Security processing event data statistical method and system

Abstract

The invention relates to the technical field of network security, and discloses a security processing event data statistical method and system, and the method comprises the steps: bringing each second object into a first object, and carrying out the first target inspection, and obtaining first target inspection data; processing the first target inspection data, and determining a third object; and performing second target processing on the third object, and regulating and controlling the third object based on a processing result. By establishing the device integration system, various safety devices and subsystems are managed in a unified mode, and the overall performance and manageability of the system are greatly improved. The timing operation system and the automatic process arrangement realize automation and timing of the inspection task, so that manual intervention is remarkably reduced, and the data processing efficiency and accuracy are improved. Risk equipment can be positioned in time through rapid identification and platform testing of abnormal data, and the safety of the system is ensured.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security processing event data statistics method and system. Background Art

[0002] The verification of network security platform functions is often carried out through unit testing, integration testing, system testing and acceptance testing to test the functional correctness, performance stability, security reliability and user satisfaction of the platform. According to the size of the organization, business needs, security goals and budget, select a suitable network security incident collaborative response platform product. According to the product documentation or the guidance of the service provider, deploy and configure the network security incident collaborative response platform to ensure that the network security platform can be integrated with existing security equipment and systems to collect and process network security data and alarms of concern. At present, the network security platform has the disadvantage of lack of systematic coordination in how to collect, analyze, handle and report network security incidents. To this end, it is necessary to propose a security processing event data statistics method and system to address the disadvantage of the network security platform's lack of systematic coordination. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is that the existing network security platform lacks systematic coordination in event collection, analysis, disposal and reporting, resulting in low processing efficiency and slow response speed.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for statistically analyzing security processing event data, comprising:

[0006] Incorporating each second object into the first object, performing first object inspection, and obtaining first object inspection data;

[0007] processing the first object inspection data to determine a third object;

[0008] The second target processing is performed on the third object, and the third object is regulated based on the processing result.

[0009] As a preferred solution of the method for statistically analyzing the safety event data of the present invention, wherein: incorporating each second object into the first object comprises receiving a plurality of second objects, selecting one of the second objects, and forming a second object characteristic function;

[0010] Returning to selecting a second object until all second objects are selected;

[0011] The characteristic value of each second object characteristic function is extracted to form the first object characteristic function.

[0012] As a preferred solution of the method for statistically analyzing the data of security processing events described in the present invention, the first target inspection includes performing the first target inspection on a first object according to the first target;

[0013] Combine the first object feature function and each feature value of the second object feature function, and receive the first object inspection data fed back by the second object feature function;

[0014] The first target inspection data includes data reflecting the operating status of the first object and the first target inspection result.

[0015] As a preferred solution of the safety processing event data statistics method described in the present invention, determining the third object includes automatically processing the first target inspection result data to obtain the operating status of all second objects and generate the third object.

[0016] As a preferred solution of the method for statistically analyzing security event data of the present invention, performing second target processing on the third object includes analyzing the second target of the third object and determining the state of the third object.

[0017] As a preferred solution of the security processing event data statistics method described in the present invention, the automated processing of the first target inspection result data includes but is not limited to processing the first target inspection result data using a random forest combined with an XGBoost algorithm to obtain the status of all second objects and generate a third object.

[0018] As a preferred solution of the security processing event data statistics method described in the present invention, wherein: the determination of the operating status of the third object includes but is not limited to, using a variational autoencoder algorithm to analyze the second target of the third object to determine the status of the third object.

[0019] A safety processing event data statistics system, wherein:

[0020] A data processing module, which incorporates each second object into the first object, performs first object inspection, and obtains first object inspection data;

[0021] A data inspection module, processing the first object inspection data and determining the third object;

[0022] The control module performs the second target processing on the third object and controls the third object based on the processing result.

[0023] A computer device comprises: a memory and a processor; the memory stores a computer program, wherein the processor implements the steps of any one of the methods of the present invention when executing the computer program.

[0024] A computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of any one of the methods of the present invention.

[0025] Beneficial effects of the present invention: The security processing event data statistics method provided by the present invention unifies the management of various security devices and subsystems by establishing an equipment integration system, greatly improving the coordination and manageability of the system. The scheduled operation system and automated process orchestration realize the automation and timing of inspection tasks, significantly reduce manual intervention, and improve data processing efficiency and accuracy. Rapid identification of abnormal data and platform testing can locate risky devices in a timely manner to ensure the security of the system. The collaborative work of the emergency response system and the mobile device side realizes efficient collaborative response of multiple personnel, shortens the response time of security incidents, and reduces potential risks. In addition, the generated security event data statistical report provides a comprehensive view of the security status through a feedback mechanism to support the decision-making optimization of management. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0027] Figure 1 An overall flow chart of a method for statistically analyzing security event data provided by the first embodiment of the present invention;

[0028] Figure 2 A system structure diagram of a security processing event data statistics method provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0030] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a method for statistically analyzing security processing event data, comprising:

[0031] S1: Incorporate each second object into the first object, perform first object inspection, and obtain first object inspection data.

[0032] In one implementation of the present application, the first object refers to the main system architecture of the device integration system, which is responsible for the management and control of the overall system and regularly checks each subsystem (i.e., the second object). The second object includes various hardware or software subsystems, which are embedded in the main system to provide functional services. Through real-time data collection and analysis of the second object, the first target inspection aims to identify potential risk devices. After processing this data, the system can identify a third object, that is, a device or subsystem with abnormalities or potential risks. For the third object, the system performs the second target processing, that is, implements security response and fault repair, and generates corresponding event data to feedback to the management level in order to make decisions and ensure the healthy operation and safety of the system.

[0033] In an optional embodiment, the first object can also be a smart home control system, which is responsible for the overall management and control of all devices in the home, such as lights, temperature control devices and security systems, and regularly checks each subsystem (i.e., the second object). The second object includes various home subsystems, such as smart lighting, temperature control systems and security monitoring, which are connected to the main control system as independent modules and provide specific functional services. Through real-time data collection and analysis of the second object, the first target inspection can identify potential risk devices. After data processing, the system can identify the third object, that is, equipment with faults or potential risks, such as temperature control device failures or security system failures. For the third object, the system implements the second target processing, that is, security response and fault repair, and generates corresponding event data to feedback to the management to help make decisions, thereby ensuring the healthy operation and safety of the smart home system.

[0034] By receiving multiple second objects (such as equipment subsystems), the characteristics of each second object are selected and extracted one by one to generate its characteristic function. Each characteristic function contains the key operating parameters or performance indicators of the object. By looping through all second objects, extracting their characteristic values ​​and summarizing them, a comprehensive characteristic function of the entire system (first object) is finally formed. This process ensures that information is extracted and integrated from each subsystem, thereby comprehensively describing the performance and status of the first object and providing basic data for subsequent risk detection and decision-making.

[0035] The first target inspection process includes a health status check on the first object (main system architecture). First, the operating data of the first object, such as load, stability, and performance indicators, are collected according to the set first target. Then, the status of the entire equipment integration system is analyzed by combining the characteristic function of the first object with the characteristic value of the characteristic function of each second object (subsystem). Each second object will feedback its operating data, including temperature, current, load and other information. These feedback data serve as the data source for the first target inspection and help evaluate the overall operating status of the first object. Ultimately, the first target inspection data reflects the operating status and inspection results of the first object, providing a basis for the system's risk assessment, performance optimization, and fault diagnosis, ensuring the healthy operation of the system and timely detection of potential problems.

[0036] S2: Process the first target inspection data and determine the third object.

[0037] The first target inspection result data is automatically processed. First, the system automatically calculates the operating status of each subsystem by analyzing the first target inspection data fed back from each second object (subsystem). These operating status data may involve parameters such as temperature, current, and load, reflecting the health of each subsystem. On this basis, the system further conducts a comprehensive assessment of the status of all subsystems, and automatically processes and identifies devices with abnormal operating status or potential faults. Ultimately, these subsystems identified as having risks or abnormalities are defined as third objects, that is, potential risk devices or faulty devices. The process of determining the third object helps the system to promptly detect and handle equipment abnormalities, preventing major failures or safety hazards in the system as a whole.

[0038] In one implementation of the present application, the automated processing identifies the equipment with abnormal operating status or potential faults by preprocessing the first target inspection result data using random forest combined with XGBoost algorithm; then, the importance of each feature is evaluated using the random forest algorithm, and the features that are highly correlated with the equipment status are screened out according to the feature importance to improve the training efficiency of the subsequent model. Subsequently, the XGBoost algorithm is used to classify or regress the screened feature data, and the model is optimized through an adaptive gradient boosting mechanism to predict the state of each second object (subsystem). Based on the model prediction results, the second objects with abnormalities or potential faults are marked, and these objects are grouped into a third object, namely, potential risk equipment. Through this process, abnormal subsystems that may exist in the system can be efficiently identified, providing a reliable basis for subsequent risk handling and security response.

[0039] In an optional embodiment, the equipment that automatically processes and identifies abnormal operating conditions or potential faults can also use the support vector machine algorithm to collect and clean the first target inspection result data, including equipment operating status, performance indicators, environmental factors, etc. Next, the data is feature extracted and standardized to ensure that the data is suitable for the SVM model. The standardization process usually includes mean normalization or standard deviation normalization for each feature to eliminate the impact of different dimensions on model training. A classification model is established using the support vector machine algorithm. The SVM algorithm distinguishes normal equipment from potential faults or abnormal equipment by constructing a hyperplane (or multiple hyperplanes) to maximize the interval between categories. During the model training process, using data that has been labeled with normal and abnormal states as a training set, the SVM model will learn how to distinguish between the normal state and fault state of the equipment.

[0040] After training, the SVM model can classify the newly collected inspection data. If the state of a device or subsystem is judged as "abnormal" by the model, the device is identified as a potential fault or risk device, and a third object is generated. The third object includes all devices identified as fault risks, which will be further subject to risk response and safety processing.

[0041] Furthermore, by automatically processing and comprehensively evaluating the operating status data of each subsystem, devices with potential failures or risks (i.e., third objects) can be identified in a timely manner. This process can efficiently and accurately monitor and analyze the health status of each subsystem in the system, avoiding delays and errors caused by human intervention, thereby improving the stability and safety of the system. By automatically identifying potential risk devices, preventive measures can be taken before failures occur, avoiding overall system failures or major safety hazards, and improving the reliability and safety of the system.

[0042] S3: Perform the second target processing on the third object, and regulate the third object based on the processing result.

[0043] Through data collection and analysis, the status of the equipment or subsystem is judged to identify whether it is in a normal, warning or fault state. According to the analysis results, appropriate control measures are taken, such as shutting down or pausing functions, adjusting operating parameters, switching redundant systems or issuing alarms. The regulated equipment needs to be continuously monitored, the treatment effect is evaluated, and the control strategy is dynamically adjusted according to the feedback data to ensure the safety and stability of the system. The results of all processing and control processes are fed back to the system to optimize future operations and response strategies.

[0044] In one implementation of the present application, the operating state of the third object is determined, the second target of the third object is analyzed using a variational autoencoder algorithm, and the second target data of the third object is deeply analyzed using a variational autoencoder algorithm. VAE can effectively reconstruct input data by learning the high-dimensional data distribution of the device under normal operating conditions. When the operating data of the third object is abnormal, the reconstruction error of VAE will increase significantly, indicating potential abnormalities or failures;

[0045] Combining the reconstruction error with the time characteristics of the data, introducing dynamic weighting coefficients and time windows, anomalies can be identified more accurately. The formula is expressed as:

[0046]

[0047] in, represents the reconstruction error function, X: represents the input data set of the device, t represents the current time point, Indicates that at time point t i VAE reconstruction error at time ω ( t i) represents the time weighting coefficient, T represents the time window size, exp ( -αt ) represents the exponential decay factor.

[0048] Next, the reconstruction error generated by VAE is passed as input to the fuzzy logic system. The fuzzy logic system uses fuzzy logic theory to divide the health status of the equipment into multiple fuzzy intervals, such as "normal", "warning", "fault", etc., instead of using hard thresholds. By inputting the reconstruction error of the equipment operation data, the fuzzy logic system evaluates the health status of the equipment according to the preset fuzzy rules.

[0049] The formula for health assessment of fuzzy logic system is expressed as:

[0050]

[0051] Where H(X) represents the health assessment result of the device or system status. represents the reconstruction error of the Xth data feature at time t in the VAE model; μ normal The fuzzy membership function representing the “normal” state, μ warning The fuzzy membership function representing the “warning” state, μ fault Fuzzy membership function representing the "fault" state.

[0052]

[0053] Among them, μ normal(x) represents the membership function between the device state and the “normal” state, μ warning (x) represents the membership function between the equipment status and the “warning” status, μ fault (x) represents the membership function between the device state and the “fault” state, μ fault (x) represents the degree of closeness between the current device state and the "fault" state. x represents the state variable of the current device. Represents the central value of "normal", "warning" and "fault" status respectively; σ normal ,σ warning ′σ fault Represents the standard deviation of "normal", "warning" and "fault" status respectively; It represents the absolute difference between the device state x and the corresponding state center value. max(0,·) indicates that this operation ensures that the value of the membership function will not be negative.

[0054] In an optional embodiment, the operating state of the third object is determined, and the second target of the third object is analyzed by combining principal component analysis (PCA) and independent component analysis (ICA) algorithms.

[0055] First, the operating data of the third object is collected, including key parameters collected by various sensors (such as temperature, pressure, current, etc.). Then, principal component analysis (PCA) is used to reduce the dimensionality of these multidimensional data, extract the main characteristic components, reduce the redundancy of the data, and highlight the main change trends. Subsequently, independent component analysis (ICA) is applied to further decompose the data processed by PCA to identify independent signal sources, which helps to distinguish different failure modes and abnormal signals.

[0056] The algorithm combining PCA and ICA can effectively extract the key features that affect the health status of the third object and separate the independent abnormal signal sources, thereby improving the accuracy and sensitivity of fault diagnosis.

[0057] Then, the eigenvalues ​​extracted by PCA and ICA are passed as input to the fuzzy logic system (FuzzyLogic). The fuzzy logic system maps these eigenvalues ​​to multiple fuzzy intervals (such as "healthy", "warning", and "fault") through pre-defined fuzzy rules instead of using hard thresholds. This method can handle the uncertainty in the health status of the equipment and the ambiguity of the data, providing smoother and more continuous health assessment results. For example, when a key parameter is close to the fault threshold, the fuzzy logic system will not immediately judge it as a "fault", but output a fuzzy value between "healthy" and "fault", indicating that further monitoring or preventive maintenance is needed.

[0058] Furthermore, through real-time monitoring and analysis of the status of equipment or subsystems, the health status can be dynamically identified and control measures can be taken in a timely manner to ensure the safety and stability of system operation. By adjusting the working parameters of the equipment, switching redundant systems or issuing alarms, potential abnormalities or failures can be quickly responded to, and the control strategy can be optimized through continuous monitoring and feedback data, improving the system's adaptive ability and emergency response efficiency, and ultimately achieving intelligent and automated equipment management and maintenance.

[0059] Example 2, reference Figure 2 , is an embodiment of the present invention, and provides a security processing event data statistics system, including:

[0060] S110, receiving an inspection script.

[0061] S120: Based on the inspection script, a time probe is formed for the system protection function.

[0062] S130, allocating time probes according to the characteristic values ​​between the system protection function and each safety data function.

[0063] S140: Start the inspection script to link the time probe.

[0064] S150, receiving real-time data fed back by each safety data function.

[0065] Specifically, the platform provides a way to use Python scripts for device access. Users can use Python to write integrations or add functions to integrations to achieve the connection of various products and devices or enrich the calling functions of connected products and devices.

[0066] By integrating various devices and their inherent inspection scripts, hundreds of system protection functions and various security data functions can be called without secondary writing. For devices that have already integrated instances, the inherent functions of the device can be called directly. At the same time, many built-in scripts are designed, which can be directly called during the task execution process. This saves users the time originally spent on sorting out the integrated device functions and truly achieves the effect of "out of the box".

[0067] Through function calls, the platform also supports scheduled scheduling of online scripts to achieve timed inspections and other purposes. Each scheduled job is displayed in a list, and provides the functions of "Run Now", "Close Job", "Edit Job" and "View Job", which displays the current running time and next running time of the current job in detail and intuitively.

[0068] The platform supports viewing the basic information of scheduled jobs at the front desk, including "Basic job information", "Job records" and "Current job participants". It also supports viewing the process status of each job record. The input and output of each job and the results of each task can be viewed through the "Process status display", which realizes automation while also achieving information transparency.

[0069] This embodiment involves a scheduled system inspection task. The security automation orchestration and response platform can compile daily inspections and other behaviors into scripts for scheduled scheduling, saving daily operation and maintenance time. It displays the current and next running time of the current job in detail and intuitively. While achieving automation, it also achieves information transparency and enhances the coordination between security equipment systems.

[0070] In one embodiment of the present application, S200 includes:

[0071] S210, selecting a time probe.

[0072] S220, refer to the real-time data corresponding to the time probe.

[0073] S230, analyzing the security level of the real-time data based on the inherent functions and built-in scripts of the security device corresponding to the time probe.

[0074] S240, returning to the step of selecting a time probe until all time probes are selected.

[0075] S250, based on the security level of real-time data, automates the process orchestration of real-time data.

[0076] Specifically, a graphical script editing interface is designed to support the creation of four different types of task nodes: "action execution", "conditional branch", "user prompt" and "script". Users can configure and complete a task node by simply dragging and clicking.

[0077] By integrating various devices and their inherent scripts, we can call functions and analyze the security level of real-time data. For devices that have integrated instances, we can directly call the inherent functions of the device. At the same time, we also design many built-in scripts that can be directly called during task execution.

[0078] In one embodiment of the present application, S300 includes:

[0079] S310, select a real-time data.

[0080] S320, using data filters and converters to decode and clean the real-time data to form a work order to be analyzed.

[0081] Specifically, the platform supports filtering and converting the data passed in by the task first, and then passing it into the function for command calling. This method reduces the trouble and time waste caused by a series of problems such as incorrect data format and the need to organize data content, and greatly improves the efficiency of task calling.

[0082] S330, executing script test on the work order to be analyzed.

[0083] Specifically, when using the platform's graphical script editing interface to write a process, users can choose to directly pass the output of the previous task, the fixed parameters of the event, and the user-configured script input as the task input for task flow. For different event inputs, the same script will produce different results.

[0084] S340, judging whether the work order to be analyzed is running normally according to the test result.

[0085] S350: If the work order to be analyzed runs normally, the process returns to selecting a real-time data until all the real-time data are selected.

[0086] S360, if the work order to be analyzed is not operating normally, the real-time data is included in the abnormal data set, and the process of selecting a real-time data is returned until all the real-time data are selected.

[0087] Specifically, the platform's script nodes call device-specific functions and use built-in scripts, and each node depends on the output of the previous task. During the script running process, you can enter the script test mode at any time, simulate input events, and check the script running status in real time, so as to find various errors in the automatic workflow running process.

[0088] In one embodiment of the present application, S500 includes:

[0089] S500: Select a real-time data in the abnormal data set → S520: Call the data filter and converter to clean and decode the data

[0090] S530: Perform unit testing to evaluate the validity of data functions → S540: Use random forests to conduct a preliminary risk assessment of the device and screen out relevant features

[0091] S550: Perform XGBoost training based on the filtered features to further analyze whether the device has security risks → S560: Determine whether the device has system security risks

[0092] S570: Attach labels to high-risk devices → S580: Perform integration testing to determine whether there are system-level security risks → S590: If the device is risk-free, return to select the next device for testing until all devices are completed.

[0093] Specifically, according to the functional realization of the platform, the platform will be tested and verified, including unit testing, integration testing, system testing and acceptance testing, to verify the functional correctness, performance stability, security and reliability of the platform and user satisfaction. The platform testing and verification will be carried out from the following aspects.

[0094] Choose a suitable cybersecurity incident collaborative response platform product based on your organization’s size, business needs, security goals, and budget.

[0095] Deploy and configure the network security incident collaborative response platform according to product documentation or service provider guidance, ensuring that it can be integrated with existing security devices and systems to collect and process network security data and alarms of concern.

[0096] Define and optimize the cybersecurity incident handling process based on organizational characteristics and business scenarios, including event classification, priority, responsible persons, response measures, etc. The orchestration and automation functions provided by the cybersecurity incident collaborative response platform can be used to transform the process into an executable script, and audit and update it regularly.

[0097] In order to verify the functions and effectiveness of the network security incident collaborative response platform, we can simulate and test some common or specific network security incidents, observe how the platform collects, analyzes, handles and reports these incidents, and evaluate the platform's role in improving detection speed, reducing response time, and reducing manual intervention.

[0098] After completing the simulation and testing, the test results can be collected and analyzed, including indicators such as platform operation status, event handling, and response effects.

[0099] These indicators can be used to evaluate the performance, reliability, and usability of the cybersecurity incident collaborative response platform, and the platform configuration or process settings can be adjusted based on test feedback.

[0100] S600 includes:

[0101] S610 (Establishing a group chat visualization interface): The group visualization interface serves as the basis for monitoring and collaboration, providing collaborative support for subsequent decision-making.

[0102] S620 (add data interface): The platform introduces the real-time data of the device into the analysis system through the data interface. At this point, the VAE algorithm begins to reconstruct and detect anomalies in the device operation data. By learning the high-dimensional data distribution of the device under normal conditions, VAE can automatically identify behaviors that are significantly different from the normal operation mode and indicate potential anomalies.

[0103] S630 (execute safety data function and call system protection function): execute the safety data function of the device and further analyze the abnormal data identified by VAE to determine the health status of the device and provide a basis for subsequent troubleshooting.

[0104] Combining the reconstruction error with the time characteristics of the data, introducing dynamic weighting coefficients and time windows, more accurately identifying anomalies, the health status of the equipment can be determined as follows:

[0105]

[0106] in, represents the reconstruction error function, X: represents the input data set of the device, t represents the current time point, Indicates that at time point t i VAE reconstruction error at time ω ( t i) represents the time weighting coefficient, T represents the time window size, exp ( -αt ) represents the exponential decay factor.

[0107] S650-S700: Safety equipment monitoring and fault diagnosis

[0108] At this stage, the reconstruction error results of VAE are introduced into the fuzzy logic system to achieve a more detailed equipment health status assessment:

[0109] S650 (calling the work order system and inspection script): The platform automatically starts the inspection script based on the results of VAE analysis, conducts in-depth inspections on devices that may have abnormalities, and collects abnormal data from the devices.

[0110] S710 (Select tagged safety devices): The devices marked as abnormal are input into the system and assigned to relevant personnel for processing through the work order system.

[0111] At this point, the reconstruction error generated by the VAE is passed as input to the fuzzy logic system to further evaluate the health of the equipment:

[0112] S710-S720 (Tag and Inspection): The system uses a fuzzy logic system to classify the health status of the device into multiple levels. Through fuzzy logic rules, a lower reconstruction error may be classified as a "normal" state, while a higher reconstruction error may be classified as a "fault" state.

[0113] The formula for health assessment of fuzzy logic system is expressed as:

[0114]

[0115] Among them, H (X ) Indicates the health assessment results of the device or system status, represents the reconstruction error of the Xth data feature at time t in the VAE model; μ normal The fuzzy membership function representing the “normal” state, μ warning The fuzzy membership function representing the “warning” state, μ fault: Fuzzy membership function representing the "fault" state.

[0116]

[0117] Among them, μ normal ( x ) Represents the membership function of the device state and the "normal" state, μ warning ( x represents the membership function between the equipment status and the "warning" status, μ fault( x ) Represents the membership function of the device state and the "fault" state, μ fault9 x ) It measures the closeness between the current device state and the "fault" state. x represents the state variable of the current device. Represents the central value of "normal", "warning" and "fault" status respectively; σ normal ,σ warning ′σ fault Represents the standard deviation of "normal", "warning" and "fault" status respectively; It represents the absolute difference between the device state x and the corresponding state center value. max(0,·) indicates that this operation ensures that the value of the membership function will not be negative.

[0118] S800-S900: Risk response and treatment

[0119] At this stage, based on the output of the VAE and fuzzy logic system, the platform responds to and repairs the risks of the equipment:

[0120] S800 (Risk Response), through the reconstruction error generated by VAE, the platform determines whether the device is in an abnormal state, and determines the level of abnormality, such as "warning" or "failure" through the fuzzy logic system. If an abnormality is detected, the system notifies the corresponding security event to the security device group and starts the repair process.

[0121] S900 (Event Display and Processing): The platform displays risk events and their status, and collaborates through group chat and visual interfaces. All events and processing records are transparently displayed on the platform, and users can view the abnormal detection and repair status of each device.

[0122] Embodiment 3, an embodiment of the present invention, is different from the first two embodiments in that:

[0123] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0124] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0125] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0126] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0127] Example 4, Experiment. The experimental environment includes a network security platform that integrates multiple security devices such as firewalls, intrusion detection systems (IDS), antivirus gateways, and Web application firewalls (WAF). Inspection scripts and function libraries are written in Python to achieve automated inspection and data collection of various security devices.

[0128] First, the inspection scripts of each security device are received (S110). These scripts cover functions such as device status query, log acquisition, and performance indicator collection. Based on these inspection scripts, time probes are formed for the system protection function (S120), and each time probe corresponds to a specific security device and inspection task. By analyzing the characteristic values ​​between the system protection function and each security data function, such as the device's response time, CPU usage, and memory usage, the time probes are reasonably allocated (S130) to ensure that important devices receive more frequent inspections.

[0129] Subsequently, the inspection script was started to link the time probe (S140) to implement scheduled inspections of each security device. The inspection script calls the inherent functions of each security device through the Python interface provided by the platform, without the need to rewrite the code. The platform also designed multiple built-in scripts, such as abnormal log analysis and traffic anomaly detection, which can be directly called during task execution. During the inspection process, real-time data feedback from each security data function is received (S150), which includes the operating status, performance indicators and security event logs of the device.

[0130] In order to further process the real-time data, a time probe is selected (S210) and its corresponding real-time data is referenced (S220). Based on the inherent functions of the security device corresponding to the time probe and the built-in script, the security level of the real-time data is parsed (S230), and the security events are divided into three levels: "normal", "warning" and "serious". Repeat the above steps until all time probes are processed (S240). According to the security level of the real-time data, the real-time data is automatically orchestrated (S250), and task nodes such as "action execution", "conditional branching", "user prompts" and "scripts" are created in the platform's graphical script editing interface to achieve automated response to security events.

[0131] Next, a real-time data is selected (S310), and the real-time data is decoded and cleaned using data filters and converters to form a work order to be analyzed (S320). In the work order system, a script test is performed on the work order to be analyzed (S330), and whether the work order to be analyzed is running normally is determined based on the test results (S340). If it is running normally, it returns to select the next real-time data until all real-time data are processed (S350); if it is not running normally, the real-time data is included in the abnormal data set and the next real-time data is processed (S360). During the script test process, the device's inherent functions and built-in scripts are called, relying on the output of the previous task, entering the script test mode at any time, simulating input events, checking the running status of the script in real time, and discovering and solving various problems in the automatic workflow operation process.

[0132] To evaluate the effectiveness of the algorithm, a variational autoencoder (VAE) is used to perform in-depth analysis of abnormal data. VAE can effectively reconstruct input data by learning the high-dimensional data distribution of the equipment under normal operating conditions. When the operating data of the equipment is abnormal, the reconstruction error of VAE will increase significantly, indicating potential abnormalities or failures. The reconstruction error generated by VAE is passed as input to the fuzzy logic system. The fuzzy logic system uses fuzzy logic theory to divide the health status of the equipment into multiple fuzzy intervals such as "normal", "warning" and "fault". By inputting the reconstruction error of the equipment operating data, the fuzzy logic system evaluates the health status of the equipment according to the preset fuzzy rules. The experimental results are shown in Table 1.

[0133] Table 1 Experimental results

[0134]

[0135]

[0136] It can be seen from the table data that the method of the present invention has significant advantages in detecting device anomalies and assessing security risks. First, the key performance indicators such as CPU usage, memory occupancy, and response time collected by the inspection script preliminarily reflect the operating status of each device. For example, the CPU usage and memory occupancy of device D and device F are both over 85%, and the response time is also significantly higher than that of other devices, indicating that their operating pressure is relatively high and there may be performance bottlenecks.

[0137] Furthermore, VAE was used to conduct in-depth analysis of the equipment operation data and calculate the reconstruction error. The reconstruction errors of the normally operating equipment (such as equipment A and equipment C) were low, 0.02 and 0.01 respectively, while the reconstruction errors of abnormal equipment (such as equipment D and equipment F) increased significantly, 0.25 and 0.30 respectively. This shows that VAE can effectively capture abnormal changes in the equipment operation status.

[0138] The reconstruction error of VAE is input into the fuzzy logic system to evaluate the health status of the equipment. The fuzzy logic evaluation results show that equipment D and equipment F are judged to be in "fault" state, equipment B and equipment G are in "warning" state, and the remaining equipment are in "normal" state. Compared with the traditional hard threshold judgment method, the fuzzy logic system can handle the uncertainty and ambiguity of data more flexibly, providing smoother and more continuous health assessment results.

[0139] Based on the results of fuzzy logic evaluation, the safety level of the equipment was further divided, and corresponding treatment measures were formulated. For high-risk equipment D and equipment F, the treatment measure of "emergency repair" was adopted, and relevant personnel were immediately notified to conduct troubleshooting and repair. For medium-risk equipment B and equipment G, the measure of "adjusting parameters" was adopted to appropriately reduce their workload or optimize their configuration. For low-risk equipment A, equipment C, and equipment E, "monitoring" continued to ensure their stable operation.

[0140] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for statistically analyzing security event data, characterized in that: include: Incorporating each second object into the first object, performing first object inspection, and obtaining first object inspection data; processing the first object inspection data to determine a third object; The second target processing is performed on the third object, and the third object is regulated based on the processing result.

2. The method for collecting statistics of security processing event data according to claim 1, characterized in that: Incorporating each second object into the first object includes receiving a plurality of second objects, selecting one of the second objects, and forming a second object characteristic function; Returning to selecting a second object until all second objects are selected; The characteristic value of each second object characteristic function is extracted to form the first object characteristic function.

3. The method for collecting statistics of security processing event data according to claim 2, characterized in that: Performing the first target inspection includes performing the first target inspection on the first object according to the first target; Combine the first object feature function and each feature value of the second object feature function, and receive the first object inspection data fed back by the second object feature function; The first target inspection data includes data reflecting the operating status of the first object and the first target inspection result.

4. The method for collecting statistics of security processing event data according to claim 3, characterized in that: Determining the third object includes automatically processing the first target inspection result data to obtain the operating status of all second objects and generate the third object.

5. The method for collecting statistics of security processing event data according to claim 4, characterized in that: Performing second target processing on the third object includes analyzing the second target of the third object and determining a state of the third object.

6. The method for collecting statistics of security processing event data according to claim 5, characterized in that: The automated processing of the first target inspection result data includes, but is not limited to, processing the first target inspection result data using a random forest combined with an XGBoost algorithm to obtain the status of all second objects and generate a third object.

7. The method for collecting statistics of security processing event data according to claim 6, characterized in that: Determining the operating state of the third object includes, but is not limited to, analyzing the second target of the third object using a variational autoencoder algorithm to determine the state of the third object.

8. A security processing event data statistics system using the method according to any one of claims 1 to 7, characterized in that: A data processing module, which incorporates each second object into the first object, performs first object inspection, and obtains first object inspection data; A data inspection module, processing the first object inspection data and determining the third object; The control module performs the second target processing on the third object and controls the third object based on the processing result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the security processing event data statistics method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the security processing event data statistics method described in any one of claims 1 to 7 are implemented.

Images