Security event alarm processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a security event alarm processing method and device, electronic equipment and a storage medium. The method comprises the following steps: determining a plurality of network equipment groups based on the equipment type of each piece of network equipment in a target network and the logic distance between each piece of network equipment and the same core switch; generating an alarm network model of the target network by taking each network equipment group as a network node; determining an attack device group corresponding to the security event alarm of the target network based on the alarm network model, wherein the attack device group is a network device group on an attack path corresponding to the security event alarm; and generating disposal prompt information of the security event alarm based on the attack device group. According to the embodiment of the invention, on the premise that management personnel are not required to have comprehensive network security knowledge, the efficiency of handling security event alarms can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security incident alarm handling method, device, electronic equipment and storage medium. Background Art

[0002] In all walks of life, including power systems, with the continuous expansion of the scale of Internet applications and the increasing network data traffic, network security incident alarms are also increasing. In order to maintain network security and ensure the normal operation of the network, it is very important to correctly and efficiently handle network security incident alarms. The alarm handling method of security incidents in the prior art requires managers to have comprehensive network security knowledge, including network security knowledge related to network equipment of different types and uses, and the handling method in the prior art has low handling efficiency. Summary of the invention

[0003] The embodiments of the present invention provide a security incident alarm handling method, device, electronic device and storage medium, which can improve the efficiency of handling security incident alarms without requiring management personnel to have comprehensive network security knowledge.

[0004] In a first aspect, an embodiment of the present invention provides a security incident alarm handling method, comprising:

[0005] Determine multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch;

[0006] Generating an alarm network model of the target network with each network device group as a network node;

[0007] Determine, based on the alarm network model, an attack device group corresponding to the security event alarm of the target network, the attack device group being the network device group on the attack path corresponding to the security event alarm; and

[0008] The security event alert is handled based on the attack path.

[0009] In a second aspect, an embodiment of the present invention provides a security event alarm handling device, including:

[0010] A network device group acquisition module, used to determine multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch;

[0011] An alarm network model acquisition module is used to generate an alarm network model of the target network with each network device group as a network node;

[0012] an attack path acquisition module, configured to determine an attack device group corresponding to the security event alarm of the target network based on the alarm network model, wherein the attack device group is the network device group on the attack path corresponding to the security event alarm; and

[0013] A handling prompt acquisition module is used to handle the security event alarm based on the attack path.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a security incident alarm handling method as described in any one of the embodiments of the present invention is implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a security incident alarm handling method as described in any one of the embodiments of the present invention.

[0016] A security incident alarm handling method, device, electronic device and storage medium provided by an embodiment of the present invention can facilitate the classification of network devices of different types or different uses into different network device groups by determining a network device group based on the device type of each network device in the target network and the logical distance between each network device and the same core switch; the embodiment of the present invention further generates an alarm network model of the target network with each network device group as a network node, and determines an attack device group corresponding to the security incident alarm of the target network based on the alarm network model, and generates handling prompt information of the security incident alarm based on the attack device group, so as to prompt the management personnel to manually handle the security incident alarm based on the handling prompt information, which can facilitate prompting management personnel with different professional knowledge to handle security incident alarms related to the corresponding network devices in a concise and easy-to-understand manner, so that even if the management personnel do not have network security knowledge related to network devices of all types and uses, they can quickly determine the different handling strategies for network devices of different types or uses, thereby improving the efficiency of handling security incident alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is a flow chart of a security incident alarm handling method provided by an embodiment of the present invention;

[0019] Figure 2 is another flow chart of the security incident alarm handling method provided by an embodiment of the present invention;

[0020] Figure 3 is another flow chart of the security incident alarm handling method provided by an embodiment of the present invention;

[0021] Figure 4 It is a structural schematic diagram of a security incident alarm handling device provided by an embodiment of the present invention;

[0022] Figure 5 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] Figure 1 A flowchart of a security incident alarm handling method provided by an embodiment of the present invention is provided. This embodiment is applicable to a scenario where there are a large number of network devices in the target network. The method can be executed by a security incident alarm handling device provided by an embodiment of the present invention, and the device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated into an electronic device, such as a computer, a server, etc. The following embodiments will be described by taking the device integrated into an electronic device as an example. Reference Figure 1 , the method may specifically include the following steps:

[0026] Step 101, multiple network device groups are determined based on the device type of each network device in the target network and the logical distance between each network device and the same core switch. This step can help to classify network devices of different types or uses into different network device groups, and generate an alarm network model of the target network based on the network device groups.

[0027] It can be understood that whether the logical distances to the same core switch are the same can reflect whether the purposes of the various network devices are the same. Therefore, based on the device type of each network device and the logical distance of each network device to the same core switch, network devices of different types or purposes can be divided into different network device groups.

[0028] Specifically, the above-mentioned target network can be understood as an Internet network, for example, it can be an Internet network of a power system.

[0029] Specifically, the target network may include one functional area or multiple functional areas separated and determined by an isolation device.

[0030] Specifically, the device type of each network device and the logical distance between each network device and the same core switch may be acquired in advance or in real time before step 101 .

[0031] Specifically, the above-mentioned device types may include, for example, firewalls, servers, and office equipment.

[0032] Optionally, the process of determining multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch includes:

[0033] Group network devices of the same device type and at the same logical distance to the same core switch into the same network device group.

[0034] Step 102, generating an alarm network model of the target network with each network device group as a network node. This step can facilitate generating an alarm network model with network device groups as nodes. This step can facilitate determining the attack device group corresponding to the security event alarm based on the alarm network model.

[0035] Optionally, the process of each of the above-mentioned network device groups generating an alarm network model of the target network for the network node includes: determining the connection relationship between each network device group based on the connection relationship between each network device; using the standard legend of each network device group to represent the corresponding network device group, and connecting each standard legend based on the connection relationship between each network device group to obtain an alarm network; and adding the network address of the corresponding network device to each standard legend to obtain an alarm network model.

[0036] Specifically, the standard legends of the above-mentioned respective network device groups may be predefined.

[0037] Specifically, the network address of the network device may be an Internet Protocol Address (IP address) or a Media Access Control Address (MAC address).

[0038] Step 103, determining the attack device group corresponding to the security event alarm of the target network based on the alarm network model, the attack device group is the network device group on the attack path corresponding to the security event alarm, which can help generate concise and easy-to-understand handling prompt information based on the attack device group.

[0039] It can be understood that the attack device group is essentially a combined representation of multiple network devices of the same type and function. The information of the attack device group is obviously more concise and easy to understand than the information of the corresponding network devices, and is therefore conducive to generating concise and easy to understand handling prompt information.

[0040] Optionally, the process of determining the attack device group corresponding to the security event alarm of the target network based on the alarm network model includes: determining the attack device group based on the network address of the network device through which the data traffic of the security event alarm passes.

[0041] Specifically, since the network address of the corresponding network device is added to each attack device group in the alarm network model, the attack device group can be accurately and quickly determined according to the network address of the network device through which the data traffic of the security event alarm passes.

[0042] Step 104, generating handling prompt information of the security incident alarm based on the attack device group, so as to prompt the management personnel to manually handle the security incident alarm based on the handling prompt information. Based on steps 101 to 103, this step can help to prompt management personnel with different professional knowledge to handle security incident alarms related to corresponding network devices in a concise and easy-to-understand manner, so that even if the management personnel do not have network security knowledge related to all types and uses of network devices, they can quickly determine different handling strategies for network devices of different types or uses, thereby improving the efficiency of handling security incident alarms.

[0043] Optionally, the above process of generating handling prompt information of the security event alarm based on the attack device group includes: generating an alarm diagram that highlights the attack device group based on the attack device group and the alarm network model to obtain the handling prompt information.

[0044] Optionally, the process of generating an alarm graph highlighting the attack device group based on the attack device group and the alarm network model includes:

[0045] The above alarm network model is visualized to obtain an alarm network model diagram, the position of the attack device group in the alarm network model diagram is determined and the corresponding position is highlighted.

[0046] Specifically, the corresponding position can be highlighted by setting the position of the attack device group in the alarm network model diagram to be highlighted.

[0047] Specifically, by generating an alarm diagram that highlights the attack device group, the attack path corresponding to the security event alarm can be intuitively presented, allowing management personnel to correctly handle the security event alarm more conveniently and efficiently.

[0048] Specifically, highlighting the attack device group in the alarm network model diagram is obviously more concise and easy to understand than displaying the devices along the corresponding attack path in a diagram with each network device as a node.

[0049] Specifically, text-based handling prompt information including the type of the attacking device group and the location of the attacking device group in the target network may also be generated.

[0050] Optionally, the manual handling methods of the security incident alarms performed by the above-mentioned management personnel based on the handling prompt information may include: blocking the network functional area to which the attacking device group belongs through a corresponding isolation device, unblocking the blocked network functional area after risk assessment, and checking, disinfecting and patching vulnerabilities of each network device in the attacking device group.

[0051] The following further describes the security incident alarm handling method provided by the embodiment of the present invention. Figure 2 As shown, the following steps may be included:

[0052] Step 201: input the network topology map of the target network into a pre-trained device identification model.

[0053] Specifically, the device recognition model may be a convolutional neural network.

[0054] Step 202: Identify the device type of each network device in the network topology diagram and the network line connecting each network device through the device identification model.

[0055] Specifically, the type flag of each device type can be pre-defined by the administrator, for example, as follows: P(t,i){t,i=1, 2, 3..., n}, where t corresponds to the device type, such as core switch, firewall, server, office equipment, etc., and n is a natural number.

[0056] Specifically, the core switch may be identified as P(1, i), and other device types may be identified in sequence as P(t, i) {t=2, 3 ..., n, i=1, 2, 3 ..., n} according to predefined type flags.

[0057] Specifically, the above network line can be identified as L(k,i) (k,i=1, 2, 3..., n).

[0058] Step 203: Obtain the number of network lines between each network device and the core switch, and calculate the logical distance between the corresponding network device and the same core switch based on the number of network lines.

[0059] Optionally, the process of calculating the logical distance between the corresponding network device and the same core switch based on the number of network lines includes: calculating the logical distance between the corresponding network device and the same core switch based on a minimum spanning tree algorithm.

[0060] Step 204: Determine multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch.

[0061] Step 205: Generate an alarm network model of the target network with each network device group as a network node.

[0062] Step 206: Determine the attack device group corresponding to the security event alarm of the target network based on the alarm network model.

[0063] Step 207: Generate handling prompt information of the security event alarm based on the attack device group to prompt the management personnel to manually handle the security event alarm based on the handling prompt information.

[0064] The embodiment of the present invention utilizes a device identification model to identify the types of network devices and network lines in the target network, which can facilitate the subsequent determination of multiple network device groups based on the device type of each network device and the logical distance between each network device and the same core switch, and then classify network devices of different types and uses into different network device groups, and determine the attack device group from each network device group, so that people with corresponding professional knowledge can efficiently handle security incident alarms.

[0065] The following further describes the security incident alarm handling method provided by the embodiment of the present invention. The security incident alarm handling method provided by the embodiment of the present invention is as follows: Figure 3 The steps shown may include:

[0066] Step 301, based on the network isolation device in the target network, the target network is divided into multiple network function areas, so that the network isolation device isolates each network function area and determines the network function area to which each network device belongs.

[0067] Specifically, the above isolation device may include a firewall, a network switch and a core switch.

[0068] Specifically, the target network may not have multiple network function areas isolated by the isolation device, that is, it may include only one network function area.

[0069] Specifically, for the scenario where the target network is the power system network of a power plant, the target network can be divided into an industrial control area, a test area, a production area, and an external network area according to the isolation device. Specifically, the network functional area including the distributed control system, network control system, plant-level information monitoring system, and plant electrical appliance monitoring and management system can be determined as the industrial control area, the network functional area including the test server can be determined as the test area, and the network functional area including the production server can be determined as the production area.

[0070] Specifically, the administrator can predefine the area mark of each network functional area, for example, it can be positioned as N(t,i){t,i=1, 2, 3…, n}, where t corresponds to the area type, such as test area, production area, external network area and industrial control area, and i corresponds to the area number.

[0071] Optionally, after executing step 202 to obtain the device type of each network device, device information such as the network function area, network address and device person in charge can be added to each network device according to the ledger, so as to facilitate the subsequent determination of the device information of the corresponding device in the network device group and attack device group, and to facilitate the generation of corresponding disposal prompt information based on the device information of each network device in the attack device group.

[0072] Step 302: Determine multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch.

[0073] Optionally, the process of determining multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch includes:

[0074] Multiple network devices that belong to the same network functional area, have the same device type, and have the same logical distance to the same core switch are grouped into the same network device group.

[0075] In practical applications, multiple network devices with the same network functional area, the same device type and the same logical distance to the same core switch can be combined and represented by a type mark of the corresponding device type.

[0076] Step 303: Generate an alarm network model of the target network with each network device group as a network node.

[0077] Step 304: determine the attack device group corresponding to the security event alarm of the target network based on the alarm network model, where the attack device group is a network device group on the attack path corresponding to the security event alarm.

[0078] Step 305: Generate handling prompt information of the security event alarm based on the attack device group to prompt the management personnel to manually handle the security event alarm based on the handling prompt information.

[0079] Optionally, the process of generating handling prompt information of the security event alarm based on the attack device group includes: generating the handling prompt information based on the attack device group and the network function area to which the attack device group belongs.

[0080] Optionally, the security incident alarm handling method provided by the embodiment of the present invention further includes: before executing step 305, determining the alarm level of the security incident alarm based on the security level of the network functional area to which the attacking device group belongs.

[0081] Optionally, the process of determining the alarm level of the security event alarm based on the security level of the network function area to which the attacking device group belongs includes:

[0082] When the security level of the network function area to which the attack device group belongs is higher, the alarm level of the security event alarm is determined to be a higher alarm level; when the security level of the network function area to which the attack device group belongs is lower, the alarm level of the security event alarm is determined to be a lower alarm level.

[0083] Optionally, the process of generating handling prompt information of the security event alarm based on the attack device group includes: generating handling prompt information of the security event alarm based on the attack device group and the alarm level.

[0084] Optionally, the above process of generating handling prompt information of the security event alarm based on the attack device group and the alarm level includes: generating handling prompt information including the attack device group information and the alarm level.

[0085] Optionally, the security incident alarm handling method provided by the embodiment of the present invention also includes: blocking the network function area to which the attacking device group belongs by a corresponding isolation device.

[0086] Optionally, the above-mentioned process of blocking the network functional area to which the attack device group belongs through the corresponding isolation device includes: after determining the attack device group, automatically controlling the corresponding isolation device to block the network functional area to which the attack device group belongs; or responding to the administrator's instruction to block the network functional area to which the attack device group belongs, controlling the corresponding isolation device to block the network functional area to which the attack device group belongs.

[0087] Specifically, the above step of blocking the network function area to which the attacking device group belongs by using the corresponding isolation device may be performed before executing step 305 , while executing step 305 , or after executing step 305 .

[0088] Optionally, when the network function area of ​​the attacking device group is a test area, the corresponding test area is blocked.

[0089] The embodiments of the present invention can help generate different alarm succession handling prompt information for different network functional areas, and then can help take the most appropriate handling measures for different network functional areas according to their functions, thereby minimizing the impact on the normal operation of the target network as much as possible while ensuring network security.

[0090] Figure 4 1 is a structural diagram of a security incident alarm handling device provided by an embodiment of the present invention, and the device is suitable for executing the security incident alarm handling method provided by an embodiment of the present invention. Figure 4 As shown, the device may specifically include:

[0091] The network device group acquisition module 401 is used to determine multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch. It is helpful to classify network devices of different types or different uses into different network device groups, and generate an alarm network model of the target network based on the network device groups.

[0092] The alarm network model acquisition module 402 is used to generate an alarm network model of the target network with each network device group as a network node, which can be helpful in determining the attack device group corresponding to the security event alarm based on the alarm network model.

[0093] Optionally, the above-mentioned alarm network model acquisition module 402 can be specifically used to determine the connection relationship between each network device group based on the connection relationship between each network device; use the standard legend of each network device group to represent the corresponding network device group, and connect each standard legend based on the connection relationship between each network device group to obtain an alarm network; and add the network address of the corresponding network device to each standard legend to obtain an alarm network model.

[0094] The attack path acquisition module 403 is used to determine the attack device group corresponding to the security event alarm of the target network based on the alarm network model, and the attack device group is the network device group on the attack path corresponding to the security event alarm. It can be helpful to generate concise and easy-to-understand handling prompt information based on the attack device group.

[0095] Optionally, the attack path acquisition module 403 can be specifically used to determine the attack device group based on the network addresses of network devices through which the data traffic of the security event alarm passes.

[0096] The handling prompt acquisition module 404 is used to generate handling prompt information of the security event alarm based on the attack device group, so as to prompt the management personnel to manually handle the security event alarm based on the handling prompt information. In combination with modules 401 to 403, it is possible to help managers with different professional knowledge to handle security event alarms related to corresponding network devices in a concise and easy-to-understand manner, so that even if the management personnel do not have network security knowledge related to all types and uses of network devices, they can quickly determine different handling strategies for network devices of different types or uses, thereby improving the efficiency of handling security event alarms.

[0097] Optionally, the handling prompt obtaining module 404 can be specifically used to generate an alarm diagram that highlights the attacking device group based on the attacking device group and the alarm network model to obtain handling prompt information.

[0098] Optionally, the security incident alarm handling provided by an embodiment of the present invention also includes: a device type and logical distance acquisition module, which is used to input the network topology map of the target network into a pre-trained device identification model before determining multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch; identify the device type of each network device in the network topology map and the network lines connecting each network device through the device identification model; and obtain the number of network lines between each network device and the core switch, and calculate the logical distance between the corresponding network device and the same core switch based on the number of network lines.

[0099] Optionally, the security incident alarm handling provided by an embodiment of the present invention also includes a functional area determination module, which is used to divide the target network into multiple network functional areas based on the network isolation device in the target network before determining multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch, so that the network isolation device isolates each network functional area and determines the network functional area to which each network device belongs.

[0100] Optionally, the aforementioned network device group acquisition module 401 can be specifically used to group multiple network devices that belong to the same network functional area, have the same device type, and have the same logical distance to the same core switch into the same network device group.

[0101] Optionally, the security incident alarm handling provided by the embodiment of the present invention also includes a blocking module, which is used to block the network function area to which the attacking device group belongs through a corresponding isolation device.

[0102] Optionally, the security event alarm handling provided by the embodiment of the present invention also includes a blocking module, which is used to determine the alarm level of the security event alarm based on the security level of the network function area to which the attacking device group belongs.

[0103] Optionally, the aforementioned handling prompt acquisition module is also used to generate handling prompt information of the security event alarm based on the attack device group and the alarm level.

[0104] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0105] An embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the security incident alarm handling method provided in any of the above embodiments is implemented.

[0106] An embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, and when the program is executed by a processor, the security incident alarm handling method provided in any of the above embodiments is implemented.

[0107] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements a security incident alarm handling method as described in any one of the embodiments of the present invention.

[0108] Reference below Figure 5 , which shows a schematic diagram of the structure of a computer system 500 of an electronic device suitable for implementing an embodiment of the present invention. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0109] like Figure 5As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0110] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0111] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present invention are executed.

[0112] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0113] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0114] The modules and / or units involved in the embodiments of the present invention may be implemented in software or hardware. The modules and / or units described may also be set in a processor, for example, it may be described as: a processor includes a network device group acquisition module, an alarm network model acquisition module, an attack path acquisition module, and a disposal prompt acquisition module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0115] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device implements: determining multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch; generating an alarm network model of the target network with each network device group as a network node; determining the attack device group corresponding to the security event alarm of the target network based on the alarm network model, the attack device group is the network device group on the attack path corresponding to the security event alarm; and generating handling prompt information of the security event alarm based on the attack device group, so as to prompt the management personnel to manually handle the security event alarm based on the handling prompt information.

[0116] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security incident alarm handling method, characterized in that: include: Determine multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch; Generating an alarm network model of the target network with each network device group as a network node; Determine, based on the alarm network model, an attack device group corresponding to the security event alarm of the target network, wherein the attack device group is the network device group on the attack path corresponding to the security event alarm; as well as Based on the attack device group, handling prompt information of the security event alarm is generated to prompt the management personnel to manually handle the security event alarm based on the handling prompt information.

2. The security incident alarm handling method according to claim 1, characterized in that: Before determining a plurality of network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch, the security event alarm handling method further includes: Inputting the network topology map of the target network into a pre-trained device identification model; Identifying the device type of each network device in the network topology diagram and the network line connecting each network device through the device identification model; and The number of the network lines between each network device and the core switch is obtained, and the logical distance between the corresponding network device and the same core switch is calculated based on the number of the network lines.

3. The security incident alarm handling method according to claim 1, characterized in that: The generating of the alarm network model of the target network with each network device group as a network node includes: Determine the connection relationship between the network device groups based on the connection relationship between the network devices; Using the standard legends of the respective network device groups to represent the corresponding network device groups, and connecting the respective standard legends based on the connection relationship between the respective network device groups to obtain an alarm network; and The network address of the corresponding network device is added to each standard diagram to obtain the alarm network model.

4. The security incident alarm handling method according to claim 1, characterized in that: The determining, based on the alarm network model, an attack device group corresponding to the security event alarm of the target network includes: The attack device group is determined based on the network addresses of the network devices through which the data traffic of the security event alarm passes.

5. The security incident alarm handling method according to claim 1, characterized in that: Before determining a plurality of network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch, the security event alarm handling method further includes: Dividing the target network into a plurality of network function areas based on a network isolation device in the target network, so that the network isolation device isolates each network function area and determines the network function area to which each network device belongs; The determining of multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch includes: Multiple network devices that belong to the same network functional area, have the same device type, and have the same logical distance to the same core switch are grouped into the same network device group.

6. The security incident alarm handling method according to claim 5, characterized in that: The security incident alarm handling method also includes: The network functional area to which the attacking device group belongs is blocked by a corresponding isolation device.

7. The security incident alarm handling method according to claim 5, characterized in that: Before generating the handling prompt information of the security event alarm based on the attack device group, the security event alarm handling method further includes: Determine the alarm level of the security event alarm based on the security level of the network functional area to which the attacking device group belongs; The generating of the handling prompt information of the security event alarm based on the attack device group includes: Generate handling prompt information of the security event alarm based on the attack device group and the alarm level.

8. The security incident alarm handling method according to claim 1, characterized in that: The generating of the handling prompt information of the security event alarm based on the attack device group includes: An alarm diagram highlighting the attack device group is generated based on the attack device group and the alarm network model to obtain the handling prompt information.

9. A security incident alarm handling device, characterized in that: include: A network device group acquisition module, used to determine multiple network device groups based on the device type of each network device in the target network and the logical distance between each network device and the same core switch; An alarm network model acquisition module is used to generate an alarm network model of the target network with each network device group as a network node; An attack path acquisition module, used to determine an attack device group corresponding to the security event alarm of the target network based on the alarm network model, wherein the attack device group is the network device group on the attack path corresponding to the security event alarm; as well as The handling prompt acquisition module is used to generate handling prompt information of the security event alarm based on the attack device group to prompt the management personnel to manually handle the security event alarm based on the handling prompt information.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the security event alarm handling method as described in any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the security event alarm handling method as described in any one of claims 1 to 8 is implemented.

Images