Alarm noise reduction method, device, equipment and medium

Abstract

The invention discloses an alarm noise reduction method and device, equipment and a medium. The alarm noise reduction method comprises the following steps: acquiring equipment alarm initial data; presetting a data standardization rule and ATTamp according to the equipment alarm initial data; determining alarm data to be clustered through a CK technology; and performing attack feature extraction and single-device alarm aggregation processing on the to-be-clustered alarm data to generate single-device alarm clustering data, and performing non-homologous alarm merging processing on the to-be-clustered alarm data to generate multi-device alarm clustering data. According to the technical scheme of the embodiment of the invention, effective noise reduction can be carried out on the alarm data, the alarm quality is improved, and the false alarm rate can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an alarm noise reduction method, device, equipment and medium. Background Art

[0002] With the advent of the information age, network security issues have become increasingly prominent, and enterprises are facing an increasing number of network attacks and threats. In order to prevent these threats, enterprises usually deploy various security protection tools, such as intrusion detection systems, firewalls, antivirus software, etc. These tools play an important role in protecting enterprise network security, but they also bring a serious problem, that is, the number of security alerts is exploding. For a large enterprise, the number of alerts generated by these security devices in a day can reach hundreds of thousands or even millions. Such a huge number of alerts makes it difficult for operation and maintenance personnel to start, let alone timely and effectively discover high-level attack behaviors to achieve effective response.

[0003] Therefore, how to quickly filter out valuable key alerts from so many protection alerts is one of the unavoidable problems in the process of enterprise information security construction. At present, the method of alert noise reduction mainly relies on simple aggregation of attack source IP (Internet Protocol) addresses or victim IP addresses. However, different attacks may have the same source and destination addresses, but their attack methods, exploited vulnerabilities, attack payloads, etc. may be completely different. Aggregation based on IP addresses alone will ignore these differences, which may cause important attack events to be covered up and cause a high false alarm rate. If an IP address is used for multiple different malicious activities, aggregation based on source and destination addresses alone may mistakenly regard these activities as a single event, resulting in a high false alarm rate. Summary of the invention

[0004] The present invention provides an alarm noise reduction method, device, equipment and medium to solve the problems of poor alarm quality and high false alarm rate in the current alarm aggregation method.

[0005] According to one aspect of the present invention, there is provided a method for reducing alarm noise, comprising:

[0006] Get the initial data of device alarm;

[0007] Determine the alarm data to be clustered based on the initial device alarm data, preset data standardization rules, and ATT&CK technology;

[0008] The clustered alarm data is subjected to attack feature extraction and single-device alarm aggregation processing to generate single-device alarm clustering data, and the clustered alarm data is subjected to non-homologous alarm merging processing to generate multi-device alarm clustering data.

[0009] According to another aspect of the present invention, there is provided an alarm noise reduction device, comprising:

[0010] A data acquisition module is used to obtain initial data of device alarms;

[0011] A module for determining alarm data to be clustered, used to determine alarm data to be clustered based on initial device alarm data, preset data standardization rules, and ATT&CK technology;

[0012] The alarm data clustering module is used to extract attack features and aggregate single-device alarms for the clustered alarm data to generate single-device alarm clustering data, and to merge non-homologous alarms for the clustered alarm data to generate multi-device alarm clustering data.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm noise reduction method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm noise reduction method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains the initial data of the device alarm, and then determines the alarm data to be clustered according to the initial data of the device alarm, the preset data standardization rules and the ATT&CK technology, and then extracts the attack characteristics and aggregates the single device alarm to the clustered alarm data to generate the single device alarm cluster data, and merges the non-homologous alarms to the clustered alarm data to generate the multi-device alarm cluster data. In this solution, the preset data standardization rules can standardize the initial data of the device alarm, enhance the consistency of the data and improve the analysis accuracy of the data, and provide a reliable data basis for the application of the ATT&CK technology, so as to effectively give play to the tactical and technical analysis advantages of the ATT&CK technology for security incidents, so as to obtain the alarm data to be clustered with more analysis value and analysis quality, and then sort out and merge the alarm information of single device and multiple devices for the clustered alarm data from the security device level, greatly reducing the number of alarms and reducing the false alarm rate, solving the problems of poor alarm quality and high false alarm rate in the current alarm aggregation method, and effectively reducing the noise of the alarm data, improving the alarm quality, and reducing the false alarm rate.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A flowchart of an alarm noise reduction method provided in Embodiment 1 of the present invention;

[0022] Figure 2 A flowchart of an alarm noise reduction method provided in Embodiment 2 of the present invention;

[0023] Figure 3 A schematic diagram of the structure of an alarm noise reduction device provided in Embodiment 3 of the present invention;

[0024] Figure 4 A schematic diagram of the structure of an electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "initial", "target", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1 This is a flowchart of an alarm noise reduction method provided in the first embodiment of the present invention. This embodiment is applicable to the case of high-quality noise reduction of alarm information. The method can be executed by an alarm noise reduction device. The alarm noise reduction device can be implemented in the form of hardware and / or software. The alarm noise reduction device can be configured in an electronic device. The electronic device can include but is not limited to a server, or a computer, etc. Figure 1 As shown, the method includes:

[0029] Step 110: Obtain initial device alarm data.

[0030] The device alarm initial data may be alarm information of a safety device.

[0031] In the embodiment of the present invention, alarm information of security devices communicating with the network may be collected, so that the collected alarm information is used as initial data of device alarms.

[0032] Step 120: Determine the alarm data to be clustered based on the device alarm initial data, preset data standardization rules, and ATT&CK technology.

[0033] Among them, the preset data standardization rules may be a pre-set data standardization processing method. The preset data standardization rules may include but are not limited to field standardization and security event standardization. Exemplarily, the preset data standardization rules can be used to standardize the security events corresponding to the device alarm initial data, and can also standardize the fields in the device alarm initial data. The alarm data to be clustered may be the processing result of the device alarm initial data based on the preset data standardization rules and ATT&CK (Adversarial Tactics Techniques and Common Knowledge) technology. The alarm data to be clustered may include but are not limited to the security event type and timestamp of the alarm security device.

[0034] In an embodiment of the present invention, data standardization processing can be performed on the initial data of the device alarm based on preset data standardization rules, and the data processing results can be analyzed using ATT&CK technology to obtain the alarm data to be clustered.

[0035] Step 130: extract attack features and aggregate single-device alarms on the clustered alarm data to generate single-device alarm cluster data, and merge non-homologous alarms on the clustered alarm data to generate multi-device alarm cluster data.

[0036] Among them, attack feature extraction can be a feature extraction operation for attack behaviors in security events. Single-device alarm aggregation processing can be a merging operation of alarm information of the same device from a time dimension, which is used to vertically merge multiple similar or identical alarm information from a time dimension. Single-device alarm clustering data can be an aggregation result describing multiple alarm data of a single security device for a single security event, that is, an aggregate alarm obtained by vertically merging multiple similar or identical alarm information from a time dimension for a single security device. Non-homologous alarm merging processing can be a merging operation of alarm information of non-homologous security devices. Exemplarily, non-homologous alarm merging processing can include but is not limited to merging alarm information of non-homologous security devices for the same security event, the same attack IP address, and / or the same attack method. Multi-device alarm clustering data can be the aggregation result of alarm information of non-homologous devices. Exemplarily, multi-device alarm clustering data can include but is not limited to merging alarm information of non-homologous security devices attacked by the same security event to obtain an aggregate alarm.

[0037] In an embodiment of the present invention, attack features can be extracted from the alarm data to be clustered, thereby performing single-device alarm aggregation processing on the extracted attack features of each security device to obtain single-device alarm clustering data. Non-homologous alarms (i.e., alarms issued by different security devices) can also be parsed from the alarm data to be clustered, and non-homologous alarms can be merged to obtain multi-device alarm clustering data.

[0038] The technical solution of the embodiment of the present invention obtains the initial data of the device alarm, and then determines the alarm data to be clustered according to the initial data of the device alarm, the preset data standardization rules and the ATT&CK technology, and then extracts the attack characteristics and aggregates the single device alarm to the clustered alarm data to generate the single device alarm cluster data, and merges the non-homologous alarms to the clustered alarm data to generate the multi-device alarm cluster data. In this solution, the preset data standardization rules can standardize the initial data of the device alarm, enhance the consistency of the data and improve the analysis accuracy of the data, and provide a reliable data basis for the application of the ATT&CK technology, so as to effectively give play to the tactical and technical analysis advantages of the ATT&CK technology for security incidents, so as to obtain the alarm data to be clustered with more analysis value and analysis quality, and then sort out and merge the alarm information of single device and multiple devices for the clustered alarm data from the security device level, greatly reducing the number of alarms and reducing the false alarm rate, solving the problems of poor alarm quality and high false alarm rate in the current alarm aggregation method, and effectively reducing the noise of the alarm data, improving the alarm quality, and reducing the false alarm rate.

[0039] Embodiment 2

[0040] Figure 2 This is a flowchart of an alarm noise reduction method provided in the second embodiment of the present invention. This embodiment is specific based on the above embodiment and provides a specific optional implementation method for extracting attack features from clustered alarm data and aggregating single device alarms to generate single device alarm cluster data. Figure 2 As shown, the method includes:

[0041] Step 210: Obtain initial device alarm data.

[0042] Step 220: Determine the alarm data to be clustered based on the device alarm initial data, preset data standardization rules, and ATT&CK technology.

[0043] In an optional embodiment of the present invention, determining the alarm data to be clustered based on the device alarm initial data, preset data standardization rules and ATT&CK technology can include: processing the device alarm initial data according to the preset data standardization rules to determine the alarm data to be mapped and the alarm field enrichment data; based on the ATT&CK technology, performing tactical and technical mapping on the alarm data to be mapped to obtain security event mapping data; using the security event mapping data and the alarm field enrichment data as the alarm data to be clustered.

[0044] The alarm data to be mapped may be data mapped with the ATT&CK technology after processing the initial device alarm data based on the preset data standardization rules. The alarm field enriched data may be data obtained by enriching the field standard of the initial device alarm data based on the preset data standardization rules. The security event mapping data may be used to describe the security events corresponding to the alarm data to be mapped and the ATT&CK technology.

[0045] In an embodiment of the present invention, the initial device alarm data can be used to identify and standardize security events using preset data standardization rules to obtain alarm data to be mapped, and the initial device alarm data can be enriched with field standards using preset data standardization rules to obtain alarm field enriched data. After obtaining the alarm data to be mapped and the alarm field enriched data, the alarm data to be mapped is mapped one-to-one with the tactics and techniques in the ATT&CK technology to obtain security event mapping data, that is, to achieve standardization and classification of security events, and then the security event mapping data and the alarm field enriched data are used as alarm data to be clustered.

[0046] In an optional embodiment of the present invention, data processing is performed on the initial data of the device alarm according to preset data standardization rules to determine the alarm data to be mapped and the alarm field enrichment data, which may include: based on the standardized security event definition in the preset data standardization rules, performing security event standardization processing on the initial data of the device alarm to obtain the alarm data to be mapped; based on the field standardization definition in the preset data standardization rules, performing field standardization processing on the initial data of the device alarm to obtain the alarm field enrichment data.

[0047] The standardized security event definition may be a standardized definition of security events in a preset data standardization rule. The field standardized definition may be a standardized definition of an alarm field in a preset data standardization rule. The standardized security event definition and the field standardized definition may be set according to user needs.

[0048] In an embodiment of the present invention, the standardized security event definition in the preset data standardization rules can be used to perform security event standardization processing on the security events corresponding to the device alarm initial data to obtain the alarm data to be mapped, and parse the fields in the device alarm initial data, and then perform field standardization processing on the fields based on the field standardization definition in the preset data standardization rules to obtain alarm field enriched data.

[0049] In an optional embodiment of the present invention, based on the field standardization definition in the preset data standardization rules, field standardization processing is performed on the initial data of the device alarm to obtain alarm field enriched data, which may include: based on the field standardization definition, field parsing and mapping and field enrichment are performed on the initial data of the device alarm to obtain alarm field enriched data.

[0050] The field parsing mapping may be used to perform parameter mapping on the fields parsed from the initial data of the device alarm. Exemplarily, the field parsing mapping may include but is not limited to mapping of parameters such as attack type and timestamp. Field enrichment may be used to complete the fields.

[0051] In an embodiment of the present invention, based on the field standardization definition, the initial data of the device alarm can be firstly parsed and mapped, and then the field of the safety device alarm type field can be enriched, so that the mapped fields and the enriched fields are used as alarm field enriched data.

[0052] In an optional embodiment of the present invention, after the security event mapping data and the alarm field enriched data are used as the alarm data to be clustered, it can also include: obtaining security event alarm rules and association analysis rules; generating security event alarm data based on the security event alarm rules and the security event mapping data, and generating attack reconstruction data based on the association analysis rules and the alarm field enriched data.

[0053] Among them, the security event alarm rule may be an alarm rule that triggers an alarm based on the type of security event. The security event alarm data may be the alarm data generated when the security event mapping data satisfies the security event alarm rule. The security event alarm data may be used to directly alarm when the security event type corresponding to the security event mapping data is the same as the security event type to be screened by the security event alarm rule. The security event types to be screened by the security event alarm rule may be set by the user. The association analysis rule may be used to perform association analysis on the alarm information of different security devices using the field as the analysis unit. Exemplarily, the association analysis rule may be executed by flink (distributed stream processing engine) and a neural network model. The attack reconstruction data may be the result of an association analysis of the alarm field enriched data based on the association analysis rule, which is used to reconstruct the intrusion scenario.

[0054] In an embodiment of the present invention, security event alarm rules and association analysis rules set based on user needs can be obtained, so that when it is determined based on the security event alarm rules that the security event type corresponding to the security event mapping data needs to be alarmed, security event alarm data can be generated to directly alarm the security event corresponding to the security event mapping data. The alarm field enriched data can also be associated and analyzed through the association analysis rules to obtain attack reconstruction data, so as to deeply analyze the attacker's true intentions and intrusion paths through the attack reconstruction data.

[0055] For example, based on the user's usage effect, the security event alarm rules, correlation analysis rules, single-device alarm aggregation processing rules, and non-homologous alarm merging processing rules can be timely optimized to continuously adapt to the ever-changing security threat environment.

[0056] Step 230: extract attack features from the alarm data to be clustered to obtain features to be clustered.

[0057] The features to be clustered may be attack features possessed by the security events corresponding to the alarm data to be clustered.

[0058] In the embodiment of the present invention, the attack features of the alarm data to be clustered may be extracted, and then the extracted attack features may be used as the features to be clustered.

[0059] Step 240: Perform single device alarm aggregation processing on the clustered alarm data according to the similarity of the features to be clustered of the same security device to obtain single device alarm cluster data, and perform non-homologous alarm merging processing on the clustered alarm data to generate multi-device alarm cluster data.

[0060] In an embodiment of the present invention, the similarity between the features to be clustered of the same security device can be determined. When there are multiple attack features with similarities greater than a set similarity threshold in the features to be clustered of a single security device, the alarm data corresponding to similar or identical attack features in the alarm data to be clustered of the single security device are clustered to obtain single-device alarm clustering data, and non-homologous alarm merging processing is performed on the clustered alarm data to generate multi-device alarm clustering data, so as to achieve mutual complementation and verification of alarms from different sources in the horizontal spatial dimension, thereby locating alarms with advanced threats.

[0061] In an optional embodiment of the present invention, non-homologous alarm merging processing is performed on the clustered alarm data to generate multi-device alarm clustering data, which may include: parsing the alarm data to be clustered to determine the target alarm generating device with the same alarm; generating multi-device alarm clustering data based on the target alarm generating device and the device alarm initial data.

[0062] The target alarm generating device may be a non-homologous security device having the same alarm.

[0063] In an embodiment of the present invention, the clustered alarm data can be analyzed to determine the existence of non-homologous security devices with the same alarm, and the determined non-homologous security devices can be used as target alarm generating devices, and then the device alarm initial data associated with the target alarm generating device can be merged to obtain multi-device alarm clustering data.

[0064] This solution can analyze the correlation of multiple parameters such as IP address, attack type, and timestamp by sorting out the mapping relationship of security events and normalizing the alarm information, thus realizing the comprehensive standardization and classification of alarm information, and can more accurately identify and distinguish different security events, avoiding the neglect of attack diversity and complexity caused by relying solely on IP address aggregation. It can analyze the alarm information in depth from multiple dimensions, reconstruct the attack scenario, reveal the attacker's true intention and intrusion path, significantly improve the alarm quality, reduce the false alarm rate, and provide the operation and maintenance team with richer contextual information, so as to more effectively deal with network threats.

[0065] It has been verified that by setting different attack scenarios, this solution can correctly map the initial data of device alarms to the tactics and techniques in the ATT&CK framework, and the preset data normalization rules can effectively improve the quality of alarm data. After simulating multiple attack modes (DDoS attacks, SQL injections, phishing attacks, etc.), it was verified that the association analysis rules of this solution can effectively reconstruct attack scenarios, and the aggregation processing of single-device alarms and the merging processing of non-homologous alarms can significantly reduce the number of alarms while maintaining the accuracy of threat detection. In summary, this solution can improve security operation efficiency, reduce alarm fatigue, and help the operation and maintenance team identify and respond to real network threats more quickly when used in practice. Play a positive role in actual network security operations.

[0066] The technical solution of the embodiment of the present invention obtains the initial data of the device alarm, and then determines the alarm data to be clustered according to the initial data of the device alarm, preset data standardization rules and ATT&CK technology, and then extracts attack features from the clustered alarm data to obtain the features to be clustered, and further performs single-device alarm aggregation processing on the clustered alarm data according to the similarity of the features to be clustered of the same security device to obtain single-device alarm clustering data, and performs non-homologous alarm merging processing on the clustered alarm data to generate multi-device alarm clustering data. In this solution, the preset data standardization rules can standardize the initial data of device alarms, enhance data consistency and improve data analysis accuracy, provide a reliable data basis for the application of ATT&CK technology, and effectively give play to the tactical and technical analysis advantages of ATT&CK technology for security incidents, so as to obtain clustered alarm data with higher analysis value and analysis quality, and then sort out and merge the alarm information of single device and multiple devices from the security device level to treat the clustered alarm data, greatly reduce the number of alarms, and reduce the false alarm rate, solve the problems of poor alarm quality and high false alarm rate in the current alarm aggregation method, and can effectively reduce the noise of alarm data, improve the alarm quality, and reduce the false alarm rate.

[0067] Embodiment 3

[0068] Figure 3 This is a schematic diagram of the structure of an alarm noise reduction device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0069] The data acquisition module 310 is used to acquire the initial data of the device alarm;

[0070] The module 320 for determining the alarm data to be clustered is used to determine the alarm data to be clustered according to the initial data of the device alarm, the preset data standardization rules and the ATT&CK technology;

[0071] The alarm data clustering module 330 is used to extract attack features and aggregate single-device alarms on the clustered alarm data to generate single-device alarm clustering data, and to merge non-homologous alarms on the clustered alarm data to generate multi-device alarm clustering data.

[0072] The technical solution of the embodiment of the present invention obtains the initial data of the device alarm, and then determines the alarm data to be clustered according to the initial data of the device alarm, the preset data standardization rules and the ATT&CK technology, and then extracts the attack characteristics and aggregates the single device alarm to the clustered alarm data to generate the single device alarm cluster data, and merges the non-homologous alarms to the clustered alarm data to generate the multi-device alarm cluster data. In this solution, the preset data standardization rules can standardize the initial data of the device alarm, enhance the consistency of the data and improve the analysis accuracy of the data, and provide a reliable data basis for the application of the ATT&CK technology, so as to effectively give play to the tactical and technical analysis advantages of the ATT&CK technology for security incidents, so as to obtain the alarm data to be clustered with more analysis value and analysis quality, and then sort out and merge the alarm information of single device and multiple devices for the clustered alarm data from the security device level, greatly reducing the number of alarms and reducing the false alarm rate, solving the problems of poor alarm quality and high false alarm rate in the current alarm aggregation method, and effectively reducing the noise of the alarm data, improving the alarm quality, and reducing the false alarm rate.

[0073] Optionally, the module 320 for determining the alarm data to be clustered includes a data processing unit, a tactical and technical mapping unit, and a data combination unit. The data processing unit is used to perform data processing on the device alarm initial data according to the preset data standardization rule to determine the alarm data to be mapped and the alarm field enrichment data. The tactical and technical mapping unit is used to perform tactical and technical mapping on the alarm data to be mapped based on the ATT&CK technology to obtain security event mapping data. The data combination unit is used to use the security event mapping data and the alarm field enrichment data as the alarm data to be clustered.

[0074] Optionally, a data processing unit is used to perform security event standardization processing on the initial data of the device alarm based on the standardized security event definition in the preset data standardization rules to obtain the alarm data to be mapped; and perform field standardization processing on the initial data of the device alarm based on the field standardization definition in the preset data standardization rules to obtain the alarm field enriched data.

[0075] Optionally, a data processing unit is used to perform field parsing mapping and field enrichment on the device alarm initial data based on the field standardization definition to obtain the alarm field enriched data.

[0076] Optionally, the alarm noise reduction device also includes an alarm data processing module to be clustered, which is used to obtain security event alarm rules and association analysis rules; generate security event alarm data based on the security event alarm rules and the security event mapping data, and generate attack reconstruction data based on the association analysis rules and the alarm field enrichment data.

[0077] Optionally, the alarm data clustering module 330 is used to extract attack features from the alarm data to be clustered to obtain features to be clustered; and perform single device alarm aggregation processing on the alarm data to be clustered according to the similarity of the features to be clustered of the same security device to obtain the single device alarm clustering data.

[0078] The alarm noise reduction device provided in the embodiment of the present invention can execute the alarm noise reduction method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0079] Embodiment 4

[0080] Figure 4 A schematic diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0081] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0082] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0083] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the alarm noise reduction method.

[0084] In some embodiments, the alarm noise reduction method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the alarm noise reduction method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the alarm noise reduction method in any other appropriate manner (e.g., by means of firmware).

[0085] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0086] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0087] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0088] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0089] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0090] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0091] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0092] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for reducing alarm noise, characterized in that: include: Get the initial data of device alarm; Determine the alarm data to be clustered according to the device alarm initial data, preset data standardization rules and ATT&CK technology; The alarm data to be clustered are subjected to attack feature extraction and single-device alarm aggregation processing to generate single-device alarm clustering data, and the alarm data to be clustered are subjected to non-homologous alarm merging processing to generate multi-device alarm clustering data.

2. The method according to claim 1, characterized in that: Determining the alarm data to be clustered according to the device alarm initial data, preset data standardization rules and ATT&CK technology includes: Processing the initial device alarm data according to the preset data standardization rule to determine the alarm data to be mapped and the alarm field enrichment data; Based on the ATT&CK technology, tactical and technical mapping is performed on the alarm data to be mapped to obtain security event mapping data; The security event mapping data and the alarm field enriched data are used as the alarm data to be clustered.

3. The method according to claim 2, characterized in that The performing data processing on the device alarm initial data according to the preset data standardization rule to determine the alarm data to be mapped and the alarm field enrichment data includes: Based on the standardized security event definition in the preset data standardization rule, the device alarm initial data is subjected to security event standardization processing to obtain the alarm data to be mapped; Based on the field standardization definition in the preset data standardization rule, the field standardization processing is performed on the device alarm initial data to obtain the alarm field enriched data.

4. The method according to claim 3, characterized in that The performing field standardization processing on the device alarm initial data based on the field standardization definition in the preset data standardization rule to obtain the alarm field enriched data includes: Based on the field standardization definition, field parsing mapping and field enrichment are performed on the device alarm initial data to obtain the alarm field enriched data.

5. The method according to claim 2, characterized in that: After the security event mapping data and the alarm field enriched data are used as the alarm data to be clustered, the method further includes: Obtain security event alarm rules and correlation analysis rules; Based on the security event alarm rule and the security event mapping data, security event alarm data is generated, and according to the association analysis rule and the alarm field enrichment data, attack reconstruction data is generated.

6. The method according to claim 1, characterized in that The extracting attack features and aggregating single-device alarms on the alarm data to be clustered to generate single-device alarm clustering data includes: Extracting attack features from the alarm data to be clustered to obtain features to be clustered; According to the similarity of the features to be clustered of the same safety device, single device alarm aggregation processing is performed on the alarm data to be clustered to obtain the single device alarm cluster data.

7. The method according to claim 1, characterized in that The performing non-homologous alarm merging processing on the alarm data to be clustered to generate multi-device alarm clustering data includes: Analyzing the alarm data to be clustered to determine the target alarm generating device having the same alarm; The multi-device alarm clustering data is generated according to the target alarm generating device and the device alarm initial data.

8. An alarm noise reduction device, characterized in that: include: A data acquisition module is used to obtain initial data of device alarms; A module for determining alarm data to be clustered, used to determine the alarm data to be clustered according to the device alarm initial data, preset data standardization rules and ATT&CK technology; The alarm data clustering module is used to extract attack features and aggregate single-device alarms on the alarm data to be clustered to generate single-device alarm clustering data, and to merge non-homologous alarms on the alarm data to be clustered to generate multi-device alarm clustering data.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm noise reduction method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm noise reduction method according to any one of claims 1 to 7 when executed.

Images