Threat warning information processing method and system

Abstract

The present invention relates to the field of information processing technology, and discloses a threat alarm information processing method and system, including a data acquisition module, a feature extraction module, a data analysis module, and a data integration module. In terms of information acquisition, the present invention can obtain data from multiple sources, covering a wide range. In terms of feature extraction, it accurately extracts features such as time, source IP and target IP, laying a solid foundation for subsequent analysis. Through time feature analysis, the risk of continuous attack can be judged according to the time interval. Source IP and target IP analysis can find abnormal addresses and locate potential threat sources and attacked targets. Correlation analysis can deeply analyze the behavioral correlation between IP addresses, attack frequency and target vulnerability status, etc., and comprehensively and accurately determine the network security situation. Finally, a report is generated through the data integration module to help network security managers make efficient decisions, effectively ensure the safe and stable operation of the network system, and improve the overall network security protection level.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a threat warning information processing method and system. Background Art

[0002] With the rapid development of information technology, networks have become deeply integrated into key sectors such as finance, energy, and communications. In power systems, while smart grids leverage networks to enhance intelligence and enable remote monitoring and automated dispatching, they also introduce numerous cybersecurity risks. Cyber ​​attackers could infiltrate monitoring networks, tamper with power data, interfere with dispatching instructions, and severely impact power supply.

[0003] The cybersecurity protection systems of enterprises and organizations are becoming increasingly complex, encompassing a variety of devices such as firewalls, intrusion detection systems, and security intelligence platforms. However, when these devices and platforms operate independently, problems arise. For one thing, threat alert information comes from scattered sources, with widely varying formats and data volumes. Firewall logs focus on network access blocking, intrusion detection systems focus on traffic anomalies, and security intelligence platforms cover external threat intelligence, making it difficult for network security managers to gain a comprehensive overview. Furthermore, traditional manual analysis of threat alert information is inefficient and prone to omissions. The lack of automated analysis and processing systems prevents in-depth mining and correlation analysis, making it difficult to quickly identify key information such as persistent attacks, attack sources, and key targets, making it difficult to implement targeted protection measures in a timely manner.

[0004] In summary, given the current severe network security situation and diverse sources of device intelligence, there is an urgent need for systems and methods that can integrate multi-source threat alert information, automatically extract features, conduct in-depth analysis, and generate intuitive reports to improve the efficiency and accuracy of network security management and ensure stable network operation. Summary of the Invention

[0005] The purpose of the present invention is to provide a threat warning information processing method and system, which solves the technical problems raised in the background technology.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] Threat warning information processing system, including:

[0008] Data collection module, used to collect threat warning information from multiple data sources;

[0009] Feature extraction module, used to extract multiple warning features from the collected threat warning information;

[0010] The data analysis module is used to analyze and process threat warning information based on the extracted features, and determine the network security situation through the analysis and processing results;

[0011] The data integration module is used to summarize and organize the analysis results of the data analysis module to form a threat warning information analysis report.

[0012] As a further solution of the present invention: the threat alert information includes logs of network security devices, abnormal information in power system monitoring data, and alert data of relevant security intelligence platforms;

[0013] Among them, network security equipment includes firewalls and intrusion detection systems.

[0014] As a further solution of the present invention: the extraction method of the feature extraction module is as follows:

[0015] Step A1, time feature extraction:

[0016] StepA1.1. Extract the alarm occurrence time from the threat alarm information based on the timestamp in the log and define it as T = {t j}, j = 1, 2, ... m, m represents the number of threat warning information, t j The time when the jth threat warning information is generated;

[0017] Step A1.2, through TJ = t j -t j-1 , calculate the time interval TJ between the threat alarm information and the alarm occurrence time at each adjacent time point;

[0018] Step A2: Source IP feature extraction:

[0019] The source IP address refers to the unique identifier of the device that sends the network data packet in the network;

[0020] First, identify the source IP address in the threat alert information;

[0021] Then count the number of occurrences of each source IP address and define it as IPYC = {IPyc i1}, where IPyc i1 is the number of occurrences of threat alert information in the i-th source IP address, i 1 = 1, 2, ... n1, where n1 represents the number of source IP addresses;

[0022] Step A3, target IP feature extraction:

[0023] The destination IP address is the unique identifier of the device that the network data packet is destined for on the network.

[0024] First, identify the target IP address in the threat alert information;

[0025] Then count the number of occurrences of each target IP address and define it as IPMC = {IPmc i2}, where IPmc i2 is the number of occurrences of threat alarm information in the i2th target IP address, i2=1, 2, ..., n2, where n2 represents the number of target IP addresses.

[0026] As a further solution of the present invention: the analysis and processing method is as follows:

[0027] Step B1. Time Analysis:

[0028] Mark the time interval of all threat alert information as TJ j0 , j0=1, 2, ... m-1;

[0029] Then through: Calculate the average time interval ATJ of all corresponding time intervals of threat warning information;

[0030] The average time interval ATJ is then compared with the preset time interval threshold TJy:

[0031] If ATJ < TJy, it is determined that there is a risk of continuous attack;

[0032] Step B2: Time-Source IP Correlation Analysis:

[0033] First, we build the correlation matrix between time and source IP address and define it as MTY=[MTY j，i1 ], where MTY j，i1 Indicates that the alarm occurs at time t j The source IP address is IPyc i1 Number of alarms that occurred;

[0034] Then through: Calculate the similarity index simTY of the association matrix j，i1 ;

[0035] Then the similarity index simTY j，i1 Similarity threshold simTY y For comparison:

[0036] If simTY j，i1 >simTY y , it means that at the time t j The behavior of the source IP address is relevant;

[0037] If simTY j，i1 ≤simTY y , then it means that at the time t jThe behavior of the source IP address is not relevant;

[0038] Step B3, Time-target IP correlation analysis:

[0039] First, we construct the correlation matrix between time and target IP address and define it as MTM=[MTM j，i2 ], where MTM j，i2 Indicates that the alarm occurs at time t j On the target IP address IPmc i2 Number of alarms that occurred;

[0040] Then through: Calculate the similarity index simTM of the association matrix j，i2 ;

[0041] Then the similarity index simTM j，i2 Similarity threshold simTM y For comparison:

[0042] If simTM j，i2 >simTM y , then it means that at the time t j The behavior of the target IP address is correlated;

[0043] If simTM j，i2 ≤simTM y , then it means that at the time t j The behavior of the target IP address is not relevant;

[0044] Step B4. Source IP address analysis:

[0045] pass: Calculate the average number of occurrences of each source IP address AIPY;

[0046] Then the number of occurrences of each source IP address IPyc i1 Compare with AIPY times F:

[0047] Wherein, F is the preset multiple value;

[0048] If IPyc i1 >F×AIPY, then the source IP address is recorded as an abnormal source IP address;

[0049] If IPyc i1 ≤F×AIPY, the source IP address will not be recorded as an abnormal source IP address;

[0050] Step B5, target IP address analysis:

[0051] pass: Calculate the average AIPM of the number of occurrences of each target IP address;

[0052] Then the number of occurrences of each target IP address IPmc i2 Compare with AIPM times F:

[0053] If IPmc i2 >F×AIPM, then the target IP address is recorded as an abnormal target IP address;

[0054] If IPmc i1 ≤F×AIPM, the target IP address will not be recorded as an abnormal target IP address;

[0055] Step B6, Source IP address-destination IP correlation analysis:

[0056] Establish source IP-target IP association matrix MYM=[MYM i1，i2 ], MYM i1，i2 Indicates the number of times the source IP address sends alarm information to the target IP address;

[0057] Then a source IP address is selected and: Calculate the attack frequency FYM1 of the source IP address on the target IP address i1，i2 ;

[0058] Then the attack frequency FYM1 of the source IP address to the target IP address i1，i2 Compare with the preset source IP-target IP attack frequency threshold FYM1y;

[0059] If FYM1 i1，i2 >FYM1y, it means that the source IP address has frequently attacked the target IP address, and the source IP address is recorded as a risky source IP address;

[0060] At the same time, select a target IP address and pass: Calculate the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 ;

[0061] Then the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 Compare with the preset alarm frequency distribution coefficient threshold FYM2y;

[0062] If FYM2 i1，i2 >FYM2y, it means that the target IP address is in a vulnerable state or the network environment has a security vulnerability, and the target IP address is recorded as a risky target IP address.

[0063] A method for processing threat warning information is implemented by the threat warning information processing system, and the method comprises the following steps:

[0064] Step 1: Data Collection:

[0065] Collect threat alert information from multiple data sources;

[0066] Step 2: Feature extraction:

[0067] Extract multiple warning features from the collected threat warning information;

[0068] Step 3: Data Analysis

[0069] Analyze and process threat warning information based on the extracted features, and determine the network security situation through the analysis and processing results;

[0070] Step 4: Data integration:

[0071] The time analysis results, time-source IP correlation analysis results, time-destination IP correlation analysis results, source IP address analysis results, destination IP address analysis results, and source IP address-destination IP correlation analysis results are summarized and organized to form a complete threat alarm information analysis report.

[0072] Beneficial effects of the present invention:

[0073] The present invention can collect threat warning information from multiple data sources, including logs of network security equipment (such as firewalls and intrusion detection systems), abnormal information in power system monitoring data, and alarm data from relevant security intelligence platforms, etc., covering multiple key information sources, making the monitoring of network security status more comprehensive and not missing any relevant information that may pose a security risk.

[0074] The present invention summarizes and organizes the analysis results of the data analysis module through the data integration module to form a threat alarm information analysis report, which helps managers to clearly and intuitively understand the overall network security situation and provides a strong basis for subsequent decision-making.

[0075] The feature extraction module in this invention can extract multiple key alarm features from the collected threat alarm information, such as time features, source IP features, and target IP features. Through detailed time feature extraction, the alarm occurrence time and the time interval between adjacent time points can be accurately obtained, which helps to analyze the persistence of the attack.

[0076] The present invention extracts and subsequently analyzes the source IP and target IP features, including counting their occurrence times, building a correlation matrix, and calculating similarity indices. This can accurately identify abnormal source IP addresses, abnormal target IP addresses, risky source IP addresses, and risky target IP addresses, thereby accurately determining which devices or nodes in the network may pose security risks and whether the associated behaviors between them are abnormal, greatly improving the accuracy of locating and identifying network security threats.

[0077] The present invention utilizes multiple analytical processing methods within its data analysis module, such as time analysis to determine the presence of persistent attack risks; time-source IP and time-destination IP correlation analysis to determine the behavioral correlations of related IP addresses at specific time points; source and destination IP address analysis to identify abnormal IP addresses; and source IP address-destination IP correlation analysis to determine the frequency of attacks by source IPs on target IPs and the vulnerability of target IPs. These combined analytical processing methods enable a comprehensive and accurate assessment of network security risks and determine the network security landscape, enabling network security managers to promptly implement effective preventative and countermeasures to ensure the secure and stable operation of network systems.

[0078] In summary, the threat alarm information processing system and method of the present invention have significant advantages in network security monitoring, risk assessment and management, and can effectively improve the ability to handle network security threats and the overall security protection level of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The present invention will be further described below with reference to the accompanying drawings.

[0080] Figure 1 It is a system block diagram of the threat warning information processing system of the present invention.

[0081] Figure 2 It is a flowchart of the threat warning information processing method of the present invention. DETAILED DESCRIPTION

[0082] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0083] Example 1

[0084] See also Figure 1 and Figure 2 As shown, the present invention is a threat warning information processing method and system, comprising the following steps:

[0085] Step 1: Data Collection:

[0086] Collect threat alert information from multiple data sources;

[0087] Threat alert information includes, but is not limited to, logs from network security devices, abnormal information in power system monitoring data, and alert data from relevant security intelligence platforms;

[0088] In this embodiment, the network security equipment includes firewalls, intrusion detection systems, etc.

[0089] Step 2: Feature extraction:

[0090] Extract multiple warning features from the collected threat warning information;

[0091] The specific method is as follows:

[0092] Step A1, time feature extraction:

[0093] StepA1.1. Extract the alarm occurrence time from the threat alarm information based on the timestamp in the log and define it as T = {t j}, j = 1, 2, ... m, m represents the number of threat warning information, t j The time when the jth threat warning information is generated;

[0094] Step A1.2, through TJ = t j -t j-1 , calculate the time interval TJ between the threat alarm information and the alarm occurrence time at each adjacent time point;

[0095] Step A2: Source IP feature extraction:

[0096] The source IP address refers to the unique identifier of the device that sends the network data packet in the network;

[0097] First, identify the source IP address in the threat alert information;

[0098] Then count the number of occurrences of each source IP address and define it as IPYC = {IPyc i1}, where IPyc i1 is the number of occurrences of threat alert information in the i-th source IP address, i 1 = 1, 2, ... n1, where n1 represents the number of source IP addresses;

[0099] Step A3, target IP feature extraction:

[0100] The destination IP address is the unique identifier of the device that the network data packet is destined for on the network.

[0101] First, identify the target IP address in the threat alert information;

[0102] Then count the number of occurrences of each target IP address and define it as IPMC = {IPmc i2}, where IPmc i2 is the number of occurrences of threat alert information in the i2th target IP address, i2 = 1, 2, ... n2, where n2 represents the number of target IP addresses;

[0103] Step 3: Data Analysis

[0104] Analyze and process threat warning information based on the extracted features, and determine the network security situation through the analysis and processing results;

[0105] The specific method is as follows:

[0106] Step 1: Time analysis:

[0107] Mark the time interval of all threat alert information as TJ j0 , j0=1, 2, ... m-1;

[0108] Then through: Calculate the average time interval ATJ of all corresponding time intervals of threat warning information;

[0109] The average time interval ATJ is then compared with the preset time interval threshold TJy:

[0110] If ATJ < TJy, it is determined that there is a risk of continuous attack;

[0111] Step 2: Source IP address analysis:

[0112] pass: Calculate the average number of occurrences of each source IP address AIPY;

[0113] Then the number of occurrences of each source IP address IPyc i1 Compare with AIPY times F:

[0114] Wherein, F is the preset multiple value;

[0115] If IPyc i1 >F×AIPY, then the source IP address is recorded as an abnormal source IP address;

[0116] If IPyc i1 ≤F×AIPY, the source IP address will not be recorded as an abnormal source IP address;

[0117] Step 3: Target IP address analysis:

[0118] pass: Calculate the average AIPM of the number of occurrences of each target IP address;

[0119] Then the number of occurrences of each target IP address IPmc i2 Compare with AIPM times F:

[0120] If IPmc i2 >F×AIPM, then the target IP address is recorded as an abnormal target IP address;

[0121] If IPmc i1 ≤F×AIPM, the target IP address will not be recorded as an abnormal target IP address;

[0122] Step 4: Data Integration

[0123] Summarize and organize the analysis results of the data analysis module to form a complete threat warning information analysis report.

[0124] In this embodiment, a structured data table is created to record each analysis result in sequence according to the corresponding threat warning information number or time sequence.

[0125] This embodiment can collect threat alert information from multiple data sources, including network security device logs, power system monitoring data anomaly information, and security intelligence platform alert data, ensuring a wide range of information sources and avoiding missing important threat clues. By extracting time, source IP, and target IP features, it provides a rich data foundation for subsequent in-depth analysis. Time features help understand the temporal patterns and frequency of alert occurrences; source IP features can identify possible attack sources and, by counting the number of occurrences, can preliminarily determine abnormal source IPs; target IP features can determine target devices or network areas of concern, facilitating targeted protection. Time, source IP, and target IP analysis based on extracted features can quickly determine the network security situation. For example, time interval analysis can promptly identify persistent attack risks; source IP address analysis can locate abnormal source IPs and assist in tracing the source of attacks; target IP address analysis can identify abnormal target IPs and strengthen protection for key targets. The analysis results are summarized and organized into a complete report, recorded in a structured data table format, for easy subsequent review, statistics, and management. This helps security teams fully understand the network security situation and provides a strong basis for decision-making.

[0126] Example 2

[0127] As the second embodiment of the present invention, when the present application is specifically implemented, compared with the first embodiment, the technical solution of this embodiment is different from that of the first embodiment only in that in this embodiment, the analysis process further includes: time-source IP correlation analysis and time-destination IP correlation analysis;

[0128] The time-source IP correlation analysis method is as follows:

[0129] First, we construct the correlation matrix between time and source IP address and define it as MTY=[MTY j，i1 ], where MTY j，i1 Indicates that the alarm occurs at time t j The source IP address is IPyc i1 Number of alarms that occurred;

[0130] Then through: Calculate the similarity index simTY of the association matrix j，i1 ;

[0131] In this embodiment, MTY j，i1 Measured the alarm occurrence time t j and source IP address IPyc i1 The "intensity" of co-occurrence; if the number of alarms from the source IP address at the time of the alarm occurrence is high, it means that they are highly correlated in this dimension, and the numerator value will be relatively large; Calculate the alarm occurrence time t j The "scale" of the number of alarms related to all source IP addresses can be understood as a measure of the "influence" of the alarm occurrence time in the source IP address dimension; Calculated the source IP address IPyc i1 The "influence" on the occurrence time of all alarms;

[0132] Then the similarity index simTY j，i1 Similarity threshold simTY y For comparison:

[0133] If simTY j，i1 >simTY y , then it means that at the time t j The behavior of the source IP address is relevant;

[0134] If simTY j，i1 ≤simTY y , then it means that at the time t j The behavior of the source IP address is not relevant;

[0135] The time-target IP correlation analysis method is as follows:

[0136] First, we construct the correlation matrix between time and target IP address and define it as MTM=[MTM j，i2 ], where MTM j，i2 Indicates that the alarm occurs at time tj On the target IP address IPmc i2 Number of alarms that occurred;

[0137] Then through: Calculate the similarity index simTM of the association matrix j，i2 ;

[0138] In this embodiment, MTM j，i2 Measured the alarm occurrence time t j and the target IP address IPmc i2 The "intensity" of co-occurrence; if the target IP address has a large number of alarms at the time of alarm occurrence, it means that they are highly correlated in this dimension, and the numerator value will be relatively large; Calculate the alarm occurrence time t j The "scale" of the number of alarms related to all target IP addresses can be understood as a measure of the "influence" of the alarm occurrence time in the target IP address dimension; Calculated the target IP address IPmc i2 The "influence" on the occurrence time of all alarms;

[0139] Then the similarity index simTM j，i2 Similarity threshold simTM y For comparison:

[0140] If simTM j，i2 >simTM y , then it means that at the time t j The behavior of the target IP address is correlated;

[0141] If simTM j，i2 ≤simTM y , then it means that at the time t j The behavior of the target IP address is not relevant.

[0142] This embodiment adds time-source IP correlation analysis and time-target IP correlation analysis to the first embodiment. By constructing a correlation matrix and calculating similarity metrics, it is possible to deeply explore the inherent connection between the alarm occurrence time and the source IP or target IP. When a strong correlation is found, attack behavior patterns can be more accurately determined, such as concentrated attacks from certain source IPs at a specific time, or frequent attacks on target IPs within a specific time. This helps to provide early warnings and take targeted preventive measures, improving the accuracy and timeliness of network security protection.

[0143] Example 3

[0144] As the third embodiment of the present invention, when the present application is specifically implemented, compared with the first and second embodiments, the technical solution of this embodiment is to combine the solutions of the first and second embodiments. The technical solution of this embodiment differs from the first and second embodiments only in that the analysis and processing in this embodiment further includes:

[0145] Source IP address-destination IP correlation analysis:

[0146] Establish source IP-target IP association matrix MYM=[MYM i1，i2 ], MYM i1，i2 Indicates the number of times the source IP address sends alarm information to the target IP address;

[0147] Then a source IP address is selected and: Calculate the attack frequency FYM1 of the source IP address on the target IP address i1，i2 ;

[0148] Then the attack frequency FYM1 of the source IP address to the target IP address i1，i2 Compare with the preset source IP-target IP attack frequency threshold FYM1y;

[0149] If FYM1 i1，i2 >FYM1y, it means that the source IP address has frequently attacked the target IP address, and the source IP address is recorded as a risky source IP address;

[0150] At the same time, select a target IP address and pass: Calculate the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 ;

[0151] Then the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 Compare with the preset alarm frequency distribution coefficient threshold FYM2y;

[0152] If FYM2 i1，i2 >FYM2y, it means that the target IP address is in a vulnerable state or the network environment has a security vulnerability, and the target IP address is recorded as a risky target IP address.

[0153] This embodiment further expands the correlation analysis to source IP address-target IP correlation analysis, establishing a source IP-target IP correlation matrix and calculating the attack frequency and alarm number distribution coefficient. This not only detects frequent attacks by source IP against target IP and promptly marks risky source IP addresses, but also, by analyzing the distribution of the number of alarms received by the target IP, determines whether the target IP's network environment has security vulnerabilities or is vulnerable to attack and marks the risky target IP addresses. This enables a comprehensive risk assessment from the attack source to the target, more effectively deploying network security resources, focusing on protection and vulnerability repair in high-risk areas, and improving overall network security defense capabilities.

[0154] Example 4

[0155] As the fourth embodiment of the present invention, when this application is specifically implemented, compared with the first, second and third embodiments, the technical solution of this embodiment is to combine and implement the solutions of the above-mentioned first, second and third embodiments.

[0156] This embodiment integrates the solutions of embodiments one, two, and three to form a comprehensive, multi-level threat alert information processing system. By integrating multiple data collection channels, multi-dimensional feature extraction, comprehensive analysis methods, and comprehensive correlation analysis, it is able to maximize the value of threat alert information, accurately and comprehensively grasp the network security situation, and promptly discover various potential security risks. Whether it is persistent attacks, abnormal source or target IP behavior, or complex source-target IP correlation attack patterns, it can effectively identify and respond to them, providing high-intensity, refined security protection for the network, and effectively ensuring the stable operation of the network system and data security.

[0157] The present invention also provides a threat warning information processing system, which is used to execute the threat warning information processing method, and the system includes:

[0158] Data collection module, used to collect threat warning information from multiple data sources;

[0159] Feature extraction module, used to extract multiple warning features from the collected threat warning information;

[0160] The data analysis module is used to analyze and process threat warning information based on the extracted features, and determine the network security situation through the analysis and processing results;

[0161] The data integration module is used to summarize and organize the analysis results of the data analysis module to form a threat warning information analysis report.

[0162] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters and thresholds in the formulas are set by technicians in this field according to actual conditions.

[0163] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for processing threat warning information, characterized in that: The following steps are involved: Step 1: Data Collection: Collect threat alert information from multiple data sources; Step 2: Feature extraction: Extracting warning features from collected threat warning information; Step 3: Data Analysis Analyze and process threat warning information based on the extracted features, and determine the network security situation through the analysis and processing results; Step 4: Data integration: Summarize and organize the analysis and processing results to form a threat warning information analysis report; The feature extraction method is as follows: Step A1, time feature extraction: StepA1.

1. Extract the alarm occurrence time from the threat alarm information based on the timestamp in the log and define it as T = {t j }, j = 1, 2, ... m, m represents the number of threat warning information, t j The time when the jth threat warning information is generated; Step A1.2, through TJ = t j -t j-1 , calculate the time interval TJ between the threat alarm information and the alarm occurrence time at each adjacent time point; Step A2: Source IP feature extraction: The source IP address refers to the unique identifier of the device that sends the network data packet in the network; First, identify the source IP address in the threat alert information; Then count the number of occurrences of each source IP address and define it as IPYC = {IPyc i1 }, where IPyc i1 is the number of occurrences of threat alert information in the i1th source IP address, i1 = 1, 2, ..., n1, where n1 represents the number of source IP addresses; Step A3, target IP feature extraction: The destination IP address is the unique identifier of the device that the network data packet is destined for on the network. First, identify the target IP address in the threat alert information; Then count the number of occurrences of each target IP address and define it as IPMC = {IPmc i2 }, where IPmc i2 is the number of occurrences of threat alert information in the i2th target IP address, i2 = 1, 2, ... n2, where n2 represents the number of target IP addresses; The analysis and processing methods for time characteristics are as follows: Mark the time interval of all threat alert information as TJ j0 , j0=1, 2, ... m-1; Then through: Calculate the average time interval ATJ of all corresponding time intervals of threat warning information; The average time interval ATJ is then compared with the preset time interval threshold TJy: If ATJ < TJy, it is determined that there is a risk of continuous attack; The source IP address is analyzed and processed as follows: pass: Calculate the average number of occurrences of each source IP address AIPY; Then the number of occurrences of each source IP address IPyc i1 Compare with AIPY times F: Wherein, F is the preset multiple value; If IPyc i1 >F×AIPY, then the source IP address is recorded as an abnormal source IP address; If IPyc i1 ≤F×AIPY, the source IP address will not be recorded as an abnormal source IP address; The target IP address is analyzed and processed as follows: pass: Calculate the average AIPM of the number of occurrences of each target IP address; Then the number of occurrences of each target IP address IPmc i2 Compare with AIPM times F: If IPmc i2 >F×AIPM, then the target IP address is recorded as an abnormal target IP address; If IPmc i1 ≤F×AIPM, the target IP address will not be recorded as an abnormal target IP address; Analytical processing also includes: Source IP address-destination IP correlation analysis: Establish source IP-target IP association matrix MYM=[MYM i1，i2 ], MYM i1，i2 Indicates the number of times the source IP address sends alarm information to the target IP address; Then a source IP address is selected and: Calculate the attack frequency FYM1 of the source IP address on the target IP address i1，i2 ; Then the attack frequency FYM1 of the source IP address to the target IP address i1，i2 Compare with the preset source IP-target IP attack frequency threshold FYM1y; If FYM1 i1，i2 >FYM1y, it means that the source IP address has frequently attacked the target IP address, and the source IP address is recorded as a risky source IP address; At the same time, select a target IP address and pass: Calculate the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 ; Then the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 Compare with the preset alarm frequency distribution coefficient threshold FYM2y; If FYM2 i1，i2 >FYM2y, it means that the target IP address is vulnerable or the network environment has a security vulnerability, and the target IP address is recorded as a risky target IP address; Analytical processing also includes: Time-Source IP Correlation Analysis: First, we construct the correlation matrix between time and source IP address and define it as MTY=[MTY j，i1 ], where MTY j，i1 Indicates that the alarm occurs at time t j The source IP address is IPyc i1 Number of alarms that occurred; Then through: Calculate the similarity index simTY of the association matrix j，i1 ; Then the similarity index simTY j，i1 Similarity threshold simTY y For comparison: If simTY j，i1 >simTY y , then it means that at the time t j The behavior of the source IP address is relevant; If simTY j，i1 ≤simTY y , then it means that at the time t j The behavior of the source IP address is not relevant; Analytical processing also includes: Time-target IP correlation analysis: First, we construct the correlation matrix between time and target IP address and define it as MTM=[MTM j，i2 ], where MTM j，i2 Indicates that the alarm occurs at time t j On the target IP address IPmc i2 Number of alarms that occurred; Then through: Calculate the similarity index simTM of the association matrix j，i2 ; Then the similarity index simTM j，i2 Similarity threshold simTM y For comparison: If simTM j，i2 >simTM y , then it means that at the time t j The behavior of the target IP address is correlated; If simTM j，i2 ≤simTM y , then it means that at the time t j The behavior of the target IP address is not relevant.

2. The threat warning information processing method according to claim 1, characterized in that: Threat alert information includes logs from network security devices, abnormal information in power system monitoring data, and alert data from relevant security intelligence platforms; Among them, network security equipment includes firewalls and intrusion detection systems.

3. A threat warning information processing system, the system being used to execute the threat warning information processing method according to any one of claims 1 to 2, characterized in that: The system includes: Data collection module, used to collect threat warning information from multiple data sources; Feature extraction module, used to extract multiple warning features from the collected threat warning information; The data analysis module is used to analyze and process threat warning information based on the extracted features, and determine the network security situation through the analysis and processing results; The data integration module is used to summarize and organize the analysis results of the data analysis module to form a threat warning information analysis report.

Images