Threat alarm aggregation method and device based on Hamming distance
Through the threat alarm aggregation method based on Hanming distance, the threat alarm information characteristics are extracted and aggregated, and the problems of redundancy and duplication of alarm information in the prior art are solved, and the aggregation efficiency and accuracy are improved.
Patent Information
- Application Number
- CN202411606090.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-12
- Publication Date
- 2025-03-18
AI Technical Summary
The prior art is prone to redundant and duplicate warning information in the aggregation process of threat warning information, which makes it impossible to accurately unearth the true correlation between different threat warning information, affecting the accuracy and effectiveness of the aggregation results.
The threat alarm aggregation method based on Hamming distance is adopted to obtain the original threat alarm information, extract its characteristics, calculate the similarity of the characteristics, and aggregate based on the similarity to form high-quality alarm information.
It effectively reduces the redundancy and duplication of alarm information, improves the aggregation efficiency and accuracy of threat alarm information, and can better classify and handle threat alarm information.
Smart Images
Figure CN119646732A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to a threat warning aggregation method based on Hamming distance. Background Art
[0002] With the rapid development of Internet technology, intrusion detection has become an indispensable part of maintaining network security and stability. However, in order to timely discover effective threat warning information, it is necessary to audit a large amount of warning information data. Manual classification is almost impossible to complete, and using computers to conduct data analysis will also encounter a series of difficulties. A large amount of irrelevant information and warning data characteristics make it difficult to detect and discover intrusion behaviors. Therefore, how to separate and aggregate a large amount of warning data in a timely manner and reduce the interference of redundant and irrelevant data characteristics is the focus of intrusion detection research.
[0003] However, existing technologies mainly use machine learning algorithms and rely on different levels of expert knowledge to comprehensively measure the relationship between different warning information by using data mining and other related technologies to achieve the aggregation of original threat warning information. Since existing technologies are prone to frequent mining, they may frequently use a single factor to measure the relationship between warning information, resulting in the inability to accurately mine the real correlation between different threat warning information, which will ultimately directly affect the accuracy and effectiveness of threat warning aggregation results. Summary of the invention
[0004] The technical problem to be solved by the present invention is how to effectively deal with the problems of redundancy and duplication of warning information in the process of threat warning information aggregation; in view of this, the present invention provides a threat warning aggregation method and device based on Hamming distance.
[0005] The technical solution adopted by the present invention is a threat warning aggregation method based on Hamming distance, comprising:
[0006] Step S1, obtaining original threat warning information, and performing feature extraction to determine corresponding warning information features;
[0007] Step S2, determining the similarity of the alarm information features;
[0008] Step S3: Based on the similarity, the features of the warning information are aggregated to form corresponding warning information.
[0009] In one embodiment, step S1 includes:
[0010] Obtain original threat alert information;
[0011] Mining and screening the field information contained in the original threat warning information;
[0012] Remove duplicate fields in the current threat alert information;
[0013] Extract the field features in the current threat warning information, that is, the warning information features.
[0014] In one embodiment, step S2 includes:
[0015] Decomposing the warning information features into different long codeword combinations;
[0016] Determine the difference value of different combinations of the long codewords by using the Hamming distance;
[0017] Based on the difference value, the similarity between the corresponding alarm information features is determined.
[0018] In one embodiment, step S3 includes:
[0019] Based on the configured similarity threshold, the alarm information features are screened to determine representative alarm information features therein;
[0020] Representative alarm information features are aggregated to form alarm information with the same structure data.
[0021] Another aspect of the present invention further provides a threat warning aggregation device based on Hamming distance, comprising:
[0022] An acquisition unit, configured to acquire original threat warning information, perform feature extraction, and determine corresponding warning information features;
[0023] A calculation unit configured to determine the similarity of the warning information features;
[0024] The aggregation unit is configured to aggregate the alarm information features based on the similarity to form corresponding alarm information.
[0025] In one embodiment, the acquisition unit is further configured to:
[0026] Obtain original threat alert information;
[0027] Mining and screening the field information contained in the original threat warning information;
[0028] Remove duplicate fields in the current threat alert information;
[0029] Extract the field features in the current threat warning information, that is, the warning information features.
[0030] In one embodiment, the computing unit is further configured to:
[0031] Decomposing the warning information features into different long codeword combinations;
[0032] Determine the difference value of different combinations of the long codewords by using the Hamming distance;
[0033] Based on the difference value, the similarity between the corresponding alarm information features is determined.
[0034] In one embodiment, the aggregation unit is further configured as:
[0035] Based on the configured similarity threshold, the alarm information features are screened to determine representative alarm information features therein;
[0036] Representative alarm information features are aggregated to form alarm information with the same structure data.
[0037] Another aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the threat alert aggregation method based on Hamming distance as described in any one of the above items.
[0038] Another aspect of the present invention further provides a computer storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the threat alert aggregation method based on Hamming distance as described in any one of the above items are implemented.
[0039] Compared with the prior art, the present invention has at least the following advantages:
[0040] In view of the problems of redundancy and duplication of warning information in the process of threat warning information aggregation, the present invention proposes a threat warning aggregation method based on Hamming distance. The method mainly uses the Hamming distance to calculate the similarity of each threat warning information feature, which can better realize the classification of threat warning information features, shorten the aggregation processing time of threat warning information, and improve the efficiency of warning information aggregation. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 A schematic diagram of a threat alert aggregation method based on Hamming distance according to an embodiment of the present invention;
[0042] Figure 2 Schematic diagram of the original threat warning information feature extraction process according to an embodiment of the present invention;
[0043] Figure 3 A schematic diagram of threat warning information aggregation and reconstruction according to an embodiment of the present invention;
[0044] Figure 4It is a schematic diagram of the composition of a threat warning aggregation device based on Hamming distance according to an embodiment of the present invention;
[0045] Figure 5 The figure is a schematic diagram of the composition of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION
[0046] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose, the present invention is described in detail below in conjunction with the accompanying drawings and preferred embodiments.
[0047] Unless otherwise defined, all terms (including technical terms and scientific terms) used in this article have the same meaning as commonly understood by ordinary technicians in the field to which this application belongs. It should also be understood that terms (such as terms defined in commonly used dictionaries) should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and will not be interpreted in an idealized or overly formal sense unless explicitly defined in this article.
[0048] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0049] The first embodiment of the present invention is a threat alert aggregation method based on Hamming distance, such as Figure 1 As shown, including:
[0050] Step S1, obtaining original threat warning information, and performing feature extraction to determine corresponding warning information features;
[0051] Step S2, determining the similarity of the alarm information features;
[0052] Step S3: Based on the similarity, the features of the warning information are aggregated to form corresponding warning information.
[0053] refer to Figure 1 , the method provided in this embodiment will be described in detail step by step below.
[0054] Step S1, obtaining original threat warning information, and performing feature extraction to determine corresponding warning information features.
[0055] It is understandable that the original threat warning information contains a large amount of redundant information, and it is impossible to directly extract useful and high-value threat warning information.
[0056] In this embodiment, the field information contained in the original threat warning information is decomposed and extracted, and the key field features of the threat warning information are extracted by screening the extracted field information, so as to prepare for the implementation of subsequent warning information aggregation work.
[0057] Specifically, the feature extraction of the original threat warning information mainly involves mining and screening the field information contained in the warning information, removing the repeated field information in each threat warning information, and extracting representative key field feature information.
[0058] The original threat warning information feature extraction process is as follows: Figure 2 shown.
[0059] For example, the specific operation steps are as follows:
[0060] ① Field information mining and processing
[0061] Since the original threat alert information may have problems such as large data volume, high redundancy, and high false alarm rate, in order to aggregate and generate higher quality alert information, it is necessary to uniformly mine the original threat alert information for field information. Field information mining mainly focuses on effectively mining and extracting field information such as the alert name, IP address, alert time, and alert type in the original threat alert information.
[0062] ②Field information screening
[0063] Based on the field information obtained after mining, field information screening is mainly used to screen out some field information content that is not related to the alarm information, and at the same time remove some existing duplicate field information to ensure the uniqueness and independence of the field information after screening.
[0064] ③Key field feature extraction
[0065] Key field feature extraction is closely related to the field information related to the alarm. By reassembling the filtered field information, alarm information feature data in a custom format is formed. Among them, the format of the alarm information feature data is mainly customized based on the extracted key field information.
[0066] Step S2, determining the similarity of the alarm information features.
[0067] Specifically, the warning information feature similarity calculation mainly uses the Hamming distance to calculate the similarity of different threat warning information features.
[0068] By decomposing the threat warning information characteristics into different long codeword combinations,
[0069] The Hamming distance is used to calculate the differences between codewords of different lengths, thereby indirectly obtaining the similarity of different alarm information features. The calculation principle of the alarm information feature similarity is as follows:
[0070] Generally, the Hamming distance is mainly used to describe the distance between two long codewords. By calculating the difference between the two long codewords, the similarity between the two long codewords can be indirectly inferred. Assume that the two n-length codewords are set to a = (a1a2....a n ),b=(b1b2....b n ),
[0071]
[0072] in, represents modulo 2 addition, a i represents {0,1}, b i represents {0,1}.
[0073] L(a,b) represents the sum of the number of different codes at the same position of two long codewords, so L(a,b) can reflect the degree of difference between the two codewords. L(a,b) is a number between 0 and n. In order to make the similarity representation more obvious, the above is converted into the following formula:
[0074]
[0075] Among them, Lsim(a,b) is between 0 and 1. The closer Lsim(a,b) is to 1, the more similar the codeword is to b.
[0076] The result obtained by calculating the long codeword similarity between the threat warning feature information can be indirectly converted into the result of similarity evaluation between different threat warning feature information.
[0077] Step S3, based on the similarity, the features of the warning information are aggregated to form corresponding warning information.
[0078] For reference Figure 3 According to the result obtained after the similarity calculation of the above-mentioned alarm information features, the threat alarm information aggregation mainly aggregates the representative alarm information features obtained after screening (for example, by setting a threshold for the similarity, and the features greater than the threshold are used as representative alarm information features), and aggregates them again to generate threat alarm information with low redundancy.
[0079] The threat warning information aggregation process mainly involves iterative fusion of warning information features, merging and reconstructing warning features with different structural information into the same data structure, and finally generating threat warning information with low redundancy.
[0080] Compared with the prior art, the method provided in this embodiment uses the Hamming distance to calculate the similarity of each threat warning information feature, which can better realize the classification of threat warning information features, shorten the time for the aggregation processing of threat warning information, and improve the efficiency of warning information aggregation.
[0081] The second embodiment of the present invention corresponds to the first embodiment, and can be referred to Figure 4 This embodiment introduces a threat warning aggregation device based on Hamming distance, including the following components:
[0082] An acquisition unit, configured to acquire original threat warning information, perform feature extraction, and determine corresponding warning information features;
[0083] A calculation unit configured to determine the similarity of the warning information features;
[0084] The aggregation unit is configured to aggregate the alarm information features based on the similarity to form corresponding alarm information.
[0085] In one embodiment, the acquisition unit is further configured to:
[0086] Obtain original threat alert information;
[0087] Mining and screening the field information contained in the original threat warning information;
[0088] Remove duplicate fields in the current threat alert information;
[0089] Extract the field features in the current threat warning information, that is, the warning information features.
[0090] In one embodiment, the computing unit is further configured to:
[0091] Decomposing the warning information features into different long codeword combinations;
[0092] Determine the difference value of different combinations of the long codewords by using the Hamming distance;
[0093] Based on the difference value, the similarity between the corresponding alarm information features is determined.
[0094] In one embodiment, the aggregation unit is further configured as:
[0095] Based on the configured similarity threshold, the alarm information features are screened to determine representative alarm information features therein;
[0096] Representative alarm information features are aggregated to form alarm information with the same structure data.
[0097] A third embodiment of the present invention is an electronic device, such as Figure 5 As shown, it can be understood as a physical device, including a processor and a memory storing instructions executable by the processor. When the instructions are executed by the processor, the following operations are performed:
[0098] Step S1, obtaining original threat warning information, and performing feature extraction to determine corresponding warning information features;
[0099] Step S2, determining the similarity of the alarm information features;
[0100] Step S3: Based on the similarity, the features of the warning information are aggregated to form corresponding warning information.
[0101] The fourth embodiment of the present invention, the process of the threat alert aggregation method based on Hamming distance in this embodiment is the same as that of the first, second or third embodiment, the difference is that in engineering implementation, this embodiment can be implemented by means of software plus a necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the method of the present invention can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), including a number of instructions for a device to execute the method described in the embodiment of the present invention.
[0102] Through the description of the specific implementation methods, a deeper and more specific understanding of the technical means and effects adopted by the present invention to achieve the predetermined purpose should be obtained. However, the accompanying drawings are only for reference and illustration purposes and are not intended to limit the present invention.
Claims
1. A threat alert aggregation method based on Hamming distance, characterized in that: include: Step S1, obtaining original threat warning information, and performing feature extraction to determine corresponding warning information features; Step S2, determining the similarity of the alarm information features; Step S3: Based on the similarity, the features of the warning information are aggregated to form corresponding warning information.
2. The threat alert aggregation method based on Hamming distance according to claim 1 is characterized in that: The step S1 comprises: Obtain original threat alert information; Mining and screening the field information contained in the original threat warning information; Remove duplicate fields in the current threat alert information; Extract the field features in the current threat warning information, that is, the warning information features.
3. The threat alert aggregation method based on Hamming distance according to claim 2 is characterized in that: The step S2 comprises: Decomposing the warning information features into different long codeword combinations; Determine the difference value of different combinations of the long codewords by using the Hamming distance; Based on the difference value, the similarity between the corresponding alarm information features is determined.
4. The threat alert aggregation method based on Hamming distance according to claim 3 is characterized in that: The step S3 comprises: Based on the configured similarity threshold, the alarm information features are screened to determine representative alarm information features therein; Representative alarm information features are aggregated to form alarm information with the same structure data.
5. A threat warning aggregation device based on Hamming distance, characterized in that: include: An acquisition unit, configured to acquire original threat warning information, perform feature extraction, and determine corresponding warning information features; A calculation unit configured to determine the similarity of the warning information features; The aggregation unit is configured to aggregate the alarm information features based on the similarity to form corresponding alarm information.
6. The threat warning aggregation device based on Hamming distance according to claim 5, characterized in that: The acquisition unit is further configured as follows: Obtain original threat alert information; Mining and screening the field information contained in the original threat warning information; Remove duplicate fields in the current threat alert information; Extract the field features in the current threat warning information, that is, the warning information features.
7. The threat warning aggregation device based on Hamming distance according to claim 2, characterized in that: The computing unit is further configured as: Decomposing the warning information features into different long codeword combinations; Determine the difference value of different combinations of the long codewords by using the Hamming distance; Based on the difference value, the similarity between the corresponding alarm information features is determined.
8. The threat warning aggregation device based on Hamming distance according to claim 2, characterized in that: The aggregation unit is further configured as: Based on the configured similarity threshold, the alarm information features are screened to determine representative alarm information features therein; Representative alarm information features are aggregated to form alarm information with the same structure data.
9. An electronic device, characterized in that: The electronic device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the threat alert aggregation method based on Hamming distance as claimed in any one of claims 1 to 4.
10. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the threat alert aggregation method based on Hamming distance as claimed in any one of claims 1 to 4.