Alarm processing method, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of information security, in particular to an alarm processing method, electronic equipment and a storage medium. The alarm processing method comprises the steps that after an alarm occurs, similar parameters of an alarm process are determined, the alarm process is a process causing the alarm, and the similar parameters are used for representing the similarity degree of the alarm process and other processes in a system; and detecting whether the alarm is valid or not according to the similar parameters of the alarm process. According to the alarm processing method and the alarm processing device, the effectiveness of the alarm can be detected at least so as to filter invalid false alarms, so that the credibility and effectiveness of the alarm are improved, the number of alarms needing to be processed is reduced, and the alarm processing burden of related personnel is reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular to an alarm processing method, an electronic device, and a storage medium. Background Art

[0002] In the field of information security, Windows operating system is often the main target of malware attacks due to its widespread use and complex ecosystem. Currently, various process behavior monitoring and alarm systems have been proposed to detect and alarm abnormal behaviors of processes in a timely manner so that relevant personnel, such as operation and maintenance personnel and users, can handle them in a timely manner.

[0003] However, the processing burden imposed by these process behavior monitoring and alerting systems is high. Summary of the invention

[0004] The embodiments of the present application provide an alarm processing method, electronic device and storage medium, which are at least conducive to detecting the effectiveness of alarms to filter out invalid false alarms, so that relevant personnel only need to process reliable and effective alarms, thereby reducing the alarm processing burden.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a method for processing an alarm, comprising: after an alarm occurs, determining similarity parameters of an alarm process, wherein the alarm process is the process that causes the alarm, and the similarity parameters are used to characterize the degree of similarity between the alarm process and other processes in the system; based on the similarity parameters of the alarm process, detecting whether the alarm is valid.

[0006] According to some embodiments of the present application, the second aspect of the embodiments of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the alarm processing method as described in any embodiment of the present application.

[0007] According to some embodiments of the present application, a third aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the alarm processing method as described in any embodiment of the present application.

[0008] The technical solution provided in the embodiment of the present application has at least the following advantages:

[0009] After an alarm occurs, by determining the similar parameters of the alarm process that causes the alarm relative to other processes in the system, the characteristic that malicious processes are usually different from other legitimate processes in the system is utilized. Based on the similar parameters of the alarm process, it is possible to reliably, effectively and accurately determine whether the alarm is valid, thereby realizing the effectiveness detection of the alarm to filter out invalid false alarms, thereby improving the credibility and effectiveness of the alarm, reducing the number of alarms that need to be processed, avoiding the consumption of human and physical resources of relevant personnel in handling false alarms, and reducing the burden of alarm processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0011] Figure 1 This is the process of the alarm processing method provided in the embodiment of the present application Figure 1 ;

[0012] Figure 2 This is the process of the alarm processing method provided in the embodiment of the present application Figure 2 ;

[0013] Figure 3 This is the process of the alarm processing method provided in the embodiment of the present application Figure 3 ;

[0014] Figure 4 This is the process of the alarm processing method provided in the embodiment of the present application Figure 4 ;

[0015] Figure 5 This is a data flow diagram of the alarm processing method provided in the embodiment of the present application;

[0016] Figure 6 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] As can be seen from the background technology, the current process behavior monitoring and alarm system has the problem of bringing a heavy processing burden to relevant personnel.

[0018] After analysis, it is found that the reason for the above problems is at least that the alarms generated by the current process behavior monitoring and alarm system are not all credible and effective, and there are always some false alarms. For example, some conventional software with complex functions have normal behaviors of calling various link libraries and supporting programs, but these behaviors may be identified as malicious behaviors because they call some link libraries, thereby generating alarms. For example, some legal software may set up some legal rogue behaviors to meet the needs of some special scenarios, but due to the particularity of its behavior, it may also be easy to alarm legal behaviors. These false alarms are mixed in with normal alarms, and relevant personnel have to deal with them one by one in order to ensure information security, wasting some time to deal with false alarms, making the alarm processing burden heavy.

[0019] That is to say, if the identification and filtering of false alarms can be provided outside the existing process monitoring and alarm system, the processing of false alarms can be reduced, thereby reducing the alarm processing burden.

[0020] Based on this, an alarm processing method, electronic device and storage medium are provided in an embodiment of the present application. Based on the fact that the number of malicious processes is small and they generally have different performance characteristics from legitimate processes, after an alarm occurs, for the alarm process, its similar parameters relative to other processes in the system are determined and the validity of the alarm is detected based on this, thereby accurately and reliably identifying false alarms and reducing the processing burden caused by invalid false alarms.

[0021] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0022] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0023] The present application embodiment provides a method for processing an alarm, which is applied to a terminal, a device or a system, such as a computer, a protective device, a security platform system, etc., which will not be listed one by one here. Figures 1 to 4 The process shown illustrates the alarm processing method provided in the embodiment of the present application.

[0024] In some embodiments, the process of the alarm processing method is as follows Figure 1 As shown, the following steps are included:

[0025] Step 101, after an alarm occurs, determine similar parameters of the alarm process, wherein the alarm process is the process that causes the alarm, and the similar parameters are used to characterize the similarity between the alarm process and other processes in the system.

[0026] Step 102: Check whether the alarm is valid based on similar parameters of the alarm process.

[0027] In this way, after an alarm occurs, by determining the similar parameters of the alarm process that causes the alarm relative to other processes in the system, the characteristic that malicious processes are usually different from other legitimate processes in the system is utilized, and based on the similar parameters of the alarm process, it is possible to reliably, effectively and accurately determine whether the alarm is valid, thereby realizing the effectiveness detection of the alarm to filter out invalid false alarms, thereby improving the credibility and effectiveness of the alarm, reducing the number of alarms that need to be processed, avoiding the consumption of human and physical resources of relevant personnel in handling false alarms, and reducing the burden of alarm processing.

[0028] For ease of understanding, the following Figure 1 The steps of the illustrated embodiment are explained.

[0029] In step 101, after the alarm occurs, the similarity parameters of the alarm process are determined. Among them, the embodiment of the present application does not limit the determination method of the similarity parameters of the alarm process. It can be understood that the similarity parameters can characterize the similarity degree of the alarm process relative to other processes in the system, and the similarity degree can be described in a variety of different ways. For example, several processes in the system (including the alarm process) are determined from different aspects to evaluate their similarity, and then the similarity parameters are determined based on the scores obtained by the evaluation. For example, several processes in the system (including the alarm process) are feature extracted, and then clustered based on the extracted feature vectors, and then based on the cluster center obtained by clustering, the deviation of the alarm process relative to the cluster center is determined as a similarity parameter, etc. Of course, the above is only an example. In some embodiments, it is also possible to select an implementation from the determination schemes of the similarity parameters of different alarm processes in combination with the concurrency of the alarm, the number of system processes, the level of the alarm, the idleness of resources, etc., which will not be listed one by one here.

[0030] It should be noted that the intrusion of illegal users is sporadic, that is, the number of malicious processes generated by the intrusion of illegal personnel will not be large, at least less than the number of normal legal processes. At the same time, illegal personnel usually invade to achieve some special purposes. In order to achieve these purposes, the malicious process may perform some processing that is different from other normal legal processes, thereby showing different performance from other normal legal processes. In other words, the malicious process will be a small number of relatively isolated processes that behave differently from other processes. Therefore, by determining the similarity between the alarm process and other processes in the system, that is, the possibility of whether the alarm process is a relatively isolated process that behaves differently from other processes, it can be used to determine whether the alarm process is really a malicious process, that is, to determine whether the alarm process is effective.

[0031] In step 102, according to the similar parameters of the alarm process, it is detected whether the alarm is valid. Among them, the embodiment of the present application does not limit the specific detection method, which can be any method that can determine whether the similar parameters of the alarm process can indicate that the alarm process is similar enough to other processes in the system to determine that the alarm process is a normal and legal process. It is understandable that, as mentioned above, there are different ways to determine the similar parameters of the alarm process, and the methods of detecting whether the alarm is valid corresponding to the similar parameters of the alarm process determined in different ways will also be different. For example, in the case where the similar parameters are a single value, it is possible to detect whether the alarm is valid by detecting whether the similar parameters of the alarm process exceed a preset threshold, wherein, in the case of exceeding the preset threshold, it is determined that the alarm is invalid, and in the case of not exceeding the preset threshold, it is determined that the alarm is valid. Thereby, the detection is real-time and efficient, avoiding the potential safety hazards caused by the untimely processing of the alarm due to the large delay caused by the detection of the effectiveness of the alarm. For example, when the similarity parameters are arrays, a trained neural network model can be used for determination, wherein the neural network model uses the similarity parameters of the alarm process in the form of an array as input, and uses the confidence level of the alarm corresponding to the alarm process as output, and uses the similarity parameters of the alarm process processed historically and the label of whether it is a valid alarm as input during training. Thus, implicit features can be learned based on the neural network model, so that the alarm validity detection does not require developers and the like to have sufficient prior knowledge, thereby reducing the difficulty of detection. Of course, the above is only an example, and other methods can be used to implement it in other embodiments, which will not be listed here one by one.

[0032] It should be noted that, as mentioned above, the more similar the alarm process is to other processes, the more likely it is to make a misjudgment, that is, the alarm is invalid and is a false alarm. In different scenarios, the requirements for similar parameters of the alarm process for effective alarms may be different. Therefore, the specific conditions for whether the alarm is valid or invalid may be different based on the scenario. Taking the example of detecting whether the similar parameters of the alarm process exceed the preset threshold, different thresholds can be set in different application scenarios. For example, for objects that need to be protected in the intranet, since the intranet has certain access conditions, it is not easy for illegal users to invade and generate malicious processes, and it is more likely to make misjudgments. Therefore, the preset threshold can be set to a larger value. For objects that need to be protected in the public network, since illegal users are more likely to successfully invade and generate malicious processes, it is less likely to make misjudgments. Therefore, the preset threshold can be set to a smaller value. For example, during periods of frequent intrusions, the preset threshold can be set to a larger value, so that the number of alarms judged as invalid is relatively small, that is, the number of alarms filtered out is relatively small, avoiding the problem of missed security risks due to alarm filtering; and during periods of less intrusions, the preset threshold can be set to a smaller value, so that the number of alarms judged as invalid is relatively large, that is, the number of alarms filtered out is relatively large, and the burden of alarm processing can be minimized while basically not ignoring security risks. Of course, the above are only examples provided from different scenarios and specific needs in corresponding scenarios. In other scenarios, other influencing factors can also be considered to adjust the detection conditions, which will not be repeated here.

[0033] It should also be noted that the above step description is mainly provided for the situation where a single alarm occurs. It is understandable that alarms may also be concurrent, in which case, the processing of multiple alarms will be involved. At this time, the processing for each alarm will be the same as the above description. The processing order between different alarms is not limited in the embodiment of the present application. For example, concurrent alarms can be processed one by one in a certain order, such as completing the validity test one by one according to the level of the alarm, wherein the level can be determined according to the urgency of different alarm reasons defined in advance, or the level is determined according to the protection requirements of the equipment (or objects such as devices), or the level is determined according to the frequency of the same alarm. In this way, the processing and filtering of more important or more urgent alarms can be completed first, so that more important or more urgent alarms can be processed more promptly, and there will be no safety hazards due to excessive delays. For example, concurrent alarms can be processed in parallel, that is, similar parameters and validity tests of each alarm process are determined at the same time, so that the efficiency is higher.

[0034] In addition, for concurrent alarms, when determining similar parameters of a single alarm process, other processes in the referenced system may include the alarm process corresponding to the concurrent alarm, or may not include the alarm corresponding to the concurrent alarm. When the alarm process corresponding to the concurrent alarm is included, it can be adapted to software with legitimate rogue behavior, avoiding the situation where the validity of the alarm is misjudged due to the failure to combine multiple alarms during the use of software with legitimate process behavior; when the alarm process corresponding to the concurrent alarm is not included, it can avoid the situation where the validity of the alarm is misjudged due to large-scale intrusion. On this basis, further, whether to include the alarm process corresponding to the concurrent alarm can be determined based on whether there is software with legitimate rogue behavior, so as to determine the appropriate alarm processing method.

[0035] In the subsequent embodiments, the processing process of a single alarm is still mainly used for explanation. As for the situation of concurrent alarms, it can be understood in combination with the description provided here, and the situation of concurrent alarms will not be described in detail in the subsequent description.

[0036] It is understandable that there are many types of other processes in the system, and not all processes are highly correlated with the alarm process. Even if the alarm process is a normal and legitimate process, there may be large differences between it and the alarm process. In other words, different processes in the system have different capabilities to provide references for the effectiveness detection of the alarm process. Therefore, in some embodiments, other processes in the system that are referenced by similar parameters for determining the alarm process can be screened, and mainly processes that are more closely correlated with the alarm process are retained to improve the effectiveness and reliability of the similarity parameters of the alarm process, thereby improving the accuracy of the alarm effectiveness detection, thereby being able to more accurately and appropriately reduce the processing burden of alarms, without causing security threats due to the processing of processes that actually have potential safety hazards.

[0037] Based on this, in some embodiments, such as Figure 2 As shown, the process of the alarm processing method may include the following steps:

[0038] Step 201, after an alarm occurs, determine the first sub-similarity parameter of the alarm process relative to the homologous process of the alarm process, and / or determine the second sub-similarity parameter of the alarm process relative to the root process of the alarm process, so as to determine the similarity parameter of the alarm process based on the first sub-similarity parameter and / or the second sub-similarity parameter; wherein, at least two processes having the same root process and being located in the same folder are homologous processes.

[0039] Step 202: Check whether the alarm is valid based on similar parameters of the alarm process.

[0040] In this way, Figure 1On the basis of the shown embodiment, the reference process for determining the similar parameters of the alarm process is further limited to the homologous process of the alarm process and / or the root process of the alarm process, thereby improving the effectiveness and reliability of the similar parameters of the alarm process through reference to the homologous process and root process with stronger reference, while effectively reducing the amount of calculation and avoiding the alarm validity detection consuming a long time and affecting the alarm processing.

[0041] For ease of understanding, the above Figure 2 The steps of the embodiment shown are explained. Among them, step 202 is substantially the same as step 101 in the above embodiment, and will not be described in detail here.

[0042] In step 201, after an alarm occurs, a first sub-similarity parameter of the alarm process relative to a homologous process of the alarm process is determined, and / or a second sub-similarity parameter of the alarm process relative to a root process of the alarm process is determined. Among them, the embodiment of the present application does not limit the method for determining the first sub-similarity parameter and the second sub-similarity parameter of the alarm process. It can be understood that it can be determined based on normal and legal homologous processes, and the characteristics between the root process and the sub-process. For example, homologous processes can generally be identified as similar processes. That is, the more homologous processes there are, the higher the similarity between the process and other processes. Therefore, the first sub-similarity parameter can be determined according to the number of homologous processes with different paths of the alarm process (that is, the processes with the same path as the alarm process in the homologous processes of the alarm process). For example, a typical way for illegal personnel to invade is through non-system dynamic link libraries (DLL), and general monitoring and alarm systems will generate alarms based on the use of non-system dynamic link libraries. For these alarms, if the root process has more non-system dynamic link libraries, the smaller the difference in the non-system dynamic link libraries, the more likely it is to have false alarms caused by normal non-system dynamic link libraries. Therefore, the second sub-similarity parameter of the alarm process can be determined based on the number of first target dynamic link libraries loaded by the root process of the alarm process, where the first target dynamic link library belongs to the non-system state link library and has the same path as the alarm process.

[0043] In particular, there are some special cases, including the situation that the security software providing protection may need to load dynamic link libraries in different processes due to the need for protection. At this time, even homologous processes with different paths will show similarity with the alarm process, and can be used as a proof of whether the alarm process is a normal and legal process (i.e., the alarm is invalid). In other words, homologous processes with different paths can also be considered as a similarity parameter. Therefore, in some embodiments, the second sub-similarity parameter of the alarm process is determined according to the number of first target dynamic link libraries loaded by the root process of the alarm process, which can be achieved as follows: the second sub-similarity parameter of the alarm process is determined according to the number of first target dynamic link libraries and the number of second target dynamic link libraries loaded by the root process of the alarm process. Among them, the second target dynamic link library belongs to a non-system dynamic link library and has a different path from the alarm process.

[0044] It should be noted that, further taking into account the possibility of special situations occurring less frequently, the correlation degree between the second sub-similarity parameter and the number of first dynamic link libraries is greater than the correlation degree between the second sub-similarity parameter and the number of second target dynamic link libraries. In this way, it can adapt to the actual application of non-system dynamic link libraries in the process, making the determined second sub-similarity parameter of the alarm process more accurate, effective and reliable, thereby making the similarity parameters of the alarm process determined based on this more accurate, effective and reliable, and realizing accurate, effective and reliable alarm effectiveness detection.

[0045] Of course, the above is only an example of how to determine the first sub-similarity parameter and the second sub-similarity parameter of the alarm process. In other embodiments, the determination of the first sub-similarity parameter and the second sub-similarity parameter of the alarm process can also be achieved in other ways. For example, for homologous processes, the first sub-similarity parameter of the alarm process can also be determined by comparing the number of non-system dynamic link libraries, or the determination of the first sub-similarity parameter and / or the second sub-similarity parameter can be roughly the same as the example provided for the determination of the similarity parameters in the aforementioned step 101. The main difference lies in the different reference processes, which will not be elaborated here.

[0046] In addition, the embodiments of the present application do not limit how the similarity parameter is determined based on the first sub-similarity parameter and the second sub-similarity parameter. For example, the array composed of the first sub-similarity parameter and the second sub-similarity parameter can be used as a similarity parameter. In this way, the processing is concise, and when detecting whether the alarm is valid, the first sub-similarity parameter and the second sub-similarity parameter can be accurately referenced for detection, avoiding detection deviation caused by information loss. For example, an association can be established between the first sub-similarity parameter and the second sub-similarity parameter, and a set of weights or a processing expression can be determined by the corresponding way of their association to calculate the value of the corresponding similarity parameter. In this way, when detecting whether the alarm is valid, what needs to be processed is a data rather than a set of data, the processing volume is smaller, the detection efficiency is higher, and the alarm validity detection is more timely, avoiding its interference with subsequent processing. Of course, the above is only an example, and other methods can also be used in other embodiments, which will not be listed here one by one.

[0047] It can also be understood that the file attribute of a process is also one of the characteristics of the process, which can also be used to determine the similarity between processes. Based on this, in some embodiments, such as Figure 3 As shown, the process of the alarm processing method may include the following steps:

[0048] Step 301, after an alarm occurs, determine the third sub-similarity parameter of the alarm process according to the file attributes of each file of the root process of the alarm process; wherein the similarity parameter is determined according to the third similarity parameter; the file attributes include at least one of the following attributes: file modification time, file digital signature, file company name, file product name.

[0049] Step 302: Check whether the alarm is valid based on similar parameters of the alarm process.

[0050] In this way, Figure 1 On the basis of the illustrated embodiment, the description of the degree of similarity between processes is further limited to the degree of similarity shown by the file attributes of the processes, so as to accurately distinguish between normal process file attribute modifications and malicious process modifications based on the characteristic that illegal user intrusion usually involves some special modifications to the file attributes of the processes, thereby being able to determine whether the alarm is effective, accurate and reliable through the degree of similarity shown by the process file attributes.

[0051] For ease of understanding, the following Figure 3 The steps of the embodiment shown are explained. Among them, step 302 is substantially the same as step 102 in the above embodiment, and will not be described in detail here.

[0052] In step 301, after the alarm occurs, the third sub-similarity parameter of the alarm process is determined according to the file attributes of each file of the root process of the alarm process. Among them, the embodiment of the present application does not limit the determination method of the third sub-similarity parameter. For example, in the case where the file attribute includes the file modification time, the third sub-similarity parameter can be determined according to the number of sub-files whose file modification time is the same as that of the root process under the file of the root process of the alarm process. For another example, in the case where the file attribute includes the file company name, the third sub-similarity parameter can be determined according to the number of sub-files whose file company name is the same as that of the root process under the file of the root process of the alarm process. For another example, in the case where the file attribute includes the file product name, the third sub-similarity parameter can be determined according to the number of sub-files whose file product name is the same as that of the root process under the file of the root process of the alarm process. For another example, in the case where the file attribute includes the file digital signature, the third sub-similarity parameter can be determined according to the number of sub-files whose file digital signature is the same as that of the root process under the file of the root process of the alarm process. Of course, the above is only an example. In some embodiments, other file attributes can also be considered, so as to determine the third sub-similarity parameter based on other file attributes, which will not be repeated here.

[0053] It should be noted that Figure 2 The embodiments shown and Figure 3 The illustrated embodiments are only used to illustrate the determination method of similar parameters of the alarm process provided from different aspects. In some cases, Figure 2 The embodiments shown and Figure 3 The shown embodiments can be combined, that is, after determining the first sub-similarity parameter (and / or the second sub-similarity parameter) and the third sub-similarity parameter, the similarity parameter is further determined based on the first sub-similarity parameter (and / or the second sub-similarity parameter) and the third sub-similarity parameter, wherein these sub-similarity parameters can be combined into an array as the similarity parameter of the alarm process, or through some processing, the first sub-similarity parameter (and / or the second sub-similarity parameter) and the third sub-similarity parameter can be combined to calculate a numerical value as the similarity parameter of the alarm process, etc., which will not be described one by one here.

[0054] It is also understandable that in the alarm, another influencing factor can be considered as a risk port. In the case of an open risk port, the alarm is likely to be effective and there is no misjudgment. In the case of an undeveloped risk port, it is difficult for illegal users to invade, and the alarm is likely to be a false alarm and is invalid. Based on this, in some embodiments, such as Figure 4 As shown, the process of the alarm processing method may include the following steps:

[0055] Step 401, after an alarm occurs, similarity parameters of the alarm process are determined, wherein the alarm process is the process that causes the alarm, and the similarity parameters are used to characterize the degree of similarity between the alarm process and other processes in the system.

[0056] Step 402: determining interference parameters of the risk port on the alarm process, wherein the interference parameters are used to characterize the degree to which the alarm process is interfered by the risk port.

[0057] Step 403: Detect whether the alarm is valid according to the interference parameter and similarity parameter of the alarm process.

[0058] In this way, Figure 1 On the basis of the illustrated embodiment, the effectiveness of the alarm is detected by using the interference parameters corresponding to the risk port in combination with similar parameters of the alarm process, thereby further combining the influence of the risk port to improve the accuracy and reliability of the alarm effectiveness detection, thereby avoiding safety hazards caused by false or missed alarms while minimizing the processing burden brought by the alarm.

[0059] For ease of understanding, the following Figure 4 The steps in the embodiment shown are explained. Among them, step 401 is substantially the same as step 101 in the above embodiment, and will not be described in detail here.

[0060] In step 402, the interference parameter of the risk port on the alarm process is determined. Among them, the embodiment of the present application does not limit the evaluation of the interference of the risk port on the alarm process, that is, the specific determination method of the interference parameter is not limited. For example, the interference parameter is determined based on whether there is a risk port. For example, it can be determined based on the proportion of risk ports in the port, the risk level and / or the access situation of the risk port. The determination of the interference parameters will not be listed one by one here.

[0061] Step 403, detect whether the alarm is valid according to the interference parameters and similar parameters of the alarm process. Among them, the embodiment of the present application defines how the interference parameters participate in the alarm validity detection. For example, the interference parameters can be treated as equivalent to the similar parameters, so as to achieve the alarm validity detection by obtaining a value representing the state of the alarm process and based on whether the value satisfies the threshold condition. In this way, the alarm validity detection is more concise and efficient, and the delay for subsequent processing is smaller. For example, the interference parameters can be treated as equivalent to the similar parameters, so as to achieve the detection of the alarm validity by combining the array composed of the interference parameters and similar parameters of the alarm process with the trained neural network model. It makes it possible to detect whether the alarm is valid more accurately and reliably through implicit features. For example, considering that the risk port refers to a way to provide some means for the implementation of the intrusion, it can be considered to determine the possibility of misjudgment to a certain extent. Therefore, the interference parameters of the risk port can be used as the coefficient of the similar parameters of the alarm process to further realize the detection of the alarm validity. That is, in some embodiments, detecting whether the alarm is valid based on the interference parameters and similar parameters of the alarm process can be achieved in the following way: updating the similar parameters of the alarm process based on the interference parameters and the preset expression, wherein the preset expression is: similar parameters of the alarm process after update = similar parameters of the alarm process before update * interference parameters; detecting whether the alarm is valid based on the similar parameters of the alarm process after update. In this way, it is more in line with the actual situation of the alarm, making the detection result of the alarm validity both efficient and accurate. Of course, the above is only an example of how the interference parameters and similar parameters of the alarm process act on the detection of the alarm validity. In some embodiments, other methods can also be used to achieve this, which will not be described one by one here.

[0062] It should be noted that Figure 4 The embodiment shown is only Figure 1 An embodiment obtained by introducing risk port considerations based on the embodiment shown in the figure, in some embodiments, it is also possible to Figure 2 , Figure 3 or a combination thereof, using Figure 4 The risk port is introduced in a similar manner to the embodiment shown, that is, in Figure 2 , Figure 3 Or a combination thereof to determine similar parameters of the alarm process, further detect whether the alarm is valid based on the similar parameters and the interference parameters of the risk port on the alarm process, and the details will not be repeated here.

[0063] In order to facilitate those skilled in the art to better understand the above embodiments, Figure 1-Figure 4 A combination example of the illustrated embodiment is used to illustrate a method for processing an alarm.

[0064] After an alarm occurs, the device, apparatus or platform that generates or receives the alarm further processes it according to the following process:

[0065] Step 1: Get the alarm process.

[0066] Specifically, when a process is detected to have abnormal behavior or create malicious files and trigger the alarm mechanism to issue an alarm, the name and process identification (PID) of the process (i.e., the alarm process) are further obtained and recorded as basic data for subsequent analysis.

[0067] Step 2: Get the root process of the alarm process.

[0068] Specifically, first, according to the PID and name of the alarm process, trace its parent process upwards, and search level by level until the root process is found. During the search process, if the parent process identifier (Parent Process ID, PPID) is 0 or 4 (this is usually the identifier of the system process), or the parent process name is explorer.exe or service.exe, stop searching and mark the current process node as the root process of the alarm process.

[0069] Step 3: Determine the first sub-similarity parameter according to the number of processes with different paths from the alarm process in the same source process as the alarm process.

[0070] Specifically, obtain a list of all other child processes under the root process tree where the alarm process is located; then, obtain the file paths of these child processes and the folders they are located in, and record them; then, obtain the file path of the alarm process and the folder it is located in, and perform comparative analysis; then, count the number of other processes (i.e., homologous processes with different paths) that have different paths from the alarm process but are in the same folder, recorded as Pn, with a maximum value of 10. If the number exceeds 10, it is calculated as 10; finally, calculate the first sub-similarity parameter Pn=Pn / 10.

[0071] Step 4: Determine a second sub-similarity parameter of the alarm process according to the number of the first target dynamic link libraries and the number of the second target dynamic link libraries loaded by the root process of the alarm process.

[0072] Specifically, obtain a list of all dynamic link libraries loaded by the root process, and record the file path of each dynamic link library; then, eliminate all dynamic link libraries under the C:\Windows path (i.e., eliminate system dynamic link libraries), and retain the dynamic link library lists of other paths (i.e., retain non-system dynamic link libraries); then, count the number of dynamic link libraries under the same path as the alarm process, denoted as Dn1, with a maximum value of 10. If the number exceeds 10, it is calculated as 10; at the same time, count the number of dynamic link libraries under different paths from the alarm process, denoted as Dn2, with a maximum value of 10. If the number exceeds 10, it is calculated as 10; finally, calculate the second sub-similarity parameter Dn=(Dn1 / 10+Dn2 / 20) / 2.

[0073] Step 5: Determine the third sub-similar parameter of the alarm process according to the file attributes of each file of the root process of the alarm process.

[0074] Specifically, the file path and the folder where the root process is located are obtained; then, it is determined whether it belongs to C:\Windows or its subfolder. If the folder belongs to C:\Windows or its subfolder, the third sub-similarity parameter Fn=0 is directly determined. Otherwise, the execution continues: obtain the list of other files in the folder, and record the relevant attributes of each file. The number of files with the same modification time as the root process is counted, which is recorded as Fn1, and the maximum value is 10. If the number exceeds 10, it is calculated as 10; the number of files with the same product name as the root process is counted, which is recorded as Fn2, and the maximum value is 10. If the number exceeds 10, it is calculated as 10; the number of files with the same company name as the root process is counted, which is recorded as Fn3, and the maximum value is 10. If the number exceeds 10, it is calculated as 10; the number of files with the same digital signature as the root process is counted, which is recorded as Fn4, and the maximum value is 10. If the number exceeds 10, it is calculated as 10; after Fn1, Fn2, Fn3, and Fn4 are determined, the third sub-similarity parameter Fn=(Fn1 / 10+Fn2 / 10+Fn3 / 10+Fn4 / 10) / 4 is calculated.

[0075] Step 6: Determine the interference parameters of the risk port on the alarm process.

[0076] Specifically, check whether the root process has an open port and obtain a list of open ports. Then, based on the list of open ports, detect whether there is an open port recorded in a predefined risk port list (wherein the risk port list is determined based on historical processing results or experience, for example, the risk port list may include ports corresponding to the following port numbers: 80, 443, 3306, 3389, etc.). If so, set the interference parameter T of the alarm process to 0, otherwise the interference parameter T of the alarm process is 1.

[0077] Step 7: Update similar parameters of the alarm process based on the interference parameters and the preset expression.

[0078] Specifically, it is updated according to the following expression: the similarity parameter S of the updated alarm process = (Pn+Dn+Fn) / 3*T.

[0079] Step 8: Determine whether the similarity parameter of the updated alarm process exceeds a preset threshold.

[0080] Specifically, it is determined whether S is greater than a preset threshold (eg, 0.2). If so, the alarm is determined to be invalid and a false alarm generated by a normal process; otherwise, it is considered to be a valid alarm.

[0081] Thus, in the above example, firstly, by tracing the root process, the root process and the alarm process can be used as the starting point of the analysis, so that the analysis is more comprehensive, and finally the alarm process actually generated can be reached, avoiding the problem that the alarms of the LOLbin (Living off the landBinaries) type cannot be distinguished. Secondly, through the analysis of the same-origin process, the legitimacy of the alarm process is judged, so that other processes under the same root process tree can be counted and analyzed, and the accuracy of false alarm filtering is improved. Thirdly, through the analysis of non-system dynamic link library loading, the DLL under the system path is eliminated to further judge the legitimacy of the process, and the number of DLLs under different paths is counted as a reference for false alarm judgment. The legitimacy of the alarm process is further judged through the analysis of the same-origin file attributes, including file modification time, product name, company name and digital signature. In addition, through port exclusion and analysis of open ports, predefined high-risk ports are excluded to avoid abnormal behaviors of processes that open high-risk services after vulnerabilities are exploited and incorrectly filtered. Finally, through the following Figure 5 The data flow process shown achieves the following effects: reducing false alarms, that is, through multiple analysis and judgment mechanisms, effectively filtering out false alarms caused by conventional legitimate software, significantly improving the accuracy of the alarm system; precise identification, that is, through multi-dimensional analysis of root processes, paths and folders, dynamic link libraries and file attributes, it can accurately distinguish between legitimate software and malicious software and reduce the false alarm rate; high flexibility, that is, it provides flexible and adjustable thresholds and parameter settings, and users can adjust the false alarm filtering standards according to actual needs, further improving the applicability and reliability of the system.

[0082] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0083] Another aspect of the present application embodiment further provides an electronic device, such as Figure 6 As shown, it includes: at least one processor 601; and a memory 602 that is communicatively connected to the at least one processor 601; wherein the memory 602 stores instructions that can be executed by the at least one processor 601, and the instructions are executed by the at least one processor 601 so that the at least one processor 601 can execute the alarm processing method described in any of the above method embodiments.

[0084] The memory 602 and the processor 601 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 601 and the memory 602 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 601 is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor 601.

[0085] The processor 601 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 602 can be used to store data used by the processor 601 when performing operations.

[0086] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0087] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0088] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for processing an alarm, characterized in that: include: After an alarm occurs, determining a similarity parameter of an alarm process, wherein the alarm process is a process that causes the alarm, and the similarity parameter is used to characterize a degree of similarity between the alarm process and other processes in the system; According to the similarity parameters of the alarm process, it is detected whether the alarm is valid.

2. The method for processing an alarm according to claim 1, characterized in that: The similar parameters of the alarm process are determined, including: Determine a first sub-similarity parameter of the alarm process relative to a homologous process of the alarm process, wherein at least two processes having the same root process and being located in the same folder are the homologous processes; and / or, Determine a second sub-similar parameter of the alarm process relative to a root process of the alarm process; The similarity parameter is determined according to the first sub-similarity parameter and / or the second sub-similarity parameter.

3. The method for processing an alarm according to claim 2, characterized in that: The determining of a first sub-similarity parameter of the alarm process relative to a homologous process includes: determining the first sub-similarity parameter according to the number of homologous processes having different paths of the alarm process; and / or, The determining of a second sub-similar parameter of the alarm process relative to a root process of the alarm process comprises: The second sub-similarity parameter of the alarm process is determined according to the number of first target dynamic link libraries loaded by the root process of the alarm process, wherein the first target dynamic link library belongs to a non-system state link library and has the same path as the alarm process.

4. The method for processing an alarm according to claim 3, characterized in that: The determining the second sub-similarity parameter of the alarm process according to the number of first target dynamic link libraries loaded by the root process of the alarm process includes: Determine the second sub-similarity parameter of the alarm process according to the number of the first target dynamic link libraries and the number of the second target dynamic link libraries loaded by the root process of the alarm process; Among them, the second target dynamic link library belongs to a non-system dynamic link library and has a different path from the alarm process; the correlation degree between the second sub-similarity parameter and the number of the first dynamic link libraries is greater than the correlation degree between the second sub-similarity parameter and the number of the second target dynamic link libraries.

5. The method for processing an alarm according to any one of claims 2 to 4, characterized in that: The determining of similar parameters of the alarm process also includes: Determining a third sub-similar parameter of the alarm process according to the file attributes of each file of the root process of the alarm process; Among them, the similarity parameter is determined based on the following information: at least one of the first sub-similarity parameter and the second sub-similarity parameter, and the third similarity parameter; the file attributes include at least one of the following attributes: file modification time, file digital signature, file company name, file product name.

6. The method for processing an alarm according to any one of claims 1 to 4, characterized in that: The detecting whether the alarm is valid according to the similarity parameter of the alarm process includes: Determining whether the similarity parameter of the alarm process exceeds a preset threshold; In the case where the preset threshold is exceeded, determining that the alarm is invalid; When the preset threshold is not exceeded, it is determined that the alarm is valid.

7. The method for processing an alarm according to any one of claims 1 to 4, characterized in that: Before detecting whether the alarm is valid according to the similarity parameter of the alarm process, the method further includes: Determining an interference parameter of the risk port on the alarm process, wherein the interference parameter is used to characterize the degree to which the alarm process is interfered by the risk port; The detecting whether the alarm is valid according to the similarity parameter of the alarm process includes: Whether the alarm is valid is detected according to the interference parameter and the similarity parameter of the alarm process.

8. The method for processing an alarm according to claim 7, characterized in that: The detecting whether the alarm is valid according to the interference parameter and the similarity parameter of the alarm process includes: According to the interference parameter and a preset expression, the similarity parameter of the alarm process is updated, wherein the preset expression is: the similarity parameter of the alarm process after update = the similarity parameter of the alarm process before update * the interference parameter; According to the updated similarity parameter of the alarm process, it is detected whether the alarm is valid.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the alarm processing method according to any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the alarm processing method according to any one of claims 1 to 8 is implemented.

Images