occurs X times within 30 minutes in the same security firewall, it is confirmed as alarm enhancement, and the confidence enhancement coefficient is

[0126] Taking the alarm time point of the current alarm event as the benchmark, if the same alarm type alarm event occurs X times in the same security firewall or different security firewalls within 30 minutes, then due to the large difference and the basic cross-correlation effect, it is confirmed as alarm enhancement. The confidence enhancement coefficient at this time is

[0127] Taking the alarm time point of the current alarm event as the benchmark, if the same type of alarm events confirmed by ATT&CK to belong to the sequential attack stage occur X times within 30 minutes in the same security firewall or different security firewalls, it is confirmed as alarm enhancement because of the greater difference and stronger cross-correlation effect. The confidence enhancement coefficient at this time is

[0128] It is understandable that the exponential value of the confidence enhancement coefficient in this embodiment is exemplary. Less than and Less than Under the condition of , any index value can be taken.

[0129] S10322: Determine a confidence confirmation coefficient corresponding to the alarm event based on the vulnerability information on which the alarm event depends and the port information corresponding to the alarm event.

[0130] In this embodiment, for example, based on the vulnerability information on which the alarm event depends and the port information corresponding to the alarm event, a confidence confirmation coefficient corresponding to the alarm event is determined and recorded as θ.

[0131] Specifically, if the vulnerability corresponding to the alarm event is determined to exist according to the vulnerability information on which the alarm event depends, the confirmation coefficient θ is 1; if the vulnerability corresponding to the alarm event does not exist, the confirmation coefficient θ is 0. If the port conditions required for the occurrence of the alarm event are determined to exist according to the port information corresponding to the alarm event, the confirmation coefficient θ is 1; if the port conditions required for the occurrence of the alarm event do not exist, the confirmation coefficient θ is 0.

[0132] S10323: Multiply the initial alarm confidence, the confidence enhancement coefficient, and the confidence confirmation coefficient to obtain the confidence of the alarm event.

[0133] In this embodiment, for example, the initial alarm confidence in the alarm event is α; if there is no alarm confidence in the alarm event, the initial alarm confidence of the alarm event is set to α=1. Therefore, the confidence of the alarm event is

[0134] In this embodiment, when it is determined that there is an associated alarm within the preset time range corresponding to the alarm event, the confidence enhancement coefficient corresponding to the alarm event is determined; based on the vulnerability information on which the alarm event depends and the port information corresponding to the alarm event, the confidence confirmation coefficient corresponding to the alarm event is determined; the initial alarm confidence, the confidence enhancement coefficient and the confidence confirmation coefficient are multiplied to obtain the confidence of the alarm event, thereby improving the accuracy of the alarm confidence.

[0135] See also Figure 5 , which is a flow chart of another embodiment of a method for sorting alarm events provided by an embodiment of the present application. Figure 5 As shown, based on the above embodiment, a specific implementation method of "determining the ranking value corresponding to the alarm event by weighted calculation of the target importance, severity and confidence, and sorting the alarm event according to the ranking value" in S104 includes:

[0136] S1041: Normalize the target importance, severity and confidence respectively to obtain an importance score, a severity score and a confidence score respectively.

[0137] In this embodiment, for example, the target importance Severity C×M×P, confidence Perform z-score normalization calculations respectively. Specifically, the calculation formula for the importance score is as follows:

[0138]

[0139] in, is the statistical mean corresponding to the importance of the target; is the statistical standard deviation corresponding to the target importance.

[0140] Similarly, the calculation formula for the severity score is as follows:

[0141]

[0142] Among them, μ(C×M×P) is the statistical mean corresponding to the severity; σ(C×M×P) is the statistical standard deviation corresponding to the severity.

[0143] The confidence score is calculated as follows:

[0144]

[0145] in, is the statistical mean corresponding to the confidence level; is the statistical standard deviation corresponding to the confidence level.

[0146] S1042: Multiply the importance score, the severity score, and the confidence score to obtain a ranking value corresponding to the alarm event.

[0147] In this embodiment, the importance score Severity score |C×M×P| and confidence score Perform multiplication to obtain the ranking value Score corresponding to the alarm event. The ranking value Score is expressed as follows:

[0148]

[0149] S1043: Sort the alarm events according to the sorting values ​​corresponding to the alarm events.

[0150] In this embodiment, all alarm events are sorted according to the sorting value corresponding to each alarm event.

[0151] In this embodiment, the target importance, severity and confidence are normalized to obtain an importance score, a severity score and a confidence score respectively; the importance score, the severity score and the confidence score are multiplied to obtain a ranking value corresponding to the alarm event; the alarm events are sorted according to the ranking values ​​corresponding to the alarm events, and multiple dimensions of the alarm events are comprehensively considered, so as to more accurately evaluate the importance of the alarm events and improve the accuracy of the alarm event priority sorting.

[0152] See also Figure 6 , which is a schematic diagram of the structure of an embodiment of a device for sorting alarm events provided by the present application. Figure 6 As shown in the solid line frame, the apparatus 60 includes: a device node determination module 61 , an importance determination module 62 , an alarm severity and confidence determination module 63 , and a priority determination module 64 .

[0153] The device node determination module 61 is used to determine the target device node and the associated device node corresponding to the alarm event according to the address information in the acquired alarm event; the associated device node is a device node that has an associated relationship with the target device node;

[0154] The importance determination module 62 is used to determine the target importance according to the importance of the target device node and the importance of the associated device nodes;

[0155] The alarm severity and confidence determination module 63 is used to determine the severity and confidence corresponding to the alarm event according to the alarm event;

[0156] The priority determination module 64 is used to determine the ranking value corresponding to the alarm event by performing weighted calculation on the target importance, severity and confidence, and to sort the alarm events according to the ranking value.

[0157] An alarm event sorting device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0158] Further, based on the above embodiments, the device node determination module 61 is specifically used to determine the target device node corresponding to the alarm event based on the address information; determine the associated device node corresponding to the target device node from the network information topology map; the network information topology map is a connectivity map between different device nodes; the associated device node is the downstream node of the target device node.

[0159] An alarm event sorting device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0160] Further, based on the above embodiments, the device node determination module 61 is specifically used to analyze the network information topology graph using a graph reachability algorithm to obtain an indirect impact subgraph corresponding to the target device node; the indirect impact subgraph is used to describe the relationship between the target device node and the associated device node; based on the indirect impact subgraph, determine the device asset node that has an associated relationship with the target device node.

[0161] An alarm event sorting device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0162] Further, on the basis of the above embodiment, the associated device node includes a first associated device node and a second associated device node, and the association relationship between the first associated device node and the target device node is stronger than the association relationship between the second associated device node and the target device node. The importance determination module 62 is specifically used to determine the importance corresponding to the target device node in the device classification mapping library according to the device classification information of the target device node corresponding to the address information queried from the configuration management information library; the configuration management information library stores the device classification information corresponding to different device nodes, and the device classification mapping library stores the importance corresponding to different device classifications; based on the device classification information corresponding to the first associated device node, the importance corresponding to the first associated device node is determined in the device classification mapping library; based on the device classification information corresponding to the second associated device node, the importance corresponding to the second associated device node is determined in the device classification mapping library; according to the importance corresponding to the target device node, the importance corresponding to the first associated device node and the importance corresponding to the second associated device node, the target importance corresponding to the target device node is calculated.

[0163] An alarm event sorting device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0164] Further, based on the above embodiments, the alarm severity and confidence determination module 63 is specifically used to determine the severity of the alarm event according to the severity level of the alarm type in the alarm event, the execution information and the disposal information in the alarm event; and to determine the confidence of the alarm event according to the initial alarm confidence in the alarm event, the dependency vulnerability information in the alarm event and the port information in the alarm event.

[0165] An alarm event sorting device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0166] Further, based on the above embodiment, Figure 6 As shown in the dashed box, the alarm severity and confidence determination module 63 may include an alarm severity determination submodule 631 and a confidence determination submodule 632 .

[0167] The alarm severity determination submodule 631 is specifically used to determine the basic value corresponding to the alarm severity level from the alarm classification and grading information library according to the alarm type and severity level; the alarm classification and grading information library stores the severity levels and corresponding basic values ​​corresponding to different alarm types; the alarm severity value of the alarm event is determined according to the execution information; the execution information is used to express whether the alarm event has been successfully executed; the alarm impact value of the alarm event is determined according to the disposal information; the disposal information is used to express whether the alarm event has been disposed of; the basic value, the alarm severity value and the alarm impact value are multiplied to obtain the severity of the alarm event.

[0168] The confidence determination submodule 632 is used to determine the confidence enhancement coefficient corresponding to the alarm event when it is determined that there is an associated alarm within the preset time range corresponding to the alarm event; determine the confidence confirmation coefficient corresponding to the alarm event based on the vulnerability information on which the alarm event depends and the port information corresponding to the alarm event; multiply the initial alarm confidence, the confidence enhancement coefficient and the confidence confirmation coefficient to obtain the confidence of the alarm event.

[0169] An alarm event sorting device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0170] Further, based on the above embodiments, the priority determination module 64 is specifically used to normalize the target importance, severity and confidence respectively to obtain the importance score, severity score and confidence score respectively; multiply the importance score, severity score and confidence score to obtain the ranking value corresponding to the alarm event; and sort the alarm events according to the ranking values ​​corresponding to the alarm events.

[0171] An alarm event sorting device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0172] See also Figure 7 , which is a schematic diagram of the structure of an embodiment of an electronic device provided by the present application. The electronic device 70 may include: a processor 71 and a memory 72.

[0173] The processor 71 is in communication with the memory 72 , and the memory 72 is used to store computer-executable instructions. The processor 71 is configured to execute the technical solution in any of the aforementioned method embodiments by executing the computer-executable instructions stored in the memory 72 .

[0174] Optionally, the memory 72 may be independent or integrated with the processor 71. Optionally, when the memory 72 is a device independent of the processor 71, the electronic device 70 may further include: a bus for connecting the above devices.

[0175] The electronic device is used to execute the technical solution in any of the aforementioned method embodiments, and its implementation principle and technical effect are similar and will not be repeated here.

[0176] An embodiment of the present application also provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement the above method. The implementation principle and technical effect are similar and will not be repeated here.

[0177] It should be noted that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device embodiment described above is merely schematic, in which the unit described as a separate component may or may not be physically separated, and the component prompted as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0178] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for sorting alarm events, characterized in that: include: Determine the target device node and the associated device node corresponding to the alarm event according to the address information in the acquired alarm event; The associated device node is a device node that has an associated relationship with the target device node; Determining the target importance according to the importance of the target device node and the importance of the associated device node; Determine the severity and confidence level of the alarm event according to the alarm event; The ranking value corresponding to the alarm event is determined by performing weighted calculation on the target importance, the severity and the confidence, and the alarm event is ranked according to the ranking value.

2. The method according to claim 1, characterized in that The step of determining the target device node and the associated device node corresponding to the alarm event according to the address information in the acquired alarm event includes: Determine the target device node corresponding to the alarm event according to the address information; The associated device node corresponding to the target device node is determined from a network information topology diagram; the network information topology diagram is a connectivity diagram between different device nodes; and the associated device node is a downstream node of the target device node.

3. The method according to claim 2, characterized in that The determining the associated device node corresponding to the target device node from the network information topology map includes: The network information topology graph is analyzed by using a graph reachability algorithm to obtain an indirect influence subgraph corresponding to the target device node; the indirect influence subgraph is used to describe the association relationship between the target device node and the associated device node; The associated device node that has an association relationship with the target device node is determined according to the indirect impact subgraph.

4. The method according to claim 3, characterized in that The associated device node includes a first associated device node and a second associated device node, the association relationship between the first associated device node and the target device node is stronger than the association relationship between the second associated device node and the target device node, and the target importance is determined according to the importance of the target device node and the importance of the associated device node, including: According to the device classification information of the target device node corresponding to the address information queried from the configuration management information base, the importance corresponding to the target device node is determined in the device classification mapping library; the configuration management information base stores the device classification information corresponding to different device nodes, and the device classification mapping library stores the importance corresponding to different device classifications; Based on the device classification information corresponding to the first associated device node, determining the importance corresponding to the first associated device node in a device classification mapping library; Based on the device classification information corresponding to the second associated device node, determining the importance corresponding to the second associated device node in a device classification mapping library; The target importance corresponding to the target device node is calculated according to the importance corresponding to the target device node, the importance corresponding to the first associated device node, and the importance corresponding to the second associated device node.

5. The method according to claim 1, characterized in that Determining the severity and confidence level corresponding to the alarm event according to the alarm event includes: Determine the severity of the alarm event according to the severity level of the alarm type in the alarm event, the execution information and the disposal information in the alarm event; The confidence of the alarm event is determined according to the initial alarm confidence in the alarm event, the dependency vulnerability information in the alarm event, and the port information in the alarm event.

6. The method according to claim 5, characterized in that Determining the severity of the alarm event according to the severity level of the alarm type in the alarm event, the execution information and the handling information in the alarm event includes: According to the severity level of the alarm type, determining the basic value corresponding to the severity level of the alarm from an alarm classification and grading information library; the alarm classification and grading information library stores the severity levels and corresponding basic values ​​corresponding to different alarm types; Determining the alarm severity value of the alarm event according to the execution information; the execution information is used to indicate whether the alarm event has been successfully executed; Determine the alarm impact value of the alarm event according to the handling information; the handling information is used to indicate whether the alarm event has been handled; The base value, the alarm severity value, and the alarm impact value are multiplied to obtain the severity of the alarm event.

7. The method according to claim 5, characterized in that Determining the confidence of the alarm event according to the initial alarm confidence in the alarm event, the dependency vulnerability information in the alarm event, and the port information in the alarm event includes: When it is determined that there is an associated alarm within the preset time range corresponding to the alarm event, determining a confidence enhancement coefficient corresponding to the alarm event; Determine a confidence confirmation coefficient corresponding to the alarm event according to the vulnerability information on which the alarm event depends and the port information corresponding to the alarm event; The initial alarm confidence, the confidence enhancement coefficient and the confidence confirmation coefficient are multiplied to obtain the confidence of the alarm event.

8. The method according to any one of claims 1 to 7, characterized in that: The step of performing weighted calculation on the target importance, the severity and the confidence to determine a ranking value corresponding to the alarm event, and ranking the alarm event according to the ranking value includes: Normalizing the target importance, severity and confidence respectively to obtain importance score, severity score and confidence score respectively; Multiplying the importance score, the severity score, and the confidence score to obtain a ranking value corresponding to the alarm event; The alarm events are sorted according to the sorting values ​​corresponding to the alarm events.

9. A device for sorting alarm events, characterized in that: include: A device node determination module, used to determine the target device node and associated device nodes corresponding to the alarm event according to the address information in the acquired alarm event; The associated device node is a device node that has an associated relationship with the target device node; An importance determination module, used to determine the target importance according to the importance of the target device node and the importance of the associated device node; An alarm severity and confidence determination module, used to determine the severity and confidence corresponding to the alarm event according to the alarm event; The priority determination module is used to determine the ranking value corresponding to the alarm event by performing weighted calculation on the target importance, the severity and the confidence, and to sort the alarm event according to the ranking value.

10. An electronic device, characterized in that: The device comprises: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 8 when executed by a processor.

Images