Data processing method and device, equipment, medium and product

Abstract

The invention discloses a data processing method and device, equipment, a medium and a product. The method comprises the following steps: acquiring an initial alarm log set; the initial alarm log set is analyzed, target alarm information is obtained, and the target alarm information comprises alarm data and processing information of the alarm data; splicing the alarm data according to the disposal types of the alarm data to obtain a target alarm log set corresponding to each disposal type; processing a target alarm log set corresponding to the automatic processing type based on a security event arrangement automatic response technology to obtain a first processing result; and receiving a second processing result input by the user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing, through the technical scheme of the invention, the labor cost can be reduced, and the alarm log processing efficiency can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to a data processing method, device, equipment, medium and product. Background Art

[0002] In order to cope with the increasingly severe network security situation, companies generally equip a large number of security devices according to various needs. However, there is no coordination mechanism between different security devices. When an attack occurs, they often issue alarms separately, generating a large number of alarm logs. Network security operation and maintenance personnel need to spend time understanding the alarm logs of different formats from different manufacturers, query and filter, and perform correlation analysis in the massive alarm logs, and then manually handle them. The labor cost is high, and the efficiency of alarm log processing is low. Summary of the invention

[0003] The embodiments of the present invention provide a data processing method, device, equipment, medium and product, which can reduce labor costs and improve alarm log processing efficiency.

[0004] According to one aspect of the present invention, there is provided a data processing method, comprising:

[0005] Get the initial alarm log set;

[0006] Parsing the initial alarm log set to obtain target alarm information, the target alarm information includes: alarm data and handling information of the alarm data, wherein the handling information includes: handling type and handling content of the handling type, and the handling type includes: automatic handling, primary manual handling and secondary manual handling;

[0007] The alarm data is spliced ​​according to the processing type of the alarm data to obtain the target alarm log set corresponding to each processing type;

[0008] Processing a target alarm log set corresponding to the automatic disposal type based on the security incident orchestration automated response technology to obtain a first processing result;

[0009] A second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing is received.

[0010] According to another aspect of the present invention, there is provided a data processing device, the data processing device comprising:

[0011] An initial alarm log set acquisition module is used to acquire an initial alarm log set;

[0012] A parsing module, used to parse the initial alarm log set to obtain target alarm information, wherein the target alarm information includes: alarm data and handling information of the alarm data, wherein the handling information includes: handling type and handling content of the handling type, wherein the handling type includes: automatic handling, primary manual handling and secondary manual handling;

[0013] A splicing module is used to splice the alarm data according to the processing type of the alarm data to obtain a target alarm log set corresponding to each processing type;

[0014] A first processing module is used to process a target alarm log set corresponding to the automatic disposal type based on the security incident orchestration automatic response technology to obtain a first processing result;

[0015] The second processing module is used to receive a second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the data processing method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data processing method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided. When the computer program is executed by a processor, the computer program implements the data processing method as described in any one of the embodiments of the present invention.

[0022] The embodiment of the present invention obtains an initial alarm log set; parses the initial alarm log set to obtain target alarm information, wherein the target alarm information includes: alarm data and disposal information of the alarm data; splices the alarm data according to the disposal type of the alarm data to obtain a target alarm log set corresponding to each disposal type; processes the target alarm log set corresponding to the automatic disposal type based on the security event orchestration automated response technology to obtain a first processing result; and receives a second processing result input by a user for the target alarm log set corresponding to the first-level manual disposal and / or the target alarm log set corresponding to the second-level manual disposal, thereby reducing labor costs and improving alarm log processing efficiency.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a data processing method in an embodiment of the present invention;

[0026] Figure 2 is a flow chart of response and handling of monitoring alarms in an embodiment of the present invention;

[0027] Figure 3 is a structural schematic diagram of a data processing device in an embodiment of the present invention;

[0028] Figure 4 It is a structural schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0032] Embodiment 1

[0033] Figure 1 A flowchart of a data processing method provided by an embodiment of the present invention. This embodiment is applicable to data processing. The method can be executed by a data processing device in an embodiment of the present invention. The device can be implemented in software and / or hardware. Figure 1 As shown, the method specifically comprises the following steps:

[0034] S110, obtaining an initial alarm log set.

[0035] In this embodiment, the initial alarm log set includes: security component logs, system logs, network logs and application logs.

[0036] In this embodiment, log access is collected from dozens of categories and hundreds of security components (security tools), more than 10,000 servers, and hundreds of thousands of terminals across the bank, and hundreds of millions of alarm logs are processed daily.

[0037] In this embodiment, a centralized management method is adopted to uniformly manage relevant security equipment, collect security information of assets in the network where the enterprise-level security operation center is located, and conduct in-depth analysis, statistics and correlation of various collected alarm logs to timely reflect the security status of the managed assets, locate security risks, and promptly discover and locate various risk events, and provide processing methods in a timely manner, thereby realizing event analysis, risk analysis, early warning management and emergency response processing.

[0038] S120, parsing the initial alarm log set to obtain target alarm information, where the target alarm information includes: alarm data and handling information of the alarm data.

[0039] In this embodiment, the treatment information includes: treatment type and treatment content of the treatment type, and the treatment type includes: automatic treatment, primary manual treatment and secondary manual treatment.

[0040] In this embodiment, the method of parsing the initial alarm log set to obtain the target alarm information can be: parsing the initial alarm log set based on macro-association rules to obtain the first alarm information; parsing the initial alarm log set based on user and entity behavior analysis rules to obtain the second alarm information; parsing the initial alarm log set based on extended intelligent analysis rules to obtain the third alarm information; determining the target alarm information according to the first alarm information, the second alarm information and the third alarm information. The method of parsing the initial alarm log set to obtain the target alarm information can also be: parsing the initial alarm log set through statistical rules, chain rules, feature rules and intelligence rules to obtain the target alarm information. Statistical rules are used to generate alarms by real-time statistical clustering analysis of attack behaviors of a certain number or frequency within a certain period of time. For example: Internet intrusion detection equipment detects that the same domain directory is attacked by more than 5 source IPs within 1 hour. Through statistical analysis of the alarm logs generated by the security detection equipment deployed at the Internet exit, if a domain directory is found to be attacked by more than 5 different source IPs within an hour, an alarm is generated. Chain-type rules mainly refer to the attack kill chain, and configure a comprehensive time-series correlation detection model for the attacker's attack process such as scanning and deep testing, vulnerability exploitation and privilege escalation. For example: A suspected recipient successfully creates a malicious file. It is mainly through comprehensive analysis of security detection equipment logs and host logs. After the security detection equipment finds that a certain destination host is attacked, and at the same time, a log of creating a malicious file is generated on the destination host within a certain period of time, an alarm will be generated. Feature-type rules mainly use the highly reliable alarm information of certain security detection tools to directly trigger the generation of alarms. Intelligence-type rules mainly use the alarm logs generated by security tools and external threat intelligence to perform comprehensive correlation analysis to generate alarms. For example: The intranet system connects to a malicious IP, mainly through the collision of the destination address in the logs of security detection equipment, host protection, etc. and external threat intelligence, thereby generating an alarm.

[0041] The method of parsing the initial alarm log set to obtain the target alarm information can also be: parsing the initial alarm log set through production rules and test rules to obtain the target alarm information. Production rules include: first- and second-line alarms, automatic response, etc. Test rules include: design test, observation optimization, etc. Management is performed through the alarm type identification of the rule. First-line alarm rule: that is, the safety duty rule, which generates first-line alarms and is included in the requirements of the production operation monitoring management system; it is a key concern and needs to be quickly analyzed and handled. Second-line alarm rule: that is, the review analysis rule, which generates second-line alarms, which are mainly handled and analyzed by security operations personnel in a regular review manner and belong to necessary concerns, and are reviewed and analyzed regularly. Automatic response rule 2 generates automatic response alarms, mainly including firewall bans, CDN bans, bypass blocking bans, etc., which are automatically responded and handled through plan arrangement without manual handling. Observation optimization rule: a test rule with initial stable operation, continuous observation and rules that need to be followed up for subsequent operation. Design test rule: preliminary test analysis and test alarms of new scenario rules.

[0042] Optionally, the initial alarm log set is parsed to obtain target alarm information, including:

[0043] The initial alarm log set is parsed based on the macro association rule to obtain the first alarm information.

[0044] In this embodiment, the initial alarm log set is parsed based on the macro-association rule to obtain the first alarm information in the following manner: the initial alarm log set is parsed based on the macro-association rule to obtain the first alarm data and the handling information of the first alarm data.

[0045] Based on the user and entity behavior analysis rules, the initial alarm log set is parsed to obtain second alarm information.

[0046] In this embodiment, based on the user and entity behavior analysis rules, the initial alarm log set is parsed to obtain the second alarm information in the following manner: based on the user and entity behavior analysis rules, the initial alarm log set is parsed to obtain the second alarm data and the handling information of the second alarm data.

[0047] Based on the extended intelligent analysis rule, the initial alarm log set is parsed to obtain third alarm information.

[0048] In this embodiment, the initial alarm log set is parsed based on the extended intelligent analysis rule to obtain the third alarm information. The method can be: based on the extended intelligent analysis rule, the initial alarm log set is parsed to obtain the third alarm data and the handling information of the third alarm data.

[0049] Target warning information is determined according to the first warning information, the second warning information and the third warning information.

[0050] In this embodiment, according to the first warning information, the second warning information and the third warning information, the method for determining the target warning information may be: merging the first warning information, the second warning information and the third warning information to obtain the target warning information. According to the first warning information, the second warning information and the third warning information, the method for determining the target warning information may also be: obtaining the union of the first warning information, the second warning information and the third warning information to obtain the target warning information.

[0051] Optionally, the extended intelligent analysis rule includes:

[0052] Based on the K-nearest neighbor algorithm and principal component analysis algorithm, detect abnormal IPs in the initial alarm log set;

[0053] If the data transfer log of the abnormal IP continues to exist within the preset time period, the alarm data is determined to be an abnormal data transfer alarm, and the handling type of the alarm data is first-level manual handling, and the handling content of the first-level manual handling includes: tracing analysis.

[0054] In this embodiment, the logs are stored in ES and can be extracted and analyzed by AI. The K nearest neighbor algorithm and principal component analysis algorithm have been used to detect web access requests from abnormal IPs and to identify suspicious IPs with abnormal data transfer behaviors.

[0055] Optional user and entity behavior analysis rules, including:

[0056] If it is determined based on the initial alarm log set that an abnormal login exists, wherein the abnormal login includes at least one of multi-city remote login, high-frequency login in the early morning, and multiple logins in a short period of time, then the alarm data is determined to be an abnormal login alarm, and the handling type of the alarm data is secondary manual handling, and the handling content of the secondary manual handling includes: investigating and confirming the user behavior.

[0057] In this embodiment, a machine learning algorithm is applied to detect abnormal behavior, and multiple VPN, host, and email alarms are configured, including logins from other cities, high-frequency logins in the early morning, and multiple logins in a short period of time. Example: The absolute median deviation algorithm is used to establish a baseline and discover anomalies such as time and frequency.

[0058] Optional, macro-association rules, including:

[0059] If it is determined based on the initial alarm log set that the number of attacks with the same source and the same target within the preset time period exceeds the number threshold, then the alarm data is determined to be an alarm that the number of attacks with the same source and the same target within the preset time period exceeds the number threshold, and the disposal types of the alarm data include: automatic disposal and first-level manual disposal, and the disposal content of the automatic disposal includes: banning the attack source IP, and the disposal content of the first-level manual disposal includes: checking application assets and tracing analysis.

[0060] In this embodiment, the preset time period is a preset time range, and the number threshold may be a preset value, which is not limited in this embodiment of the present invention.

[0061] In this embodiment, the macro model is mainly developed based on expert experience, red-blue confrontation, daily operations, etc., covering eight major scenarios including network attacks, access control, threat intelligence, denial of service information leakage, anomaly detection, security operation and maintenance, and system security, with a total of more than 100 rule models.

[0062] In a specific example, the Internet intrusion detection device detected more than 25 attacks from the same source and the same target within 1 minute. Rules: It mainly integrates the alarm logs of multiple types of security equipment and the threshold statistics of the number of attacks, which belongs to the correlation statistics type rules; in the model framework, it belongs to the network attack scenario and the production-type front-line alarm rules; the alarm generated has high credibility and high threat level, and the first treatment is to trigger the alarm to respond automatically and ban the attack source IP to eliminate the threat, and the second is to respond manually to further trace the source analysis. If it is determined that the target host has been attacked according to the initial alarm log set, and a log of creating a malicious file is generated on the target host within a preset time period, then the alarm data is determined to be a suspected victim implanted with a malicious file. The types of disposal of the alarm data include: automatic disposal and first-level manual disposal. The disposal content of the automatic disposal includes: banning the attack source IP, and the disposal content of the first-level manual disposal includes: checking application assets and tracing the source analysis.

[0063] In a specific example, a suspected victim was implanted with a malicious file. Rules: It is mainly through comprehensive analysis of the security detection device logs and host logs on the associated channel side. After the security detection device finds that a host at a certain destination address has been attacked, and at the same time, a log of creating a malicious file is generated on the destination host within a certain time window, an alarm will be generated, which belongs to the chain type rule; in the model framework, it belongs to the abnormal access scenario and the production-type front-line alarm rule; it conforms to the attack stage division of the kill chain, and the alarm has high credibility and high threat. The response and disposal are: the alarm triggers the automatic response plan, bans the attack source IP to eliminate the threat, and the second is manual response to check the application assets and conduct traceability analysis.

[0064] S130, splicing the alarm data according to the processing type of the alarm data to obtain a target alarm log set corresponding to each processing type.

[0065] In this embodiment, the method of splicing the alarm data according to the processing type of the alarm data may be: splicing the alarm data corresponding to the same processing type to obtain a target alarm log set corresponding to each processing type.

[0066] S140: Process the target alarm log set corresponding to the automatic handling type based on the security incident orchestration automatic response technology to obtain a first processing result.

[0067] In this embodiment, based on Security Orchestration, Automation and Response (SOAR) technology, a target alarm log set corresponding to the automatic disposal type is processed to obtain a first processing result.

[0068] S150, receiving a second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing.

[0069] It should be noted that the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing needs to be displayed in the interface, and the user processes the alarm logs in the target alarm log set based on the display information in the interface to obtain the second processing result.

[0070] Optionally, receiving a second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing includes:

[0071] Generate a display interface based on the target alarm log set corresponding to the first-level manual processing and the target alarm log set corresponding to the second-level manual processing, wherein the display interface includes: an icon corresponding to the first-level manual processing and an icon corresponding to the second-level manual processing;

[0072] In response to detecting a trigger operation for an icon corresponding to a first-level manual disposal in the display interface, a target alarm log set display interface corresponding to the first-level manual disposal is displayed, and the target alarm log set display interface corresponding to the first-level manual disposal includes: a target alarm log list corresponding to the first-level manual disposal, in response to detecting a touch operation for any target alarm log in the target alarm log list corresponding to the first-level manual disposal, an initial alarm log corresponding to the target alarm log corresponding to the first-level manual disposal is displayed, and a second processing result input by a user for the initial alarm log corresponding to the target alarm log corresponding to the first-level manual disposal is received;

[0073] and / or,

[0074] In response to detecting a trigger operation on the icon corresponding to the secondary manual procedure in the display interface, a target alarm log set display interface corresponding to the secondary manual procedure is displayed, and the target alarm log set display interface corresponding to the secondary manual procedure includes: a target alarm log list corresponding to the secondary manual procedure; in response to detecting a touch operation on any target alarm log in the target alarm log list corresponding to the secondary manual procedure, an initial alarm log corresponding to the target alarm log corresponding to the secondary manual procedure is displayed, and a second processing result input by the user for the initial alarm log corresponding to the target alarm log corresponding to the secondary manual procedure is received.

[0075] In this embodiment, the daily monitoring and handling of security operations is mainly carried out through the alarm monitoring and handling module, which is also the main workbench for front-line duty personnel and information security duty personnel at all levels of the enterprise.

[0076] The company has established a safety operation monitoring and disposal process. The specific system display is as follows:

[0077] Enter the Alarm Center-Alarm Monitoring to view the number of first-level manually handled alarms and second-level manually handled alarms that have not been closed this year.

[0078] Alarm Center - Alarm Monitoring Interface Introduction. The alarm monitoring page automatically refreshes once every 5 seconds. If a new alarm appears, it will flash in the corresponding label position for 1 minute and the alarm ring will sound for 1 minute. The on-duty personnel need to handle the first-level manual handling alarm and the second-level manual handling alarm in time.

[0079] Information security monitoring alarm handling is mainly carried out in the security operation center. According to the dimensions of alarm threat severity, timeliness, and rule accuracy, the alarm rule hierarchical management is implemented, and the relevant alarm rules are configured with labels such as "level one manual handling alarm" and "level two manual handling alarm". It is required that both level one manual handling alarm and level two manual handling alarm must be handled and closed in a timely manner. "Level one manual handling alarm" is a security duty alarm, which requires real-time monitoring and handling by the duty personnel; "level two manual handling alarm" is a retrospective analysis of security threats, the purpose of which is to reduce risks and eliminate false alarms and missed alarms, and requires periodic analysis and handling.

[0080] Enter the Alarm Center-Alarm Monitoring to view the number of first-level manually handled alarms and second-level manually handled alarms that have not been closed this year.

[0081] Alarm Center - Alarm Monitoring Interface Introduction. If a new alarm appears on the alarm monitoring page, it will flash at the label position for 1 minute and the alarm ring will sound for 1 minute (the alarm prompt depends on the situation).

[0082] In this embodiment, the target alarm log collection display interface includes: a query area, a filter area and a target alarm log display area, and the target alarm log display area includes: alarm log start time, alarm log name, disposal order, disposal type, regional organization, alarm type, alarm level, attacker group, victim group, number of alarms, confirmation status, disposal status and operation controls (details control and disposal control); disposal types include: first-level manual disposal and second-level manual disposal, and alarm types include: Web attack, operation and maintenance monitoring alarm and WebShell (WebShell, as the name implies, "web" means that the server obviously needs to open web services, and "shell" means obtaining some degree of operation authority on the server. Hackers have invaded After a website is created, these asp or php backdoor files are usually mixed with normal web page files in the web server's WEB directory. Then, you can use a browser to access these asp or php backdoors to obtain a command execution environment to achieve the purpose of controlling the website server (you can upload and download files, view databases, execute arbitrary program commands, etc.). Since webshell is mostly a command execution environment in the form of web page files such as asp, php, jsp or cgi, it can also be called a web backdoor). The alarm levels include: reminder, warning, serious and emergency. The confirmation status includes: unread, successful attack, failed attack, false alarm, wrong operation and others. The disposal status includes: disposal, pending disposal, disposal completed and ignored. The filtering area includes: alarm level filtering area, alarm type filtering area, disposal status filtering area and confirmation status filtering area. The query area includes: time drop-down box. The time drop-down box includes: today control, this year control, and custom control. If the user clicks today control, he can view today's alarm. If the user clicks on this year's control, they can view all the unclosed alarms for this year (the number displayed on the alarm monitoring page is the number of alarms for the whole year, and the details page entered by clicking on any time control is the alarms for that day). You can customize the time range.

[0083] Click the details control of an alarm log to display the alarm log display interface (you can view the specific information of the alarm log). The alarm log display interface includes: the alarm log attribute information display area, the alarm log basic information display area, the alarm log initial alarm list display area, the alarm log historical experience display area, the alarm log similar alarm display area and the victim details display area. The alarm log attribute information display area includes: the alarm log start time, the alarm log end time, the alarm log alarm type, the alarm log affected host, the alarm stage, the attack direction, the ID and the disposal suggestion. The alarm log basic information display area includes: attacker group, victim group, alarm number, alarm content, threat credibility, threat name, threat information, threat type and view more controls. Click the view more control to expand the specific information of the alarm log. The basic information display area of ​​the expanded alarm log also includes: data source, cluster identifier, confirmation status, destination address group, destination address, destination city, data source group, organization to which the rule belongs, judgment result, regional organization, deployment method, deployment region, monitoring traffic area, cluster identifier, log merging strategy, etc. The initial alarm list display area of ​​the alarm log includes: the initial alarm log list corresponding to the target alarm log, the initial alarm log list includes multiple initial alarm logs, and the alarm occurrence time, alarm name, alarm type, source address, source port, destination address, destination port, domain name, associated log control and drill-down log control corresponding to each initial alarm log. Click the associated log control to display the associated log display interface, and you can view all logs that generate the target alarm log. The associated log display interface includes the associated log list, and the associated log list includes: log occurrence time, log name, log level, source address, source port, destination address, destination port, domain name and expansion control. Click the expansion control to display the log details, and you can expand to view the specific log details for further analysis and disposal. Log details include: source city, destination area, threat name, threat information, deployment method, log subcategory, IP protocol, receiving time, object service, source security domain, destination city, threat type, policy name, access device type, transmission protocol, log tag, protocol, ID, parsing rule name, collector data source, and data source. You can also click the drill-down log control to jump to the log query page for viewing and analysis. If the initial alarm log does not contain enough information, you need to log in to the corresponding security device for detailed viewing and analysis. Click the source address or destination address to associate assets, bans, plans, data analysis, etc. You can perform associated queries, further analysis, and disposal for the source and destination addresses. For example, click the destination address to display the expand entity portrait control, query asset details control, view ban details control, drill down to data analysis control, and disposal plan control.Click the disposal plan control to call the pre-configured plan to handle the alarm. The input parameter is the alarm log. Click the association analysis rule name in the basic information display area of ​​the alarm log to jump to the association analysis rule page to view the rule configuration details. Auxiliary tools can quickly decode and view the encoded information.

[0084] In a specific example, Figure 2 As shown, in order to effectively carry out alarm monitoring response and disposal, in the network security operation work of the enterprise, for the first and second level manual disposal, it is necessary to complete the closed-loop response disposal. The following is the response and disposal process of monitoring alarms:

[0085] Step 1: On-duty monitoring;

[0086] Step 2: Analyze the response;

[0087] Step 3: If the alarm is invalid, go to step 4; if it is a false alarm, go to step 5; if it is other alarms, go to step 6;

[0088] Step 4: Mark and close;

[0089] Step 5: Fill in the reason for the false alarm and close it;

[0090] Step 6: Create an alarm investigation and disposal form;

[0091] Step 7: Organize relevant support roles to carry out processing;

[0092] Step 8: Determine whether to accept the troubleshooting and disposal suggestions. If accepted, proceed to step 9. If not, provide the specific reasons and re-establish the alarm troubleshooting and disposal form (return to step 6).

[0093] Step 9. Organize and carry out the processing, and after the processing is completed, provide feedback on the results and return to step 6.

[0094] The embodiment of the present invention can display the pressure drop of the alarm log, and the specific means adopted are: respectively counting and calculating the number of alarm logs, the number of alarms, the number of first and second level manual disposals, and the number of event orders in the initial alarm log set, and the above four indicator data are in a typical pyramid shape. In addition, the display content can also include: data source: security operation center; data type: display type; statistical period: day / week / month / quarter.

[0095] As network security threats become increasingly severe, large enterprises need to build an efficient, stable and continuously improved security operation system. The existing security operation system is not clear and accurate in structural description, and lacks a systematic continuous improvement mechanism. Therefore, the data processing method provided in the embodiment of the present invention can also use the PDCA cycle as the core to carry out a structured description and continuous optimization of the security operation system, aiming to improve the overall security operation capability of the enterprise level and ensure the information security and business continuity of the enterprise. Through the four major frameworks of integrated security protection, standardized security operation and maintenance, normalized security verification and intelligent security measurement, comprehensive planning and practice are carried out for the construction of the enterprise-level security operation system, aiming to ensure the information security and business continuity of the enterprise and achieve a steady spiral rise in security operation capabilities, among which, the PDCA cycle: also known as the Deming cycle, a quality management model for continuous improvement, including four stages: plan (Plan), do (Do), check (Check) and act (Act). Enterprise-level security operation: for large enterprises, through the comprehensive use of personnel, processes and tools, etc., to ensure the operation activities of enterprise information security, data protection and business continuity.

[0096] The embodiment of the present invention adopts the PDCA cycle model to construct an enterprise-level security operation system including four main frameworks. These four frameworks correspond to the four stages of the PDCA cycle, namely:

[0097] Plan framework: that is, integrated security protection. In this stage, we clarify the security operation goals, conduct demand analysis and risk assessment, and formulate detailed security strategies and plans. This includes building a comprehensive security protection system to ensure the security of the network, system and data.

[0098] Execution (Do) framework: standardized security operation and maintenance. Organize personnel to perform security operation activities according to the strategies and plans formulated in the planning framework. This includes standardized security operation and maintenance processes, the use of tools, and personnel training to ensure the effective execution of security operation activities.

[0099] Check framework: This is normalized security verification. Continuously monitor, evaluate and audit security operations in the execution framework. By collecting and analyzing data such as security logs and event reports, the effectiveness and stability of the security operation system can be verified, and potential security risks can be discovered.

[0100] Act framework: that is, intelligent security measurement. Based on the results of the inspection framework, the security operation system is continuously improved and optimized using intelligent means. This may include automated error repair, intelligent strategy adjustment, process optimization, tool upgrades, etc. At the same time, the improvement results are incorporated into the new planning framework to achieve a spiral upward trend in the security operation system.

[0101] In a specific example, the construction of a security operation system based on PDCA continuous improvement is a comprehensive requirement and organic combination of the three elements of operation activities: personnel, processes and tools, which requires continuous operation and continuous improvement. The construction of an enterprise-level security operation system closely revolves around the implementation of the PDCA (Deming) cycle of continuous quality improvement, including four major security operation frameworks. The four major frameworks correspond to the four links of PDCA respectively. The implementation of the four frameworks also follows the concept of continuous improvement; effectively ensuring the steady spiral rise of enterprise-level security operation capabilities.

[0102] Integrated security protection: Establish a deep protection system covering multiple levels such as network, system, and application to ensure the implementation of baseline standards for security configuration. At the same time, establish a grayscale verification environment to ensure the stability and security of new functions. Develop and rehearse emergency plans to deal with potential security risks.

[0103] Standardized security operation and maintenance: Through alarm monitoring, work order management, security policy management, vulnerability management, standard operating procedures (SOPs), security change management and incident management, standardization and process-based security operation and maintenance are achieved to ensure that various security operations are effectively implemented.

[0104] Regular security verification: Regularly verify the security protection system, including vulnerability scanning, penetration testing, etc., to discover and repair potential security risks. At the same time, organize red-blue confrontation drills to improve emergency response and collaborative handling capabilities.

[0105] Intelligent security measurement: Build a digital security operation map to display security trends and key indicators. Through tools such as the security operation indicator system, security situation screen and dashboard, real-time monitoring of security status can be carried out to provide decision support for management.

[0106] The entire security operation system aims at continuous improvement, and through continuous optimization and adjustment, it improves security protection capabilities to ensure enterprise information security and business continuity. The security operation system can be continuously improved and upgraded, reducing security risks and losses, and improving the efficiency and quality of security operations.

[0107] The technical solution of this embodiment is to obtain an initial alarm log set; parse the initial alarm log set to obtain target alarm information, wherein the target alarm information includes: alarm data and disposal information of the alarm data; splice the alarm data according to the disposal type of the alarm data to obtain a target alarm log set corresponding to each disposal type; process the target alarm log set corresponding to the automatic disposal type based on the security event orchestration automated response technology to obtain a first processing result; receive a second processing result input by the user for the target alarm log set corresponding to the first-level manual disposal and the target alarm log set corresponding to the second-level manual disposal, so as to extract effective alarms from hundreds of millions of alarm logs in the initial alarm log set, reduce invalid alarms, thereby reducing labor costs and improving alarm log processing efficiency.

[0108] Embodiment 2

[0109] Figure 3 This is a schematic diagram of the structure of a data processing device provided by an embodiment of the present invention. This embodiment is applicable to data processing. The device can be implemented in software and / or hardware. The device can be integrated in any device that provides data processing functions, such as Figure 3 As shown, the data processing device specifically includes: an initial alarm log set acquisition module 310, a parsing module 320, a splicing module 330, a first processing module 340 and a second processing module 350.

[0110] Among them, the initial alarm log set acquisition module is used to obtain the initial alarm log set;

[0111] A parsing module, used to parse the initial alarm log set to obtain target alarm information, wherein the target alarm information includes: alarm data and handling information of the alarm data, wherein the handling information includes: handling type and handling content of the handling type, wherein the handling type includes: automatic handling, primary manual handling and secondary manual handling;

[0112] A splicing module is used to splice the alarm data according to the processing type of the alarm data to obtain a target alarm log set corresponding to each processing type;

[0113] A first processing module is used to process a target alarm log set corresponding to the automatic disposal type based on the security incident orchestration automatic response technology to obtain a first processing result;

[0114] The second processing module is used to receive a second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing.

[0115] The above-mentioned product can execute the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0116] Embodiment 3

[0117] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0118] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0119] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0120] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as a data processing method.

[0121] In some embodiments, the data processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the data processing method in any other appropriate manner (e.g., by means of firmware).

[0122] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0123] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0124] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0125] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0126] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0127] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0128] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0129] An embodiment of the present invention further provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the data processing method according to any embodiment of the present invention is implemented.

[0130] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0131] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data processing method, characterized in that: include: Get the initial alarm log set; Parsing the initial alarm log set to obtain target alarm information, the target alarm information includes: alarm data and handling information of the alarm data, wherein the handling information includes: handling type and handling content of the handling type, and the handling type includes: automatic handling, primary manual handling and secondary manual handling; The alarm data is spliced ​​according to the processing type of the alarm data to obtain the target alarm log set corresponding to each processing type; Processing a target alarm log set corresponding to the automatic disposal type based on the security incident orchestration automated response technology to obtain a first processing result; A second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing is received.

2. The method according to claim 1, characterized in that The initial alarm log set is parsed to obtain target alarm information, including: Parsing the initial alarm log set based on the macro association rule to obtain first alarm information; Based on the user and entity behavior analysis rules, the initial alarm log set is parsed to obtain second alarm information; Based on the extended intelligent analysis rule, the initial alarm log set is parsed to obtain third alarm information; Target warning information is determined according to the first warning information, the second warning information and the third warning information.

3. The method according to claim 2, characterized in that The extended intelligent analysis rules include: Based on the K-nearest neighbor algorithm and principal component analysis algorithm, detect abnormal IPs in the initial alarm log set; If the data transfer log of the abnormal IP continues to exist within the preset time period, the alarm data is determined to be an abnormal data transfer alarm, and the handling type of the alarm data is first-level manual handling, and the handling content of the first-level manual handling includes: tracing analysis.

4. The method according to claim 2, characterized in that: User and entity behavior analysis rules, including: If it is determined based on the initial alarm log set that an abnormal login exists, wherein the abnormal login includes at least one of multi-city remote login, high-frequency login in the early morning, and multiple logins in a short period of time, then the alarm data is determined to be an abnormal login alarm, and the handling type of the alarm data is secondary manual handling, and the handling content of the secondary manual handling includes: investigating and confirming the user behavior.

5. The method according to claim 2, characterized in that: Macro-association rules, including: If it is determined according to the initial alarm log set that the number of attacks with the same source and the same target within the preset time period exceeds the number threshold, the alarm data is determined to be an alarm that the number of attacks with the same source and the same target within the preset time period exceeds the number threshold, and the disposal types of the alarm data include: automatic disposal and first-level manual disposal. The disposal content of the automatic disposal includes: banning the attack source IP, and the disposal content of the first-level manual disposal includes: checking application assets and tracing analysis; If after it is determined based on the initial alarm log set that the target host has been attacked, a log of creating a malicious file is generated on the target host within a preset time period, then the alarm data is determined to be that the victim is suspected to have been implanted with a malicious file, and the disposal types of the alarm data include: automatic disposal and first-level manual disposal. The disposal content of the automatic disposal includes: banning the attack source IP, and the disposal content of the first-level manual disposal includes: checking application assets and tracing analysis.

6. The method according to claim 1, characterized in that Receiving a second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing, includes: Generate a display interface based on the target alarm log set corresponding to the first-level manual processing and the target alarm log set corresponding to the second-level manual processing, wherein the display interface includes: an icon corresponding to the first-level manual processing and an icon corresponding to the second-level manual processing; In response to detecting a trigger operation for an icon corresponding to a first-level manual disposal in the display interface, a target alarm log set display interface corresponding to the first-level manual disposal is displayed, and the target alarm log set display interface corresponding to the first-level manual disposal includes: a target alarm log list corresponding to the first-level manual disposal, in response to detecting a touch operation for any target alarm log in the target alarm log list corresponding to the first-level manual disposal, an initial alarm log corresponding to the target alarm log corresponding to the first-level manual disposal is displayed, and a second processing result input by a user for the initial alarm log corresponding to the target alarm log corresponding to the first-level manual disposal is received; and / or, In response to detecting a trigger operation on the icon corresponding to the secondary manual procedure in the display interface, a target alarm log set display interface corresponding to the secondary manual procedure is displayed, and the target alarm log set display interface corresponding to the secondary manual procedure includes: a target alarm log list corresponding to the secondary manual procedure; in response to detecting a touch operation on any target alarm log in the target alarm log list corresponding to the secondary manual procedure, an initial alarm log corresponding to the target alarm log corresponding to the secondary manual procedure is displayed, and a second processing result input by the user for the initial alarm log corresponding to the target alarm log corresponding to the secondary manual procedure is received.

7. A data processing device, characterized in that: include: An initial alarm log set acquisition module is used to acquire an initial alarm log set; A parsing module, used to parse the initial alarm log set to obtain target alarm information, wherein the target alarm information includes: alarm data and handling information of the alarm data, wherein the handling information includes: handling type and handling content of the handling type, wherein the handling type includes: automatic handling, primary manual handling and secondary manual handling; A splicing module is used to splice the alarm data according to the processing type of the alarm data to obtain a target alarm log set corresponding to each processing type; A first processing module is used to process a target alarm log set corresponding to the automatic disposal type based on the security incident orchestration automatic response technology to obtain a first processing result; The second processing module is used to receive a second processing result input by a user for the target alarm log set corresponding to the first-level manual processing and / or the target alarm log set corresponding to the second-level manual processing.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the data processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data processing method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the data processing method according to any one of claims 1 to 6.

Images