Alarm event false alarm identification method and device, equipment and medium

Abstract

The invention discloses an alarm event false alarm identification method and device, equipment and a medium, and the method comprises the steps: collecting alarm data of a to-be-detected alarm event, the alarm data comprises target security log data and a target image, the target image is used for representing the data size condition of the security log data of which the generation time is within a set time length, and the target image is used for representing the data size condition of the security log data of which the generation time is within the set time length; the generation time of the target security log data is within the set duration; and inputting the alarm data into a trained alarm event identification model to obtain a false alarm identification result of the to-be-detected alarm event, the false alarm identification result being used for representing whether the to-be-detected alarm event is a false alarm. The method can improve the accuracy of false alarm identification of the alarm event.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing, and in particular to a method, device, equipment and medium for identifying false alarms of alarm events. Background Art

[0002] With the rapid development of information technology, the core infrastructure of all industries is facing increasingly serious security threats. Therefore, network security has become an important issue that needs to be urgently addressed in all industries.

[0003] Existing alarm systems usually detect alarm events based on preset rules or static models, and lack dynamic adaptability. When faced with new threat forms or complex attack patterns, the alarm system reacts slowly and it is difficult to adjust strategies in time, resulting in high false alarm rates or missed alarms. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, device and medium for identifying false alarms of alarm events, so as to improve the accuracy of identifying false alarms of alarm events.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying false alarms of alarm events, comprising:

[0006] Collect alarm data of the alarm event to be tested, wherein the alarm data includes target security log data and a target image, the target image is used to characterize the data volume of the security log data whose generation time is within a set time period, and the generation time of the target security log data is within the set time period;

[0007] The alarm data is input into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, wherein the false alarm recognition result is used to indicate whether the alarm event to be tested is a false alarm.

[0008] In an embodiment of the present application, the target security log data and target image of the alarm event to be tested are input into the trained alarm event recognition model for processing to obtain a false alarm recognition result that characterizes whether the alarm event to be tested is a false alarm, wherein the target image is used to characterize the data volume of the security log data whose generation time is within the set time length, and the generation time of the target security log data is within the set time length. The present application can improve the accuracy and efficiency of false alarm recognition of alarm events, and perform better when dealing with complex security scenarios.

[0009] In a possible design, inputting the alarm data into a trained alarm event recognition model to obtain a false alarm rate of the alarm event to be tested includes:

[0010] Inputting the target security log data into the first feature extraction layer of the alarm event recognition model, and extracting first feature information of the target security log data through the first feature extraction layer; and inputting the target image into the second feature extraction layer of the alarm event recognition model, and extracting second feature information of the target image through the second feature extraction layer;

[0011] The first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to determine the false alarm recognition result of the alarm event to be detected.

[0012] In an embodiment of the present application, the first feature information of the target security log data is extracted by the first feature extraction layer of the alarm event recognition model, the second feature information of the target image is extracted by the second feature extraction layer of the alarm event recognition model, the first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to determine the false alarm recognition result of the alarm event to be tested, thereby improving the accuracy of the false alarm recognition result of the determined alarm event to be tested.

[0013] In a possible design, the target image is determined by the following method:

[0014] Acquire multiple security log data within a set time period, wherein the multiple security log data include the target security log data, and the set time period includes multiple sub-time periods;

[0015] Determine the amount of security log data in each sub-time period based on the sub-time period to which the generation time of each security log data belongs;

[0016] The target image is determined based on the data volume of the security log data in each sub-time period.

[0017] In an embodiment of the present application, multiple security log data including target security log data within a set time period are obtained, and based on the sub-time period to which the generation time of each security log data belongs, the data volume of the security log data in each sub-time period is determined, and based on the data volume of the security log data in each sub-time period, the target image is determined, thereby more accurately characterizing the data volume of the security log data with a generation time within the set time period.

[0018] In a possible design, inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes:

[0019] The alarm data is input into a trained alarm event recognition model to obtain the false alarm recognition result indicating that the alarm event to be tested is not a false alarm, and processing suggestion information for the alarm event to be tested.

[0020] In an embodiment of the present application, by inputting the alarm data into a trained alarm event recognition model, a false alarm recognition result characterizing that the alarm event to be tested is not a false alarm can be directly obtained, as well as processing suggestion information for the alarm event to be tested, so that the user can perform corresponding processing according to the processing suggestion information of the alarm event to be tested, thereby improving the processing efficiency of the alarm event to be tested and improving the user experience.

[0021] In a possible design, inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes:

[0022] Inputting the alarm data into a trained alarm event recognition model to obtain a false alarm rate of the alarm event to be tested;

[0023] The false alarm rate is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, a false alarm identification result of the alarm event to be tested is obtained.

[0024] In an embodiment of the present application, the alarm data is input into a trained alarm event recognition model to obtain the false alarm rate of the alarm event to be tested, so as to characterize the probability that the alarm event to be tested is a false alarm. In addition, the present application compares the false alarm rate with a set probability threshold to obtain a comparison result. Based on the comparison result, a false alarm recognition result of the alarm event to be tested is obtained, thereby improving the accuracy and efficiency of false alarm recognition of alarm events.

[0025] In a possible design, obtaining a false alarm identification result of the alarm event to be tested based on the comparison result includes:

[0026] If the comparison result indicates that the false alarm rate is greater than or equal to the set probability threshold, the false alarm identification result indicating that the alarm event to be tested is a false alarm is obtained;

[0027] If the comparison result indicates that the false alarm rate is less than the set probability threshold, the false alarm identification result indicating that the alarm event to be detected is not a false alarm is obtained.

[0028] In the embodiment of the present application, based on the false alarm rate and the set probability threshold, it is determined whether the alarm event to be tested is a false alarm, so as to more accurately identify whether the alarm event is a false alarm.

[0029] In a possible design, after obtaining the false alarm identification result indicating that the alarm event to be tested is not a false alarm, the method further includes:

[0030] The alarm data is input into the trained question-answering model to obtain processing suggestion information for the alarm event to be tested.

[0031] In an embodiment of the present application, after determining that the alarm event to be tested is not a false alarm, the alarm data is input into the trained question-answering model to determine the processing suggestion information for the alarm event to be tested, so that the user can perform corresponding processing according to the processing suggestion information of the alarm event to be tested, thereby improving the processing efficiency of the alarm event to be tested and improving the user experience.

[0032] In a possible design, the target security log data is obtained by the following method:

[0033] Collect multiple pieces of original security log data;

[0034] For each piece of original security log data, data formatting is performed on the original security log data to obtain first security log data, and data cleaning is performed on the first security log data to obtain second security log data;

[0035] Noise reduction processing is performed on the plurality of second security log data to obtain a plurality of processed second security log data, and each processed second security log data is used as the target security log data.

[0036] In an embodiment of the present application, data formatting is performed on original security log data to obtain first security log data, and data cleaning is performed on the first security log data to obtain second security log data, noise reduction is performed on multiple second security log data to obtain multiple processed second security log data, and each processed second security log data is used as target security log data, thereby improving the accuracy of the target security log data.

[0037] In a possible design, after obtaining the first security log data, the method further includes:

[0038] Determine a first ID based on the partition ID number ID, generation time and offset of the original security log data;

[0039] Using the first id as the primary key value of the first security log data, and saving the primary key values ​​of the first security log data and the first security log warning data;

[0040] After obtaining the second security log data, the method further includes:

[0041] Generate a second ID for the second security log data using a globally unique ID generation algorithm;

[0042] The second ID is used as the primary key value of the second security log data, and the second security log data and the primary key value of the second security log data are saved.

[0043] In an embodiment of the present application, after obtaining the first security log data, the first id is determined based on the partition id, generation time and offset of the original security log data, the first security log data and the first id as the primary key value of the first security log alarm data are saved, and after obtaining the second security log data, the second id of the second security log data is generated using a globally unique id generation algorithm, the second security log data and the second id as the primary key value of the second security log data are saved, thereby ensuring that each security log data can be uniquely traced back to its source, avoiding data loss or duplication, and at the same time ensuring that data is stored by layer using a unique id to achieve storage uniqueness, thereby improving the integrity and reliability of the security log data, making the analysis and handling of alarm events more targeted and accurate.

[0044] In a second aspect, an embodiment of the present application provides a device for identifying false alarms of alarm events, including:

[0045] A collection module, used for collecting alarm data of the alarm event to be tested, wherein the alarm data includes target security log data and a target image, the target image is used to characterize the data volume of the security log data whose generation time is within a set time period, and the generation time of the target security log data is within the set time period;

[0046] The processing module is used to input the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, wherein the false alarm recognition result is used to indicate whether the alarm event to be tested is a false alarm.

[0047] In a third aspect, the present application provides an electronic device, including:

[0048] A memory for storing program instructions;

[0049] The processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods in the first aspect according to the obtained program instructions.

[0050] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes any one of the methods described in the first aspect.

[0051] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0052] The technical effects brought about by the second to fifth aspects and any one of their designs can refer to the technical effects brought about by the corresponding designs in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0054] Figure 2 A flowchart of a method for identifying false alarms of alarm events provided in an embodiment of the present application;

[0055] Figure 3 A flowchart of a method for determining a target image provided by an embodiment of the present application;

[0056] Figure 4 A schematic diagram of a target image provided in an embodiment of the present application;

[0057] Figure 5 A flowchart of a method for determining target security log data provided by an embodiment of the present application;

[0058] Figure 6 A schematic diagram of a method for determining target security log data provided by an embodiment of the present application;

[0059] Figure 7 A flowchart of a method for obtaining a false alarm identification result of an alarm event to be tested provided in an embodiment of the present application;

[0060] Figure 8 A detailed flow chart of a method for identifying false alarms of alarm events when an alarm event recognition model is a probability model provided in an embodiment of the present application;

[0061] Fig. 9 A flowchart of a method for obtaining a false alarm rate of an alarm event to be tested provided in an embodiment of the present application;

[0062] Fig.10 A flowchart of a method for training an alarm event recognition model provided in an embodiment of the present application;

[0063] Fig.11 A flowchart of a method for training a question-answering model provided in an embodiment of the present application;

[0064] Fig.12A detailed flow chart of a method for identifying false alarms of alarm events when the alarm event recognition model provided in an embodiment of the present application is a question-answering model;

[0065] Fig.13 A flowchart of another method for training an alarm event recognition model provided in an embodiment of the present application;

[0066] Fig.14 A detailed flow chart of a method for identifying false alarms of alarm events when another alarm event recognition model provided in an embodiment of the present application is a question-answering model;

[0067] Fig.15 A flowchart of another method for training an alarm event recognition model provided in an embodiment of the present application;

[0068] Fig.16 A schematic diagram of the structure of a false alarm identification device for an alarm event provided in an embodiment of the present application;

[0069] Fig.17 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0071] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0072] In the technical solution of this application, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0073] Before introducing a method for identifying false alarms of alarm events provided in an embodiment of the present application, for ease of understanding, the technical background of the embodiment of the present application is first introduced in detail below.

[0074] With the rapid development of information technology, the core infrastructure of all industries is facing increasingly serious security threats. Therefore, network security has become an important issue that needs to be urgently addressed in all industries.

[0075] Existing alarm systems usually detect alarm events based on preset rules or static models, and lack dynamic adaptability. When faced with new threat forms or complex attack patterns, the alarm system reacts slowly and it is difficult to adjust strategies in time, resulting in high false alarm rates or missed alarms.

[0076] In order to solve the above problem, the present invention proposes a method, device, equipment and medium for identifying false alarms of alarm events, so as to improve the accuracy of identifying false alarms of alarm events.

[0077] First reference Figure 1 , which is a schematic diagram of an application scenario of an embodiment of the present disclosure, including a collector 11 and a server 12, wherein the collector 11 and the server 12 are connected to each other through a network, which may be a local area network, a wide area network, etc. The collector 11 may be a convenient device (e.g., a mobile phone, a tablet, a laptop, etc.), or a personal computer (PC, Personal Computer), and the server 12 may be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms. The collector 11 is used to collect the alarm data of the alarm event to be tested, and send it to the server 12, and the server 12 is used to determine whether the alarm event to be tested is a false alarm based on the alarm data of the alarm event to be tested.

[0078] In the embodiment of the present disclosure, as an optional implementation, the server 12 obtains the alarm data of the alarm event to be tested collected by the collector 11, wherein the alarm data includes target security log data and a target image, the target image is used to characterize the data volume of the security log data whose generation time is within the set time period, and the generation time of the target security log data is within the set time period; the alarm data is input into the trained alarm event recognition model to obtain the false alarm recognition result of the alarm event to be tested, wherein the false alarm recognition result is used to characterize whether the alarm event to be tested is a false alarm.

[0079] Reference below Figure 2The flowchart of a method for identifying false alarms of alarm events is shown to illustrate the technical solution provided by the embodiment of the present application:

[0080] Step 201: Collect alarm data of the alarm event to be tested.

[0081] The set duration can be set according to actual conditions, for example, the set duration can be 1 minute. The alarm data includes target security log data and target images. The target image is used to characterize the data volume of security log data generated within the set duration. The generation time of the target security log data is within the set duration. The target image can be a business intelligence (BI) report. A BI report is a reporting tool that integrates internal and external data of an enterprise through data analysis, data mining and data visualization technology to help enterprise managers better understand the enterprise's operating conditions, market trends and competitive situations.

[0082] Figure 3 A flowchart of a method for determining a target image provided by an embodiment of the present application is shown in FIG. Figure 3 As shown, at least the following steps 301-303 are included:

[0083] Step 301, obtaining multiple security log data within a set time period.

[0084] Among them, the multiple security log data include target security log data. For example, if the duration is set to 2 hours and the generation time of the target security log data is 1:00:00, the security log data with the generation time between 0:00:00 and 1:00:00 and the security log data with the generation time between 1:00:00 and 2:00:00 can be obtained. Each security log data includes data such as the generation time, the security network element name, and the alarm event type.

[0085] In the embodiment of the present application, the set duration includes multiple sub-time periods. The number of sub-time periods can be set according to actual conditions. For example, when the set duration is 1 minute, the set duration can be divided into 6 sub-time periods, each of which is 10 seconds.

[0086] Step 302 : determining the data volume of the security log data in each sub-time period based on the sub-time period to which the generation time of each piece of security log data belongs.

[0087] For example, the duration is set to 1 day, and the duration is set to include 4 sub-time periods, namely, sub-time period 1 is 0:00:00-6:00:00, sub-time period 2 is 6:00:00-12:00:00, sub-time period 3 is 12:00:00-18:00:00 and sub-time period 4 is 18:00:00-24:00:00. If the generation time of security log data 1 is 2:00:00, the generation time of security log data 1 belongs to sub-time period 1; if the generation time of security log data 2 is 7:30:20, the generation time of security log data 2 belongs to sub-time period 2; if the generation time of security log data 3 is 12:30:00, the generation time of security log data 3 belongs to sub-time period 3; if the generation time of security log data 4 is 23:59:00, the generation time of security log data 4 belongs to sub-time period 4.

[0088] Step 303: determine the target image based on the data volume of the security log data in each sub-time period.

[0089] Specifically, a target image is determined by making a graph based on the data volume of the security log data in each sub-time period. The target image may be a bar graph, a line graph, or the like.

[0090] For example, Figure 4 A schematic diagram of a target image provided in an embodiment of the present application, such as Figure 4 As shown, the horizontal axis is time, the vertical axis is the data volume of the security log data, the set duration is 1 day, and the set duration includes 4 sub-time periods, sub-time period 1 is 0:00:00-6:00:00, sub-time period 2 is 6:00:00-12:00:00, sub-time period 3 is 12:00:00-18:00:00 and sub-time period 4 is 18:00:00-24:00:00, the data volume of the security log data in the sub-time period 1 is 20, the data volume of the security log data in the sub-time period 2 is 50, the data volume of the security log data in the sub-time period 3 is 80, and the data volume of the security log data in the sub-time period 4 is 40.

[0091] Figure 5 A flowchart of a method for determining target security log data provided by an embodiment of the present application, such as Figure 5 As shown, at least the following steps 501-503 are included:

[0092] Step 501, collecting multiple pieces of original security log data.

[0093] Figure 6 A schematic diagram of a method for determining target security log data provided by an embodiment of the present application, such as Figure 6As shown, the log collector (Rocket-fast system for log, Rsyslog) collects raw security log data from each security network element and transmits the raw security log data to the xxx_origin topic of Kafka (distributed publish-subscribe messaging system). Rsyslog is an open source tool that can be used to accept log data from various sources for conversion and output the results to different destinations. Rsyslog usually uses the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) to forward or receive log data. Kafka is a high-throughput distributed publish-subscribe messaging system that can handle all action stream data of consumers on a website.

[0094] Step 502 , for each piece of original security log data, perform data formatting processing on the original security log data to obtain first security log data, and perform data cleaning on the first security log data to obtain second security log data.

[0095] Among them, data formatting of the original security log data refers to converting the format of the original security log data into a set format. For example, if the font of the alarm event type in the original security log data is traditional Chinese, the original security log data needs to be formatted so that the font of the alarm event type is simplified Chinese. Data cleaning refers to operations such as checking data consistency and processing invalid values ​​and missing values.

[0096] Step 503 , performing noise reduction processing on the plurality of second security log data to obtain a plurality of processed second security log data, and using each processed second security log data as target security log data.

[0097] Data denoising aims to remove noise from data to reveal the true trends and patterns of the data. Common denoising methods include moving average, Fourier transform, Kalman filter, thermal equation processing and equal depth binning.

[0098] Traditional alarm event detection methods usually lack an effective backtracking mechanism and cannot track the source of each security log data. This lack makes it difficult to determine the root cause of the problem after the event occurs, increasing the difficulty of locating and solving the problem. Therefore, in order to solve the above problem, after obtaining the first security log data, the present application also includes: determining the first ID based on the partition identity document (ID), generation time and offset of the original security log data; using the first ID as the primary key value of the first security log data, and saving the primary key value of the first security log data and the first security log alarm data.

[0099] Optionally, determining the first ID based on the partition ID, generation time, and offset of the original security log data includes:

[0100] The partition id, generation time and offset of the original security log data are concatenated by using the set character to determine the first id. The set character can be set according to actual conditions, for example, the set character can be "-".

[0101] For example, the partition id of an original security log data is 00001, the generation time is 2024 / 10 / 10 / 01 / 00 / 00, and the offset is 1000. Therefore, the first id of the original security log data is 00001-2024 / 10 / 10 / 01 / 00 / 00-1000.

[0102] like Figure 6As shown, Rsyslog transfers the original security log data to the xxx_origin topic of Kafka as the topic of the original security log data. The Extract-Transform-Load (ETL) platform consumes the original security log data in the xxx_origin topic, performs data formatting, and obtains the first security log data. After obtaining the first security log data, the first id (messageId) is determined based on the Kafka partition (Partition) id, generation time and offset (Offset) of the original security log data, and the first id is used as the backtracking correspondence of the original security log data consumption, so that each first security log data corresponds to a unique first id, and the consumption uniqueness can be confirmed to the source. The first security log data is input into the xxx_standard topic as the topic of the first security log data. The first id is used as the primary key value of the first security log data, and the primary key values ​​of the first security log data and the first security log alarm data can be saved to the database, or the primary key values ​​of the first security log data and the first security log alarm data can be written to the data storage layer as the operational data source (Operational Data Store, ODS) layer.

[0103] Among them, ETL is used to describe the process of extracting, transforming, and loading data from the source to the destination. In Kafka, a Topic is divided into multiple Partitions. Each piece of data in a Partition is assigned a unique sequence number, namely Offset. The ODS layer is mainly used to save the original data and complete data accumulation.

[0104] In an embodiment of the present application, after obtaining the second security log data, it also includes: generating a second ID of the second security log data using a globally unique ID generation algorithm; using the second ID as the primary key value of the second security log data, and saving the second security log data and the primary key value of the second security log data.

[0105] The globally unique ID generation algorithm may be the Snowflake algorithm, which is a distributed algorithm for generating globally unique IDs. The Snowflake algorithm uses a 64-bit binary number as the ID, which is divided into four parts: a sign bit, a timestamp, a work machine ID, and a serial number. These four parts are used to represent different information, map data to a distributed system with a specific structure, and implement data storage and query.

[0106] like Figure 6As shown, the ETL platform consumes the first security log data in the xxx_standard topic, performs data cleaning, and obtains the second security log data. After obtaining the second security log data, the snowflake algorithm is used to generate the second id (u_uid) of the second security log data, and the second id is used as the backtracking correspondence of the first security log data consumption, so that each second security log data corresponds to a unique second id, and the uniqueness of consumption can be confirmed to the source. The second security log data is input into the xxx_final topic as the topic of the second security log data. The second id is used as the primary key value of the second security log data, and the second security log data and the primary key value of the second security log data can be written to the data storage layer as the data detail (Data Warehouse Detail, DWD) layer. The second security log data and the primary key value of the second security log data can also be saved in the database.

[0107] Among them, the DWD layer usually receives the original data from the data warehouse ODS layer, and performs operations such as cleaning, standardization, dimensionality degradation, and abnormal data elimination for unified processing to provide support for data analysis.

[0108] Step 202: input the alarm data into the trained alarm event recognition model to obtain the false alarm recognition result of the alarm event to be tested.

[0109] Figure 7 A flowchart of a method for obtaining a false alarm identification result of an alarm event to be tested provided in an embodiment of the present application, such as Figure 7 As shown, the above step 202 at least includes the following steps 701-702:

[0110] Step 701, inputting target security log data into a first feature extraction layer of an alarm event recognition model, extracting first feature information of the target security log data through the first feature extraction layer, and inputting a target image into a second feature extraction layer of the alarm event recognition model, extracting second feature information of the target image through the second feature extraction layer;

[0111] Step 702: The first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to determine the false alarm recognition result of the alarm event to be detected.

[0112] Specifically, the target security log data is input into the text encoder of the alarm event recognition model for feature extraction to obtain the first feature information; the target image is input into the image encoder of the alarm event recognition model for feature extraction to obtain the second feature information; the first feature information and the second feature information are input into the fusion module of the alarm event recognition model for fusion to obtain the fused feature information; the fused feature information is input into the recognition module of the alarm event recognition model to obtain the false alarm recognition result of the alarm event to be tested.

[0113] Among them, the false alarm recognition result is used to characterize whether the alarm event to be tested is a false alarm. The alarm event recognition model can be a probabilistic model, which can be pre-trained by a machine learning method (such as a supervised learning method). The basic model used to train the alarm event recognition model, that is, the preset alarm event recognition model, can be various models with recognition functions, such as a convolutional neural network model, a neural network model, etc. The alarm event recognition model can also be a question-and-answer model, which can be pre-trained by a machine learning method (such as a supervised learning method). The basic model used to train the alarm event recognition model, that is, the preset alarm event recognition model, can be various models with question-and-answer functions, such as a convolutional neural network model, a neural network model, etc.

[0114] Optionally, if the alarm event recognition model is a probability model, the alarm data is input into the trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, including:

[0115] Input the alarm data into the trained alarm event recognition model to obtain the false alarm rate of the alarm event to be tested;

[0116] The false alarm rate is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, a false alarm identification result of the alarm event to be tested is obtained.

[0117] The probability threshold may be set according to actual conditions. For example, the probability threshold may be set to 0.8.

[0118] Optionally, based on the comparison result, a false alarm identification result of the alarm event to be tested is obtained, including:

[0119] If the comparison result indicates that the false alarm rate is greater than or equal to the set probability threshold, a false alarm identification result indicating that the alarm event to be tested is a false alarm is obtained;

[0120] If the comparison result indicates that the false alarm rate is less than the set probability threshold, a false alarm identification result indicating that the alarm event to be tested is not a false alarm is obtained.

[0121] Taking the probability threshold of 0.8 as an example, if the false alarm rate of alarm event 1 is 0.9, the false alarm rate of alarm event 1 is greater than the set probability threshold, and therefore, alarm event 1 is determined to be a false alarm; if the false alarm rate of alarm event 2 is 0.3, the false alarm rate of alarm event 2 is less than the set probability threshold, and therefore, alarm event 2 is determined to be a non-false alarm.

[0122] Optionally, if the alarm event recognition model is a question-answering model, the alarm data is input into the trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, including:

[0123] Input the alarm data into the trained alarm event recognition model to obtain a false alarm recognition result indicating that the alarm event to be tested is not a false alarm;

[0124] The alarm data is input into the trained alarm event recognition model to obtain a false alarm recognition result indicating that the alarm event to be tested is a false alarm.

[0125] Optionally, if the alarm event recognition model is a question-answering model, the alarm data is input into the trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, including:

[0126] Input the alarm data into the trained alarm event recognition model to obtain a false alarm recognition result indicating that the alarm event to be tested is not a false alarm, as well as processing suggestion information for the alarm event to be tested;

[0127] The alarm data is input into the trained alarm event recognition model to obtain a false alarm recognition result indicating that the alarm event to be tested is a false alarm.

[0128] In an embodiment of the present application, the target security log data and target image of the alarm event to be tested are input into the trained alarm event recognition model for processing to obtain a false alarm recognition result that characterizes whether the alarm event to be tested is a false alarm, wherein the target image is used to characterize the data volume of the security log data whose generation time is within the set time length, and the generation time of the target security log data is within the set time length. The present application can improve the accuracy and efficiency of false alarm recognition of alarm events, and perform better when dealing with complex security scenarios.

[0129] Based on the different alarm event recognition models, the alarm event false alarm recognition method is also different. Therefore, the specific steps of the alarm event false alarm recognition method when the alarm event recognition model provided above is a probability model are described in detail, such as Figure 8 As shown:

[0130] Step 801: Collect alarm data of the alarm event to be tested.

[0131] Step 802: input the alarm data into the trained alarm event recognition model to obtain the false alarm rate of the alarm event to be tested.

[0132] Fig. 9 A flowchart of a method for obtaining a false alarm rate of an alarm event to be tested provided in an embodiment of the present application, such as Fig. 9 As shown, the above step 802 at least includes the following steps 901-902:

[0133] Step 901, input the target security log data into the first feature extraction layer of the alarm event recognition model, extract the first feature information of the target security log data through the first feature extraction layer, and input the target image into the second feature extraction layer of the alarm event recognition model, and extract the second feature information of the target image through the second feature extraction layer.

[0134] Step 902: The first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to determine the false alarm rate of the alarm event to be detected.

[0135] Specifically, the first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model, so as to map the fused feature information to the range of 0 to 1 using an activation function (Sigmoid), thereby obtaining the false alarm rate of the alarm event to be tested.

[0136] In an embodiment of the present application, the target security log data is input into the text encoder of the alarm event recognition model for feature extraction to obtain first feature information; the target image is input into the image encoder of the alarm event recognition model for feature extraction to obtain second feature information; the first feature information and the second feature information are input into the fusion module of the alarm event recognition model for fusion to obtain fused feature information; the fused feature information is input into the recognition module of the alarm event recognition model to generate the false alarm rate of the alarm event to be tested.

[0137] in, Fig.10 A flowchart of a method for training an alarm event recognition model provided in an embodiment of the present application, such as Fig.10 As shown, at least the following steps 101-103 are included:

[0138] Step 101: Obtain a first training data set.

[0139] The first training data set includes a plurality of first historical alarm data, each of which includes historical security log data, historical images and a first label of a historical alarm event, and the first label is used to characterize whether the historical alarm event is a false alarm. For example, if the historical alarm event is a false alarm, the first label of the historical alarm event is 1, and if the historical alarm event is not a false alarm, the first label of the historical alarm event is 0.

[0140] Step 102, input each first historical alarm data in the first training data set into a preset alarm event recognition model respectively, process it using the preset alarm event recognition model, and output the first label of the first historical alarm data as a target to train the preset alarm event recognition model.

[0141] Step 103, until the preset alarm event recognition model converges, an alarm event recognition model is obtained.

[0142] Step 803, determine whether the false alarm rate is less than a set probability threshold, if so, execute step 804, otherwise, execute step 805.

[0143] Step 804: obtaining a false alarm identification result indicating that the alarm event to be tested is not a false alarm.

[0144] In the embodiment of the present application, after obtaining the false alarm identification result indicating that the alarm event to be tested is not a false alarm, the method further includes:

[0145] Input the alarm data into the trained question-answering model to obtain processing suggestions for the alarm events to be tested.

[0146] Optionally, the alarm data is input into a trained question-answering model to obtain processing suggestion information for the alarm event to be tested, including:

[0147] Input the target security log data into the third feature extraction layer of the question-answering model, and extract the third feature information of the target security log data through the third feature extraction layer; input the target image into the fourth feature extraction layer of the question-answering model, and extract the fourth feature information of the target image through the fourth feature extraction layer; fuse the third feature information and the fourth feature information, and input the fused feature information into the output layer of the question-answering model to determine the processing suggestion information for the alarm event to be tested.

[0148] Specifically, the target security log data is input into the text encoder of the question-answering model for feature extraction to obtain the third feature information; the target image is input into the image encoder of the question-answering model for feature extraction to obtain the fourth feature information; the third feature information and the fourth feature information are input into the fusion module of the question-answering model for fusion to obtain the fused feature information; the fused feature information is input into the question-answering module of the question-answering model to generate processing suggestion information for the alarm event to be tested.

[0149] Among them, the question-answering model can be a large model (Large Language Model, LLM). LLM is a natural language processing model based on deep learning technology, which has high language comprehension and generation capabilities and can generate high-quality natural language text.

[0150] Fig.11A flowchart of a method for training a question-answering model provided in an embodiment of the present application, such as Fig.11 As shown, at least the following steps 111-113 are included:

[0151] Step 111: Obtain a second training data set.

[0152] The second training data set includes multiple pieces of second historical alarm data, and each piece of second historical alarm data includes historical security log data, historical images, and historical processing suggestion information of historical alarm events.

[0153] Step 112, input each second historical alarm data in the second training data set into the preset question-answering model respectively, process it using the preset question-answering model, and train the preset question-answering model with the goal of outputting historical processing suggestion information of the second historical alarm data.

[0154] Step 113, until the preset question-answering model converges, a question-answering model is obtained.

[0155] During the training of the question-answering model, prompt words are added to the question-answering model through the prompt project. The prompt words can clearly inform the question-answering model that the current task is "security incident analysis" and that it needs to provide security advice as a "security expert" to ensure that the question-answering model can understand the task objectives more accurately and generate outputs that are more in line with actual needs.

[0156] Step 805: obtaining a false alarm identification result indicating that the alarm event to be detected is a false alarm.

[0157] The specific steps of the method for identifying false alarms of alarm events when the alarm event recognition model provided above is a question-answering model are described in detail, such as Fig.12 As shown:

[0158] Step 121: Collect alarm data of the alarm event to be tested.

[0159] Step 122: input the alarm data into the trained alarm event recognition model.

[0160] Step 123, obtaining a false alarm identification result indicating that the alarm event to be tested is not a false alarm.

[0161] The false alarm identification result indicating that the alarm event to be tested is not a false alarm may be information such as “not”, “not a false alarm”, or “not a false alarm”.

[0162] Optionally, after obtaining a false alarm identification result indicating that the alarm event to be tested is not a false alarm, the method further includes:

[0163] Input the alarm data into the trained question-answering model to obtain processing suggestions for the alarm events to be tested.

[0164] The trained question-answering model may be a trained alarm event recognition model, or may be the same model as the alarm event recognition model, or may be a model different from the alarm event recognition model.

[0165] Step 124, obtaining a false alarm identification result indicating that the alarm event to be detected is a false alarm.

[0166] The false alarm identification result indicating that the alarm event to be tested is a false alarm may be information such as “yes”, “is a false alarm”, or “false alarm”.

[0167] in, Fig.13 A flowchart of another method for training an alarm event recognition model provided in an embodiment of the present application, such as Fig.13 As shown, at least the following steps 131-133 are included:

[0168] Step 131, obtaining a third training data set.

[0169] The third training data set includes a plurality of third historical alarm data, each of which includes historical security log data of a historical alarm event, a historical image, and a second label, and the second label is used to characterize whether the historical alarm event is a false alarm. For example, if the historical alarm event is a false alarm, the second label of the historical alarm event is "false alarm", and if the historical alarm event is not a false alarm, the second label of the historical alarm event is "not a false alarm".

[0170] Step 132, input each third historical alarm data in the third training data set into the preset alarm event recognition model respectively, process it using the preset alarm event recognition model, and output the second label of the third historical alarm data as the target to train the preset alarm event recognition model.

[0171] Step 133, until the preset alarm event recognition model converges, an alarm event recognition model is obtained.

[0172] The specific steps of the method for identifying false alarms of alarm events when the other alarm event recognition model provided above is a question-answering model are described in detail. Fig.14 As shown:

[0173] Step 141: Collect alarm data of the alarm event to be tested.

[0174] Step 142, input the alarm data into the trained alarm event recognition model.

[0175] Step 143 , obtaining a false alarm identification result indicating that the alarm event to be tested is not a false alarm, and processing suggestion information for the alarm event to be tested.

[0176] Step 144, obtaining a false alarm identification result indicating that the alarm event to be detected is a false alarm.

[0177] In an embodiment of the present application, target security log data of the alarm data is input into the first feature extraction layer of the alarm event recognition model, and the first feature information of the target security log data is extracted through the first feature extraction layer; and the target image of the alarm data is input into the second feature extraction layer of the alarm event recognition model, and the second feature information of the target image is extracted through the second feature extraction layer; the first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to obtain a false alarm recognition result characterizing that the alarm event to be tested is a false alarm, or to obtain a false alarm recognition result characterizing that the alarm event to be tested is a non-false alarm and processing suggestion information for the alarm event to be tested.

[0178] Specifically, the target security log data is input into the text encoder of the alarm event recognition model for feature extraction to obtain first feature information; the target image is input into the image encoder of the alarm event recognition model for feature extraction to obtain second feature information; the first feature information and the second feature information are input into the fusion module of the alarm event recognition model for fusion to obtain fused feature information; the fused feature information is input into the recognition module of the alarm event recognition model to obtain a false alarm recognition result indicating that the alarm event to be tested is a false alarm, or a false alarm recognition result indicating that the alarm event to be tested is not a false alarm and processing suggestion information for the alarm event to be tested.

[0179] in, Fig.15 A flowchart of another method for training an alarm event recognition model provided in an embodiment of the present application, such as Fig.15 As shown, at least the following steps 151-153 are included:

[0180] Step 151: Obtain a fourth training data set.

[0181] Among them, the fourth training data set includes multiple fourth historical alarm data, each fourth historical alarm data includes historical security log data, historical images and a third label of the historical alarm event, and the third label includes information characterizing that the historical alarm event is a false alarm, or information characterizing that the historical alarm event is a non-false alarm and corresponding historical processing suggestion information. For example, if the historical alarm event is a false alarm, the third label of the historical alarm event is "false alarm", and if the historical alarm event is not a false alarm, the third label of the historical alarm event is "non-false alarm, processing suggestion is suggestion 1".

[0182] Step 152, input each fourth historical alarm data in the fourth training data set into the preset alarm event recognition model respectively, process it using the preset alarm event recognition model, and train the preset alarm event recognition model with the third label of the fourth historical alarm data as the output target.

[0183] Step 153, until the preset alarm event recognition model converges, an alarm event recognition model is obtained.

[0184] Based on the same technical concept, the present application exemplarily provides a device for identifying false alarms of alarm events, such as Fig.16 As shown, the device comprises:

[0185] The acquisition module 161 is used to acquire the alarm data of the alarm event to be tested, wherein the alarm data includes target security log data and a target image, wherein the target image is used to characterize the data volume of the security log data whose generation time is within a set time period, and the generation time of the target security log data is within the set time period;

[0186] The processing module 162 is used to input the alarm data into the trained alarm event recognition model to obtain the false alarm recognition result of the alarm event to be tested, wherein the false alarm recognition result is used to indicate whether the alarm event to be tested is a false alarm.

[0187] Optionally, the processing module 162 is used to:

[0188] Inputting the target security log data into the first feature extraction layer of the alarm event recognition model, and extracting first feature information of the target security log data through the first feature extraction layer; and inputting the target image into the second feature extraction layer of the alarm event recognition model, and extracting second feature information of the target image through the second feature extraction layer;

[0189] The first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to determine the false alarm recognition result of the alarm event to be detected.

[0190] Optionally, the acquisition module 161 is used to determine the target image by the following method:

[0191] Acquire multiple security log data within a set time period, wherein the multiple security log data include the target security log data, and the set time period includes multiple sub-time periods;

[0192] Determine the amount of security log data in each sub-time period based on the sub-time period to which the generation time of each security log data belongs;

[0193] The target image is determined based on the data volume of the security log data in each sub-time period.

[0194] Optionally, the processing module 162 is used to:

[0195] The alarm data is input into a trained alarm event recognition model to obtain the false alarm recognition result indicating that the alarm event to be tested is not a false alarm, and processing suggestion information for the alarm event to be tested.

[0196] Optionally, the processing module 162 is used to:

[0197] Inputting the alarm data into a trained alarm event recognition model to obtain a false alarm rate of the alarm event to be tested;

[0198] The false alarm rate is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, a false alarm identification result of the alarm event to be tested is obtained.

[0199] Optionally, the processing module 162 is used to:

[0200] If the comparison result indicates that the false alarm rate is greater than or equal to the set probability threshold, the false alarm identification result indicating that the alarm event to be tested is a false alarm is obtained;

[0201] If the comparison result indicates that the false alarm rate is less than the set probability threshold, the false alarm identification result indicating that the alarm event to be detected is not a false alarm is obtained.

[0202] Optionally, after obtaining the false alarm identification result indicating that the alarm event to be tested is not a false alarm, the processing module 162 is further configured to:

[0203] The alarm data is input into the trained question-answering model to obtain processing suggestion information for the alarm event to be tested.

[0204] Optionally, the acquisition module 161 is used to obtain target security log data by the following method:

[0205] Collect multiple pieces of original security log data;

[0206] For each piece of original security log data, data formatting is performed on the original security log data to obtain first security log data, and data cleaning is performed on the first security log data to obtain second security log data;

[0207] Noise reduction processing is performed on the plurality of second security log data to obtain a plurality of processed second security log data, and each processed second security log data is used as the target security log data.

[0208] Optionally, after obtaining the first security log data, the collection module 161 is further used to:

[0209] Determine a first ID based on the partition ID number ID, generation time and offset of the original security log data;

[0210] Using the first id as the primary key value of the first security log data, and saving the primary key values ​​of the first security log data and the first security log warning data;

[0211] After obtaining the second security log data, the collection module 161 is further used to:

[0212] Generate a second ID for the second security log data using a globally unique ID generation algorithm;

[0213] The second ID is used as the primary key value of the second security log data, and the second security log data and the primary key value of the second security log data are saved.

[0214] Based on the same inventive concept, the embodiment of the present application provides an electronic device, which can realize the function of the alarm event false alarm identification device discussed above, please refer to Fig.17 , the device comprises a processor 171 and a memory 172, wherein the memory 172 is used to store program instructions;

[0215] The processor 171 calls the program instructions stored in the memory and executes the program instructions to implement the following steps:

[0216] Collect alarm data of the alarm event to be tested, wherein the alarm data includes target security log data and a target image, the target image is used to characterize the data volume of the security log data whose generation time is within a set time period, and the generation time of the target security log data is within the set time period;

[0217] The alarm data is input into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, wherein the false alarm recognition result is used to indicate whether the alarm event to be tested is a false alarm.

[0218] Optionally, the inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes:

[0219] Inputting the target security log data into the first feature extraction layer of the alarm event recognition model, and extracting first feature information of the target security log data through the first feature extraction layer; and inputting the target image into the second feature extraction layer of the alarm event recognition model, and extracting second feature information of the target image through the second feature extraction layer;

[0220] The first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to determine the false alarm recognition result of the alarm event to be detected.

[0221] Optionally, the processor 171 is configured to execute the following method to determine the target image:

[0222] Acquire multiple security log data within a set time period, wherein the multiple security log data include the target security log data, and the set time period includes multiple sub-time periods;

[0223] Determine the amount of security log data in each sub-time period based on the sub-time period to which the generation time of each security log data belongs;

[0224] The target image is determined based on the data volume of the security log data in each sub-time period.

[0225] Optionally, the inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes:

[0226] The alarm data is input into a trained alarm event recognition model to obtain the false alarm recognition result indicating that the alarm event to be tested is not a false alarm, and processing suggestion information for the alarm event to be tested.

[0227] Optionally, the inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes:

[0228] Inputting the alarm data into a trained alarm event recognition model to obtain a false alarm rate of the alarm event to be tested;

[0229] The false alarm rate is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, a false alarm identification result of the alarm event to be tested is obtained.

[0230] Optionally, obtaining a false alarm identification result of the alarm event to be detected based on the comparison result includes:

[0231] If the comparison result indicates that the false alarm rate is greater than or equal to the set probability threshold, the false alarm identification result indicating that the alarm event to be tested is a false alarm is obtained;

[0232] If the comparison result indicates that the false alarm rate is less than the set probability threshold, the false alarm identification result indicating that the alarm event to be detected is not a false alarm is obtained.

[0233] Optionally, after obtaining the false alarm identification result indicating that the alarm event to be tested is not a false alarm, the processor 171 is further configured to execute:

[0234] The alarm data is input into the trained question-answering model to obtain processing suggestion information for the alarm event to be tested.

[0235] Optionally, the processor 171 is used to execute the following method to obtain target security log data:

[0236] Collect multiple pieces of original security log data;

[0237] For each piece of original security log data, data formatting is performed on the original security log data to obtain first security log data, and data cleaning is performed on the first security log data to obtain second security log data;

[0238] Noise reduction processing is performed on the plurality of second security log data to obtain a plurality of processed second security log data, and each processed second security log data is used as the target security log data.

[0239] Optionally, after obtaining the first security log data, the processor 171 is further configured to execute:

[0240] Determine a first ID based on the partition ID number ID, generation time and offset of the original security log data;

[0241] Using the first id as the primary key value of the first security log data, and saving the primary key values ​​of the first security log data and the first security log warning data;

[0242] After obtaining the second security log data, the method further includes:

[0243] Generate a second ID for the second security log data using a globally unique ID generation algorithm;

[0244] The second ID is used as the primary key value of the second security log data, and the second security log data and the primary key value of the second security log data are saved.

[0245] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, and a computer program product includes: a computer program code, when the computer program code is executed on a computer, the computer executes any of the alarm event false alarm identification methods discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the alarm event false alarm identification method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0246] Based on the same inventive concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the false alarm identification methods for alarm events discussed above. Since the principle of solving the problem by the above computer program product is similar to that of the false alarm identification method for alarm events, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0247] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0248] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0249] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0250] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of user-operated steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0251] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying false alarms of alarm events, characterized in that: include: Collecting alarm data of the alarm event to be tested, wherein the alarm data includes target security log data and a target image, wherein the target image is used to characterize the data volume of the security log data whose generation time is within a set time period, and the generation time of the target security log data is within the set time period; The alarm data is input into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, wherein the false alarm recognition result is used to indicate whether the alarm event to be tested is a false alarm.

2. The method according to claim 1, characterized in that The step of inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes: Inputting the target security log data into the first feature extraction layer of the alarm event recognition model, and extracting first feature information of the target security log data through the first feature extraction layer; and inputting the target image into the second feature extraction layer of the alarm event recognition model, and extracting second feature information of the target image through the second feature extraction layer; The first feature information and the second feature information are fused, and the fused feature information is input into the output layer of the alarm event recognition model to determine the false alarm recognition result of the alarm event to be detected.

3. The method according to claim 1 or 2, characterized in that The target image is determined by the following method: Acquire multiple security log data within a set time period, wherein the multiple security log data include the target security log data, and the set time period includes multiple sub-time periods; Determine the amount of security log data in each sub-time period based on the sub-time period to which the generation time of each security log data belongs; The target image is determined based on the data volume of the security log data in each sub-time period.

4. The method according to claim 1, characterized in that The step of inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes: The alarm data is input into a trained alarm event recognition model to obtain the false alarm recognition result indicating that the alarm event to be tested is not a false alarm, and processing suggestion information for the alarm event to be tested.

5. The method according to claim 1, characterized in that The step of inputting the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested includes: Inputting the alarm data into a trained alarm event recognition model to obtain a false alarm rate of the alarm event to be tested; The false alarm rate is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, a false alarm identification result of the alarm event to be tested is obtained.

6. The method according to claim 5, characterized in that The obtaining, based on the comparison result, a false alarm identification result of the alarm event to be tested, comprises: If the comparison result indicates that the false alarm rate is greater than or equal to the set probability threshold, the false alarm identification result indicating that the alarm event to be tested is a false alarm is obtained; If the comparison result indicates that the false alarm rate is less than the set probability threshold, the false alarm identification result indicating that the alarm event to be detected is not a false alarm is obtained.

7. The method according to claim 1, characterized in that After obtaining the false alarm identification result indicating that the alarm event to be tested is not a false alarm, the method further includes: The alarm data is input into the trained question-answering model to obtain processing suggestion information for the alarm event to be tested.

8. The method according to claim 1, characterized in that The target security log data is obtained by the following method: Collect multiple pieces of original security log data; For each piece of original security log data, data formatting is performed on the original security log data to obtain first security log data, and data cleaning is performed on the first security log data to obtain second security log data; Noise reduction processing is performed on the plurality of second security log data to obtain a plurality of processed second security log data, and each processed second security log data is used as the target security log data.

9. The method according to claim 8, characterized in that After obtaining the first security log data, the method further includes: Determine a first ID based on the partition ID number ID, generation time and offset of the original security log data; Using the first id as the primary key value of the first security log data, and saving the primary key values ​​of the first security log data and the first security log warning data; After obtaining the second security log data, the method further includes: Generate a second ID for the second security log data using a globally unique ID generation algorithm; The second ID is used as the primary key value of the second security log data, and the second security log data and the primary key value of the second security log data are saved.

10. A device for identifying false alarms of alarm events, characterized in that: include: A collection module, used for collecting alarm data of the alarm event to be tested, wherein the alarm data includes target security log data and a target image, the target image is used to characterize the data volume of the security log data whose generation time is within a set time period, and the generation time of the target security log data is within the set time period; The processing module is used to input the alarm data into a trained alarm event recognition model to obtain a false alarm recognition result of the alarm event to be tested, wherein the false alarm recognition result is used to indicate whether the alarm event to be tested is a false alarm.

11. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods of claims 1-9 according to the obtained program instructions.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method according to any one of claims 1 to 9.

Images