Threat detection system based on ATTCK framework

Abstract

The invention discloses a method based on ATTamp; the invention discloses a threat detection system of a CK framework. The method comprises the following steps: establishing ATTamp; through the CK attack and defense knowledge base and the threat detection rule, accurate identification and rapid tracing of abnormal behaviors in the enterprise network environment are realized. According to the system, a multi-dimensional data acquisition strategy is adopted to acquire key data in an enterprise network environment, and the system is based on ATTamp; a CK framework constructs a detection rule to perform real-time matching, meanwhile, a statistical analysis technology and a machine learning algorithm are combined to comprehensively identify abnormal behaviors therein, and correlation is realized through source analysis and time sequence analysis, so that an attack link is restored and constructed. The system also supports a visual display and grading alarm mechanism of attack links, and realizes real-time early warning of abnormal behaviors. The method has the technical advantages of being high in detection accuracy, high in traceability efficiency, high in expandability and the like, and provides timely and effective decision support for enterprise safety protection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a threat detection system based on the ATT&CK framework. Background Art

[0002] With the rapid development of information technology, cyber attack methods are becoming increasingly complex and diverse. Traditional signature-based security protection measures such as firewalls, intrusion detection / prevention systems (IDS / IPS), etc., show obvious limitations when facing new unknown threats. In particular, APT (Advanced Persistent Threat) attacks are difficult for traditional security tools to effectively detect and defend against due to their strong concealment, long duration, and flexible and changeable attack methods. According to statistics, global APT organizations were active frequently in 2023, with an average attack latency of more than 200 days, causing huge security risks and economic losses to enterprises and organizations. The ATT&CK framework developed by MITRE is a globally recognized cyber threat knowledge base that describes in detail the various tactics and techniques that attackers may use at different stages of an attack. The framework has become an important reference standard in the field of cybersecurity, providing a systematic theoretical basis for threat detection and defense.

[0003] However, in terms of converting the ATT&CK framework into actual detection capabilities, existing threat detection systems have the following problems: The detection rules have limited coverage and cannot fully identify various attack methods, resulting in severely limited detection capabilities. The detection mechanism relies too much on predefined static rules, which can neither effectively identify known attack methods that have been mutated nor discover unknown threats. It only provides isolated warning information for identified abnormal behaviors, lacks the ability to correlate and analyze attack behaviors, and cannot achieve fast and accurate attack tracing.

[0004] Therefore, there is an urgent need for a new threat detection system that can systematically utilize the ATT&CK framework to achieve comprehensive detection rule coverage, multi-dimensional detection decision-making mechanisms, and attack chain-based correlation analysis capabilities, so as to effectively respond to the increasingly severe network security challenges and provide organizations with more reliable security protection capabilities. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] In order to solve the above problems, the present invention provides a threat detection system based on the ATT&CK framework. Relying on the threat model provided by the ATT&CK framework, the present invention constructs a complete detection rule knowledge base, which comprehensively covers various tactics and techniques that attackers may adopt, thereby improving the comprehensiveness of threat detection. In terms of detection, an innovative multi-dimensional detection decision mechanism is adopted. The system constructs a comprehensive threat identification framework by combining rule matching technology, statistical analysis technology and machine learning algorithms to achieve effective identification of known threats and unknown threats. At the same time, based on the tactical matrix and attack link model of the ATT&CK framework, the system can quickly associate scattered attack behaviors, construct a complete attack path, and achieve efficient and accurate threat tracing through visual link display.

[0007] (II) Technical solution

[0008] To achieve the above objectives, the present invention provides a threat detection system based on the ATT&CK framework, which is implemented through the following technical solutions:

[0009] A threat detection system based on an ATT&CK framework, characterized by comprising a data collection module (21), a data processing module (22), an ATT&CK rule module (23), an abnormal behavior detection module (24), an attack link management module (25), and a security alarm module (26).

[0010] The data collection module (21) is used to collect various security-related data from the enterprise network environment. The data processing module (22) cleans the collected raw data. The ATT&CK rule module (23) extracts the attack techniques and tactics defined in the ATT&CK framework into a technique and tactic library, and extracts corresponding detection rules based on the technique and tactic library. The abnormal behavior detection module (24) comprehensively evaluates the abnormal behavior through rule matching, statistical analysis and machine learning. The attack link management module (25) performs correlation analysis on the detected abnormal behavior, and constructs an attack link according to the tactical link model of the ATT&CK framework for visual display. The security alarm module (26) supports multi-channel alarms for abnormal behaviors that exceed a preset threat threshold.

[0011] Furthermore, the data collection module includes a host log collection module, an application log collection module, a network data collection module and a security device log collection module.

[0012] Furthermore, the host log collection module collects Windows system logs through the Sysmon tool and collects Linux system logs using the Syslog protocol.

[0013] Furthermore, the application log collection module collects logs generated by application programs and middleware by deploying probes in the target system.

[0014] Furthermore, the network data acquisition module captures data packets generated by switches and routers in the network environment by means of port mirroring.

[0015] Furthermore, the security device log collection module collects security alarm logs generated by firewalls and intrusion detection / prevention devices (IDS / IPS) by deploying probes on the security device system.

[0016] Furthermore, the data processing module processes the collected raw data, including the following steps:

[0017] The data analysis library pandas is used for data cleaning to remove duplicate records, process missing values, and eliminate outliers.

[0018] Regular expression technology is used to extract key field information such as network addresses, user information, system processes, etc. in the data.

[0019] JSON serialization is used to achieve unified format conversion of extracted fields and package them into standard JSON objects to ensure the consistency and parsability of the extracted fields and facilitate subsequent analysis.

[0020] Furthermore, the ATT&CK rule module includes a technical and tactical library module and a rule library module.

[0021] Furthermore, the technical and tactical library module stores detailed information on tactics, techniques, and sub-techniques defined in the ATT&CK framework, including the following steps:

[0022] All technical and tactical data are obtained through the API interface of the ATT&CK framework, including basic information such as the ID of each technology, the tactics it belongs to, the technology name, and description.

[0023] The acquired original technical and tactical data is cleaned, irrelevant information such as HTML tags and special characters in the description text are removed, and the data is organized into a unified structured format and stored in the database.

[0024] Furthermore, the rule base module extracts features of the detection indicators corresponding to the attack techniques in the technique and tactics base module, and forms corresponding detection rules according to the extracted features, including the following steps:

[0025] The TF-IDF algorithm is used to extract keywords, and the TF-IDF value of each word is calculated based on the term frequency (TF) and inverse document frequency (IDF). The TextRank algorithm is used to sort the keywords in the text and determine the most important keywords.

[0026] The TF-IDF value and TextRank score are combined and normalized, and a weighted sum is used to obtain a list of keywords that best represent the ATT&CK technical description.

[0027] Corresponding detection rules are further formed based on the extracted keyword list.

[0028] Furthermore, the abnormal behavior detection module includes a rule matching module, a statistical analysis module, a machine learning module, and a comprehensive decision-making module.

[0029] Furthermore, the rule matching module matches the data by calling the detection rules defined in the rule base module, and identifies the behaviors that meet the attack characteristics through regular expressions and string matching.

[0030] Furthermore, the statistical analysis module discovers abnormal data patterns and behavioral trends by performing statistical analysis on the data.

[0031] Furthermore, the machine learning module detects abnormal activities that deviate from normal behavior patterns through a machine learning algorithm, including the following steps:

[0032] The random forest algorithm is used to extract features from the data passed in by the data processing module, calculate the importance score of each feature, and identify the most valuable features for anomaly detection.

[0033] The LSTM model is used to perform time series analysis and anomaly detection on the feature-converted data. The normal behavior patterns in the historical data are used to train the LSTM model to build a normal behavior baseline, and the model is used to predict the feature-converted data to determine whether there is potential abnormal activity that deviates significantly from normal behavior.

[0034] Furthermore, the comprehensive decision-making module performs comprehensive evaluation by obtaining the results of the rule matching module, the statistical analysis module and the machine learning module to accurately identify abnormal behaviors in the network.

[0035] Furthermore, the attack chain management module is responsible for obtaining abnormal behaviors from the comprehensive decision-making module, and through source analysis and timing analysis, the discrete abnormal behavior events are associated to form a complete attack chain and visualized.

[0036] Furthermore, the security alert module implements intelligent alerts for abnormal behaviors detected by the comprehensive decision-making module through integration with Alertmanager, and supports multiple alert methods such as email and enterprise WeChat.

[0037] (III) Advantages of the solution

[0038] It can be seen from the above technical solutions that, compared with the existing technical solutions, the present invention has the following advantages:

[0039] (1) Relying on the threat model provided by the ATT&CK framework, a comprehensive detection rule knowledge base is built, covering various tactics and techniques that attackers can use to ensure the comprehensiveness and accuracy of threat detection.

[0040] (2) A comprehensive threat identification framework is constructed by adopting a multi-dimensional detection decision mechanism combined with rule matching, statistical analysis and machine learning algorithms. It can effectively identify known and unknown threats, reduce false alarm rates and missed alarm rates, and improve the overall performance of the system.

[0041] (3) Comprehensive decision-making uses Dempster-Shafer evidence theory, fuzzy weight optimization method and Bayesian final decision to integrate and evaluate the results of each detection submodule at multiple levels. This method not only improves the accuracy and reliability of the detection results, but also enhances the system's adaptive ability and can make more accurate judgments in complex environments.

[0042] (4) Perform correlation analysis on discrete abnormal behaviors, build a complete attack chain, and achieve efficient threat tracing through visual display.

[0043] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and its implementation method, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the examples of the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below.

[0045] Figure 1 A schematic diagram of a threat detection system architecture based on the ATT&CK framework provided in an embodiment of the present application; Figure 2 A flowchart of combining the TF-IDF and TextRank algorithms provided in an embodiment of the present invention to extract features and classify ATT&CK framework techniques and tactics. Figure 3 A flowchart of anomaly detection using a random forest algorithm and an LSTM model is provided in an embodiment of the present invention.

[0046] In the figure: 21-data collection module; 211-host log collection module; 212-application log collection module; 213-network data collection module; 214-security device log collection module; 22-data processing module; 23-ATT&CK rule module; 231-technical and tactical library module; 232-rule library module; 24-abnormal behavior detection module; 241-rule matching module; 242-statistical analysis module; 243-machine learning module; 244-comprehensive decision-making module; 25-attack link management module; 26-security alarm module. DETAILED DESCRIPTION

[0047] The various embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0048] The present invention proposes a threat detection system based on the ATT&CK framework, which uses technical means to accurately detect known threats and predict unknown threats, while realizing functions such as attack link visualization and multi-channel alarm.

[0049] like Figure 1 As shown, the present invention provides a threat detection system based on the ATT&CK framework, including a data collection module 21, a data processing module 22, an ATT&CK rule module 23, an abnormal behavior detection module 24, an attack link management module 25, and a security alarm module 26; the data collection module includes a host log collection module 211, an application log collection module 212, a network data collection module 213, and a security device log collection module 214, the ATT&CK rule module 23 includes a technical and tactical library module 231 and a rule library module 232, and the abnormal behavior detection module 24 includes a rule matching module 241, a statistical analysis module 242, a machine learning module 243, and a comprehensive decision-making module 244.

[0050] The data collection module 21 is used to interact with various data sources to collect various data in the enterprise network environment, including logs, network traffic, terminal events, etc., including a host log collection module 211, an application log collection module 212, a network data collection module 213, and a security device log collection module 214.

[0051] The host log collection module 211 implements efficient collection of host logs by deploying the Sysmon tool in the Windows system and enabling the Syslog service on the Linux system.

[0052] The application log collection module 212 uniformly adopts the method of deploying probes to collect Web application program and database logs for different types of application systems.

[0053] The network data acquisition module 213 uses port mirroring to mirror the ports of switches and routers in the target network that need to be monitored to an idle physical port to capture network traffic data packets in real time.

[0054] The security device log collection module 214 also uses a unified deployment probe method to collect alarm events generated by firewalls and intrusion detection / prevention devices (IDS / IPS).

[0055] The data processing module 22 cleans the data through pandas, uses regular expressions to extract key fields and perform field mapping, and finally converts the mapped fields into a standardized JSON format for output.

[0056] The ATT&CK rule module 23 includes a technical and tactical library module 231 and a rule library module 232 .

[0057] The technical and tactical library module 231 extracts and stores detailed information on tactics, techniques, and sub-techniques in the ATT&CK framework. The specific steps are as follows:

[0058] All technical and tactical data are obtained through the API interface of the ATT&CK framework, including basic information such as the ID of each technology, the tactics it belongs to, the technology name, and description.

[0059] The acquired original technical and tactical data is cleaned, irrelevant information such as HTML tags and special characters in the description text are removed, and the data is organized into a unified structured format and stored in the database.

[0060] The rule base module 232 uses the machine learning algorithms TF-IDF and TextRank to extract key features in the ATT&CK technical description and convert them into corresponding detection rules.

[0061] Specifically, Figure 2 As shown in the figure, the ATT&CK framework techniques and tactics are extracted and classified based on the combination of TF-IDF and TextRank algorithms. First, the TF-IDF algorithm is used to extract keywords from the ATT&CK framework techniques and tactics description text, and the TF-IDF value of each word is calculated based on the word frequency and text frequency. The word frequency (TF) represents the probability of keyword w appearing in the document Di:

[0062]

[0063] Where count(w) is the number of occurrences of keyword w, and |Di| is the number of all words in document Di. The inverse document frequency (IDF) reflects the prevalence of keywords - the more common a word is, the lower its IDF value is; conversely, the higher its IDF value is. IDF is defined as follows:

[0064]

[0065] Where N is the total number of documents, and I(w,Di) indicates whether document Di contains the keyword. If so, it is 1, and if not, it is 0. The TF-IDF value of keyword w in document Di is:

[0066]

[0067] Secondly, the TextRank algorithm is used to sort the keywords in the text and the words with the highest scores are used as keywords. First, the given text T is segmented into complete sentences, that is:

[0068]

[0069] For each sentence Si belonging to T, perform word segmentation and part-of-speech tagging, and filter out stop words, leaving only the words of the specified word, such as nouns, verbs, and adjectives, that is:

[0070]

[0071] Among them, ti,j are the candidate keywords after retention. Construct the candidate keyword graph G=(V,E), where V is a node set consisting of candidate keywords, and then use the co-occurrence relationship to construct the edge between any two points. The edge between two nodes exists only when their corresponding words co-occur in a window of length K, where K represents the window university, that is, at most K words co-occur. Iterate and propagate the weight of each node according to the following formula until convergence.

[0072]

[0073] The node weights are sorted in reverse order to obtain the most important T words as candidate keywords. These T words are marked in the original text, and if they form adjacent phrases, they are combined into multi-word keywords.

[0074] Then, the TF-IDF value is combined with the TextRank score, but due to the different weight value ranges of the two algorithms, normalization is required. For some words that are too common or too rare, filtering or weighting can be performed. Use the linear scaling method to map the TF-IDF value to the range of [0,1]:

[0075] Among them, min_TF-IDF and max_TF-IDF are the minimum and maximum TF-IDF values ​​of all words in the text respectively. The softmax method is used to map the TextRank score to the range of [0,1]:

[0076]

[0077] Among them, TextRank is the score calculated by the TextRank algorithm, and sum(exp(TextRank)) is the exponential sum of all keyword scores. Use the following formula to perform a weighted sum of the TF-IDF value and the TextRank score to calculate the comprehensive score of the keyword:

[0078] Among them, TF-IDF_weight and TextRank_weight are the weight values ​​of TF-IDF and TextRank respectively, which can be adjusted according to the actual situation. Through normalization, the weight values ​​obtained by different algorithms are mapped to the same range, and the final keyword list is obtained by comprehensive sorting.

[0079] The abnormal behavior detection module 24 includes a rule matching module 241 , a statistical analysis module 242 , a machine learning module 243 , and a comprehensive decision-making module 244 .

[0080] The rule matching module 241 mainly performs rule matching by calling the detection rules in the rule base module 232 and the data input by the data processing module 22 , and transmits the successfully matched abnormal behavior data to the comprehensive decision module 244 .

[0081] The statistical analysis module 242 mainly analyzes the data transmitted by the data processing module 22 based on statistical methods, including various statistical means such as frequency analysis, time series analysis and correlation analysis, and establishes a baseline model by calculating the statistical characteristics of the data. When the data deviates from the normal baseline range or abnormal statistical characteristics appear, the relevant abnormal data is passed to the comprehensive decision-making module 244.

[0082] The machine learning module 243 mainly uses the random forest algorithm and the LSTM model in combination with the data input by the data processing module 22 for modeling and anomaly detection, predicts and classifies real-time data, and when data that deviates significantly from normal behavior patterns is detected, it is identified as potential abnormal behavior and passed to the comprehensive decision-making module 244.

[0083] Specifically, Figure 3As shown. The random forest model contains many decision trees. The Bootstrap resampling technique is used to randomly sample from the data set to construct and train each decision tree in the model. Finally, each decision tree is combined, and then the final result is obtained by voting. RF has a strong tolerance for outliers and noise. When facing massive high-dimensional data, it can obtain the importance score of features while analyzing the data. Use random forest to score the importance of data features, calculate the contribution of each feature on each decision tree in the random forest, that is, solve the Gini index (Gini) difference before and after the branch of the feature at a certain node, solve all the features contained in the data, divide the Gini index difference of a single feature by the Gini index difference of all features, and obtain the normalized contribution of a feature. Obtain the importance weight of each feature, and compare and sort the importance weights between features. The calculation method of the Gini index is:

[0084]

[0085] Among them, K means there are K categories, and pk represents the weight of the kth type.

[0086] The Gini index change value of each feature j at node m is represented by VIMjm, and its calculation method is:

[0087]

[0088] Among them, GIl and GIr represent the Gini index of the two new nodes generated after the node m branches.

[0089] Finally, the contribution of feature j is normalized and recorded as the importance score of feature j:

[0090]

[0091] Among them, VIM is the sum of the Gini index differences of all features.

[0092] Long Short-Term Memory Network (LSTM) is an improved time recurrent neural network. Due to its special network structure, it is suitable for processing time series data. In traditional RNN, when the sequence of continuous data becomes longer, the expansion time step will be too long. When back-propagating to update parameters, the gradient must be continuously multiplied according to the time step, which will lead to the problem of gradient vanishing. The introduction of gate control units such as forget gate and input gate in LSTM combines short-term memory and long-term memory to control the circulation and loss of features, which can solve the problem of gradient vanishing caused by RNN's inability to handle long-distance dependencies to a certain extent. LSTM contains 3 gate units, namely input gate it, forget gate ft, and output gate ot. The most important of them is the forget gate, which is used to determine which memory information in the previous moment needs to be retained and lost. The input gate determines the memory information needed at this moment, and the output gate is used to determine the output content. The relevant calculation formula is as follows:

[0093]

[0094] Among them, it represents the input gate, ft represents the forget gate, ot represents the output gate, Ct represents the cell state (long-term memory), ht represents the memory (short-term memory), represents the candidate state (new knowledge), Wi, Wf, Wo are weight matrices, bi, bf, bo are bias terms, xt is the input information at time t, ht represents the intermediate output, tanh represents the hyperbolic tangent activation function, and σ represents the Sigmoid activation function.

[0095] Combining the characteristics of random forest and LSTM neural network, random forest is used for feature extraction, and LSTM network is used as a classifier for learning and classification, so as to achieve accurate detection of abnormal data and prediction of unknown anomalies.

[0096] The comprehensive decision module 244 performs comprehensive analysis and decision-making based on the detection results from the rule matching module 241, the statistical analysis module 242 and the machine learning module 243, so as to achieve high-precision threat detection.

[0097] The Dempster-Shafer evidence theory is used to calculate the basic probability distribution of the original results of each detection submodule and perform preliminary fusion through the DS combination rule; based on the fuzzy weight optimization method, the fuzzy matrix and weight vector of the detection index are constructed, and the weighted results are obtained through fuzzy operation;

[0098] The Bayesian final decision is adopted, and the results of DS evidence theory fusion and fuzzy weight optimization weighting are used as conditional probability input. The final threat probability is calculated through the Bayesian formula to achieve multi-level result integration.

[0099] The attack link management module 25 is based on the threat detection results output by the comprehensive decision module 244, associates discrete abnormal behavior events through time series correlation analysis, builds a complete attack link according to the tactical link model of the ATT&CK framework, and displays it visually.

[0100] The security alarm module 26 is integrated with the Alertmanager, and uses its existing alarm grouping, suppression and silencing functions to intelligently alarm the threat detection results output by the comprehensive decision-making module 244, and supports multiple alarm channels such as email, information, and enterprise WeChat.

Claims

1. A threat detection system based on the ATT&CK framework, characterized in that: The system comprises a data collection module (21), a data processing module (22), an ATT&CK rule module (23), an abnormal behavior detection module (24), an attack link management module (25), and a security alarm module (26). The data collection module (21) collects various security-related data from the enterprise network environment, the data processing module (22) cleans the collected raw data, the ATT&CK rule module (23) extracts the attack techniques and tactics defined in the ATT&CK framework into a technique and tactic library, and extracts corresponding detection rules based on the technique and tactic library, the abnormal behavior detection module (24) comprehensively evaluates abnormal behaviors in the network through rule matching, statistical analysis, and machine learning, the attack link management module (25) performs correlation analysis on the detected abnormal behaviors, and constructs an attack link based on the ATT&CK framework tactical link model for visual display, and the security alarm module (26) supports multi-channel alarms for abnormal behaviors that exceed a preset threat threshold.

2. A threat detection system based on the ATT&CK framework according to claim 1, characterized in that: The data collection module (21) comprises a host log collection module (211), an application log collection module (212), a network data collection module (213), and a security device log collection module (214).

3. A threat detection system based on the ATT&CK framework according to claim 2, characterized in that: The host log collection module (211) collects log information of Windows and Linux systems respectively by using the Sysmon tool and the Syslog protocol; the application log collection module (212) collects logs generated by application programs and middleware by deploying probes; the network data collection module (213) captures data packets generated by switches and routers by using mirror ports; and the security device log collection module (214) collects alarm logs generated by security devices such as firewalls, IDS / IPS, etc. by deploying probes.

4. The threat detection system based on the ATT&CK framework according to claim 1, characterized in that: The data processing module (22) cleans the data collected from various data sources, extracts keywords and performs field mapping, and finally converts the data into a standardized JSON format for output.

5. The threat detection system based on the ATT&CK framework according to claim 1, characterized in that: The ATT&CK rule module (23) includes a technical and tactical library module (231) and a rule library module (232).

6. A threat detection system based on the ATT&CK framework according to claim 5, characterized in that: The technical and tactical library module (231) stores detailed information on tactics, techniques, and sub-techniques defined in the ATT&CK framework, including technology ID, technology name, technology description, detection suggestions, mitigation suggestions, etc.; the rule library module (232) extracts characteristic indicators of attack techniques from the technical and tactical library and generates corresponding detection rules.

7. The threat detection system based on the ATT&CK framework according to claim 1, characterized in that: The abnormal behavior detection module (24) comprises a rule matching module (241), a statistical analysis module (242), a machine learning module (243), and a comprehensive decision-making module (244).

8. The threat detection system based on the ATT&CK framework according to claim 7, characterized in that: The rule matching module (241) performs matching analysis on the data processed by the data processing module (22) based on the detection rules of the rule base module (232), and identifies behaviors that meet the attack characteristics through regular expressions, string matching, etc.; The statistical analysis module (242) performs statistical analysis on the data processed by the data processing module (22) to discover abnormal data patterns and behavioral trends; the machine learning module (243) uses a machine learning algorithm to detect abnormal activities that deviate from normal behavioral patterns in the data processed by the data processing module (22) by establishing a behavioral baseline model; and the comprehensive decision module (244) performs comprehensive analysis and evaluation on the results of each detection module to generate a final abnormal behavior detection result.

9. The threat detection system based on the ATT&CK framework according to claim 1, characterized in that: The attack link management module (25) receives the anomaly detection result transmitted by the comprehensive decision module (244), and associates discrete abnormal behavior events into a complete attack link through time series association analysis, thereby performing visual display.

10. The threat detection system based on the ATT&CK framework according to claim 1, characterized in that: The security alarm module (26) is integrated with the Alertmanager, and uses the alarm grouping, suppression and silencing functions provided by the Alertmanager to intelligently alarm the abnormal detection results transmitted by the comprehensive decision-making module (244), and supports alarms through multiple channels such as email, DingTalk, and enterprise WeChat.

Images