Alarm handling method and device based on graph deep learning, equipment, medium and program product

Abstract

Embodiments of the present application disclose an alarm handling scheme generation method, a device, a medium and a program product. The method comprises: obtaining alarm information; generating at least two alarm node feature vectors according to the alarm information, and determining an alarm node relationship graph according to the alarm node feature vectors; determining an alarm graph feature vector according to the alarm node feature vectors and the graph structure of the alarm node relationship graph; inputting the alarm graph feature vector into a pre-constructed handling scheme generation model to determine an alarm handling scheme corresponding to each alarm node of the alarm information; wherein the alarm node relationship graph is a directed graph with attack transceiving addresses as nodes and attack information between the attack transceiving addresses as edges. In the determination of the alarm handling scheme, the complex correlation between different alarms can be fully considered, the detection and response capabilities for complex alarms and unknown alarm threats are improved, the adaptability of the generated alarm handling scheme is better, and the generation efficiency of the alarm handling scheme is improved.

Description

Technical Field

[0001] This invention relates to the field of power network security technology, and in particular to an alarm handling method, apparatus, equipment, medium and program product based on graph deep learning. Background Technology

[0002] With the rapid development of network technology, networks are becoming increasingly large-scale, and network technology is being applied more and more to power systems, becoming an important technical basis for establishing power information systems. However, attacks between different network nodes may occur during network operation, affecting the stability of power network operation, and timely handling of attack threats is necessary.

[0003] Existing threat management technologies primarily rely on automated incident response tools and static security information management systems. Automated incident response tools typically set up a series of automated scripts based on known attack patterns. These scripts trigger a series of predefined actions, such as blocking IP addresses, isolating devices, or sending alert notifications. However, these tools usually rely on predefined rules and scripts to process alert information. In practical applications, these schemes and scripts are often designed based on known threat scenarios and individual alert messages, making them very passive and lacking flexibility and adaptability when facing newly emerging unknown threats. This limits the processing capabilities of existing threat management technologies to established patterns for dealing with known threats, making it difficult to effectively determine the potential correlations between alert messages, resulting in difficulties in achieving the expected processing results when handling complex attacks.

[0004] Meanwhile, the aforementioned threat mitigation technologies can only generate mitigation plans for known threats. For unknown threats, the generation of mitigation plans currently relies heavily on manual analysis and judgment. This method not only consumes significant manpower and time, but also struggles to promptly identify correlations between high-net-worth individuals and large-scale alerts, thus failing to seize opportunities to respond to complex attacks in a timely manner. This inefficiency and error-prone nature severely restricts network security defense capabilities. Summary of the Invention

[0005] This invention provides an alarm handling method, apparatus, device, medium, and program product based on graph deep learning. It constructs feature vectors containing the correlation between alarms from the acquired alarm information, and then automatically generates alarm handling schemes based on the constructed feature vectors. When determining the alarm handling scheme, it fully considers the complex correlation between different alarms, and improves the detection and response capabilities for unknown alarm threats. This makes the generated alarm handling schemes more adaptable and improves the generation efficiency of alarm handling schemes.

[0006] In a first aspect, embodiments of the present invention provide an alarm handling method based on graph deep learning, comprising:

[0007] Obtain alarm information;

[0008] Generate at least two alarm node feature vectors based on the alarm information, and determine the alarm node relationship graph based on the feature vectors of each alarm node;

[0009] The alarm graph feature vector is determined based on the feature vector of each alarm node and the graph structure of the alarm node relationship graph;

[0010] The alarm graph feature vector is input into the pre-built handling scheme generation model to determine the alarm handling scheme for each alarm node corresponding to the alarm information;

[0011] The alarm node relationship graph is a directed graph with attack send / receive addresses as nodes and attack information between them as edges.

[0012] Secondly, embodiments of the present invention also provide an alarm handling device based on graph deep learning, comprising:

[0013] The information acquisition module is used to acquire alarm information;

[0014] The relationship graph determination module is used to generate at least two alarm node feature vectors based on alarm information, and to determine the alarm node relationship graph based on each alarm node feature vector.

[0015] The graph vector determination module is used to determine the alarm graph feature vector based on the feature vectors of each alarm node and the graph structure of the alarm node relationship graph.

[0016] The solution generation module is used to input the alarm graph feature vector into the pre-built solution generation model to determine the alarm handling solution for each alarm node corresponding to the alarm information.

[0017] The alarm node relationship graph is a directed graph with attack send / receive addresses as nodes and attack information between them as edges.

[0018] Thirdly, embodiments of the present invention also provide an alarm handling device based on graph deep learning, comprising:

[0019] At least one processor; and a memory communicatively connected to the at least one processor;

[0020] The memory stores a programmable program that can be executed by at least one processor. The programmable program is executed by at least one processor so that at least one processor can implement the alarm handling method based on graph deep learning according to any embodiment of the present invention.

[0021] Fourthly, embodiments of the present invention also provide a storage medium containing executable instructions, which, when executed by a programmable processor, are used to perform the alarm handling method based on graph deep learning according to any embodiment of the present invention.

[0022] Fifthly, embodiments of the present invention also provide a program product, including a programmable program, which, when executed by a processor, is used to perform the alarm handling method based on graph deep learning according to any embodiment of the present invention.

[0023] This invention provides an alarm handling method, apparatus, device, medium, and program product based on graph deep learning. The method involves: acquiring alarm information; generating at least two alarm node feature vectors based on the alarm information; determining an alarm node relationship graph based on each alarm node feature vector; determining alarm graph feature vectors based on the graph structure of each alarm node feature vector and the alarm node relationship graph; and inputting the alarm graph feature vectors into a pre-built handling scheme generation model to determine the alarm handling scheme for each alarm node corresponding to the alarm information. The alarm node relationship graph is a directed graph with attack send / receive addresses as nodes and attack information between these addresses as edges. By employing the above technical solution, after acquiring alarm information, the method extracts the alarm node feature vectors corresponding to each individual alarm information based on the alarm information, and constructs an alarm node relationship graph with each attack send / receive address as a node, considering the attack propagation relationship between the feature vectors of each alarm node, thereby obtaining alarm graph feature vectors containing the correlation between alarms. By processing the feature vector of the alarm graph through a pre-built solution generation model, the alarm handling solution is automatically generated. This allows for full consideration of the complex correlations between different alarms when determining the alarm handling solution, improving the detection and response capabilities for complex alarms and unknown alarm threats. The generated alarm handling solutions are more adaptable, and the generation efficiency of alarm handling solutions is improved.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 The flowchart shows an alarm handling method based on graph deep learning provided in Embodiment 1 of the present invention.

[0027] Figure 2 The flowchart shows an alarm handling method based on graph deep learning provided in Embodiment 2 of the present invention.

[0028] Figure 3 This is a structural example diagram of an alarm node relationship diagram provided in Embodiment 2 of the present invention;

[0029] Figure 4 This is an example diagram of the overall structure of a treatment scheme generation model provided in Embodiment 2 of the present invention;

[0030] Figure 5 This is a partial structural example diagram of a treatment scheme generation model provided in Embodiment 2 of the present invention;

[0031] Figure 6 This is a schematic diagram of the structure of an alarm handling device based on graph deep learning provided in Embodiment 3 of the present invention;

[0032] Figure 7 This is a schematic diagram of the structure of an alarm handling device based on graph deep learning, provided in Embodiment 4 of the present invention. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] Example 1

[0036] Figure 1This is a flowchart illustrating an alarm handling method based on graph deep learning, provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where alarms generated in a monitored network environment are comprehensively processed to automatically generate a handling plan for the alarms. This alarm handling plan generation method can be executed by a graph deep learning-based alarm handling device, which can be implemented in software and / or hardware. This graph deep learning-based alarm handling device can be configured within a graph deep learning-based alarm handling equipment. Optionally, the graph deep learning-based alarm handling equipment can be an electronic device, such as a laptop, desktop computer, or smart tablet, etc. This embodiment of the present invention does not impose any limitations on this.

[0037] like Figure 1 As shown in the figure, an alarm handling method based on graph deep learning provided by an embodiment of the present invention specifically includes the following steps:

[0038] S101. Obtain alarm information.

[0039] In this embodiment, alarm information can be specifically understood as information obtained by a device that monitors the network operation status, monitors the operational status of each network node within its monitoring range, and collects and summarizes attacks and abnormal situations when an attack penetration attempt is detected. For example, alarm information may include the address information of the network node that initiated or received the attack within the network operation monitoring range, the attack type, timestamp, alarm type and alarm level based on the attack, etc. This embodiment of the invention does not impose limitations on these aspects.

[0040] Specifically, during the operation of the power system, network security monitoring equipment can be set up to continuously monitor the network security status of the power system. When the monitoring detects an attack or penetration attempt in the corresponding management area, the attack information can be collected directly. Based on the attack information, the alarms that each network node can generate when it receives an attack can be determined. The attack information and alarm information are then combined to obtain alarm information.

[0041] Optionally, when monitoring detects an attack or penetration attempt within the managed area, the system can first attempt to intercept the attack or penetration using pre-designed security devices. If it is determined that interception is not possible, the system can then collect and summarize the attack information as described above to determine the alarm information.

[0042] S102. Generate at least two alarm node feature vectors based on the alarm information, and determine the alarm node relationship diagram based on the feature vectors of each alarm node.

[0043] The alarm node relationship graph is a directed graph with attack send / receive addresses as nodes and attack information between them as edges.

[0044] In this embodiment, the alarm node feature vector can be specifically understood as a feature vector representing the alarm information in vector form, generated by extracting information and transforming features based on a complete alarm in the alarm information. It can be understood that when a node in the network is attacked, the network node that initiated the attack can be clearly identified. Therefore, when generating the alarm node feature vector based on the attacked node, the direction of the generated alarm node feature vector can be from the attacking network node to the attacked node, or it can be understood as a vector containing specific attack feature information, pointing from the attacking network node to the attacked network node.

[0045] In this embodiment, the alarm node relationship graph can be specifically understood as a directed graph used to show the relationships between the feature vectors of multiple alarm nodes. Optionally, the start and end points of each alarm node feature vector can be used as the nodes to be constructed in the directed graph, that is, the send and receive addresses of each attack in the alarm information can be used as the nodes to be constructed in the directed graph. The feature vectors of each alarm node are connected to each node according to the vector direction, that is, the attack information contained in the feature vectors of each alarm node is used as the edges of the directed graph, and the finally constructed directed graph is used as the alarm graph feature vector.

[0046] Specifically, alarm-related information generated under different attacks can be extracted from alarm information. Since each alarm-related information can contain textual, numerical, or coded information, different feature transformation techniques can be used to transform the different types of information for each alarm-related information. The transformed features are then concatenated to obtain the alarm node feature vector corresponding to the alarm-related information. Furthermore, based on the start and end points of the alarm node feature vector and the attack information contained within the alarm node feature vector itself, an alarm node relationship graph is constructed to indicate the correlation between different alarms.

[0047] S103. Determine the alarm graph feature vector based on the feature vector of each alarm node and the graph structure of the alarm node relationship graph.

[0048] Specifically, feature extraction is performed by combining the feature vectors of each alarm node with the graph structure of the alarm node relationship graph to obtain an alarm graph feature vector that contains both the feature information in the feature vector of each alarm node and the relationship features between different alarms based on the graph structure.

[0049] For example, the alarm graph feature vector can be obtained by outputting the graph structure of the relationship graph between each alarm node feature vector and the alarm node feature vector through the readout function.

[0050] S104. Input the alarm graph feature vector into the pre-built handling scheme generation model to determine the alarm handling scheme for each alarm node corresponding to the alarm information.

[0051] In this embodiment, the handling scheme generation model can be specifically understood as a neural network model used to process the graph features in the input through feature extraction, message passing, and message aggregation, in order to output a handling scheme corresponding to the graph features. The alarm node can be specifically understood as a network node that generates an alarm due to an attack. The alarm handling scheme can be specifically understood as a handling scheme used to instruct the alarm node to make adjustments to reduce the impact of the attack.

[0052] Specifically, after obtaining the alarm graph feature vector, the alarm graph feature vector can be input into the pre-built handling scheme generation model. The handling scheme generation model extracts and integrates the alarm-related relationships and specific alarm content in the alarm graph feature vector, and generates and outputs the alarm handling scheme required for each alarm node contained in the alarm graph feature vector after comprehensively considering the relationships between alarms.

[0053] The technical solution of this embodiment involves acquiring alarm information; generating at least two alarm node feature vectors based on the alarm information; determining an alarm node relationship graph based on each alarm node feature vector; determining alarm graph feature vectors based on the graph structure of each alarm node feature vector and the alarm node relationship graph; and inputting the alarm graph feature vectors into a pre-built handling scheme generation model to determine the alarm handling scheme for each alarm node corresponding to the alarm information. The alarm node relationship graph is a directed graph with attack sending / receiving addresses as nodes and attack information between these addresses as edges. By adopting the above technical solution, after acquiring the alarm information, the feature vectors corresponding to each alarm information are extracted based on the alarm information, and an alarm node relationship graph is constructed with each attack sending / receiving address as a node, considering the attack propagation relationship between the feature vectors of each alarm node, thereby obtaining alarm graph feature vectors containing the correlation between alarms. By processing the feature vector of the alarm graph through a pre-built solution generation model, the alarm handling solution is automatically generated. This allows for full consideration of the complex correlations between different alarms when determining the alarm handling solution, improving the detection and response capabilities for complex alarms and unknown alarm threats. The generated alarm handling solutions are more adaptable, and the generation efficiency of alarm handling solutions is improved.

[0054] Example 2

[0055] Figure 2This is a flowchart of an alarm handling method based on graph deep learning provided in Embodiment 2 of the present invention. This embodiment further optimizes the above-mentioned optional technical solutions. Based on the different source and destination addresses corresponding to different alarms, at least two sets of alarm content containing source address, destination address, alarm level, and attack type are extracted from the alarm information. Based on the different feature transformation methods required for different information in each set of alarm content, feature transformation of each information is achieved through methods such as encoding, word embedding, and conversion. The transformed features are concatenated to determine the alarm node feature vector corresponding to the alarm content. Then, based on the feature vectors of each alarm node, the graph nodes and edges used to construct the alarm node relationship graph are determined, completing the construction of the alarm node relationship graph. Meanwhile, the structure of the pre-built handling solution generation model was clarified, as well as the processing method of the graph features of the input handling solution generation model based on the new model structure, so as to realize the automated generation of alarm handling solutions. This allows the complex correlation between different alarms to be fully considered when determining alarm handling solutions, improves the detection and response capabilities for complex alarms and unknown alarm threats, makes the generated alarm handling solutions more adaptable, and improves the generation efficiency of alarm handling solutions.

[0056] like Figure 2 As shown in the figure, an alarm handling method based on graph deep learning provided by an embodiment of the present invention specifically includes the following steps:

[0057] S201, Obtain alarm information.

[0058] S202. Extract at least two sets of alarm content from the alarm information.

[0059] The alarm content should include at least the source address, destination address, alarm type, alarm level, and attack type.

[0060] In this embodiment, the alarm content can be specifically understood as the information related to the alarm and the attack corresponding to an alarm generated by an attack. The source address can be specifically understood as the IP address of the network node that launched the attack. The destination address can be specifically understood as the IP address of the network node that received the attack. The alarm type can be specifically understood as the type of alarm generated based on the received attack. The alarm level can be specifically understood as the level of the generated alarm determined according to a pre-set level classification rule based on the severity of the attack on the network node. It can also be understood as the alarm handling priority determined based on different attack severity levels, which may include classification methods such as urgent, important, medium, and general. This embodiment of the invention does not limit this. The attack type can be specifically understood as the type of attack determined by the network node based on the attack payload.

[0061] Specifically, since alarm information can contain information corresponding to multiple different attacks simultaneously, and the source address, destination address, alarm level, attack type, and alarm type corresponding to different attacks can all be different, information such as source address, destination address, alarm type, alarm level, and attack type belonging to the same attack can be grouped and extracted based on the above differences, and each group of information can be determined as a set of alarm content.

[0062] It is understood that the alarm information may also include the timestamps generated by each attack and the corresponding alarm. When determining each group of alarm content, the timestamp information corresponding to that group of alarm content can be included in the alarm content. At the same time, other information related to a single attack and alarm can also be included in the corresponding alarm content. This embodiment of the invention does not limit the types of information included in the alarm content.

[0063] For example, the alarm information may include the alarm ID corresponding to an attack: "001", alarm type: "data anomaly", timestamp: "2022-01-01 08:00:00", source address: "192.168.1.10", destination address: "192.168.1.20", port: "443", attack type: "SQL injection attack", etc. This embodiment of the invention does not limit this.

[0064] S203. For each set of alarm content, the source address, destination address, alarm type, alarm level, and attack type are encoded, word embedded, converted, and concatenated to determine the alarm node feature vector corresponding to the alarm content.

[0065] The direction of the alarm node feature vector is from the alarm node corresponding to the source address to the alarm node corresponding to the destination address.

[0066] Specifically, based on the different representation methods of different information in each set of alarm content, appropriate feature transformation methods are selected for source address, destination address, alarm type, alarm level, and attack type. For example, feature transformation for alarm type, alarm level, source address, and destination address can be achieved through encoding, while feature transformation for text-based content within the attack type can be achieved through word embedding. Then, the features obtained after feature transformation of each part are concatenated to obtain the alarm node feature vector corresponding to the alarm content, with the direction pointing from the alarm node corresponding to the source address to the alarm node corresponding to the destination address.

[0067] Following the example above, one-hot encoding can be used to transform information such as alarm type, alarm level, source address, and destination address. For example, the one-hot encoding of alarm type "data anomaly" is [1,0,0], the one-hot encoding of alarm level "high" is [0,1,0], the source address is [1,0,0], and the destination address is [0,1,0]. Meanwhile, since the attack type "SQL injection attack" is text information, word embedding feature transformation method in natural language processing can be used to perform word segmentation and mapping embedding processing, represented as [0.5,0.3,0.7,0.2,0.1]. Based on the above method, all components in the alarm content are converted into feature forms, and the converted features are concatenated. As in the example above, they can be concatenated as [1,0,0,0,1,0,1,0,0,0,1,0,0.5,0.3,0.7,0.2,0.1]. In practical applications, the corresponding alarm node feature vector can be obtained according to the different information contained in the alarm content. This embodiment of the invention only uses the above example for demonstration and does not limit the specific encoding and feature concatenation method.

[0068] S204. Using the alarm nodes corresponding to the feature vectors of each alarm node as graph nodes, construct an alarm node relationship graph using the feature vectors of each alarm node as edges.

[0069] For example, since the feature vectors of each alarm node can identify the network nodes that send and receive the attack, and these are used as alarm nodes, the network nodes corresponding to each source and destination address in the alarm information can also be considered as network nodes. Assuming that the source and destination addresses in the alarm information correspond to four IP nodes I1, I2, I3, and I4, the feature vectors of the alarm nodes among these nodes can be represented as b. ij The graph structure formed by the feature vectors of each IP node and alarm node can be represented as G = (V, E), where V is the set of nodes, which is the set of the IP nodes mentioned above, and E is the set of edges representing the relationships between nodes, which is the feature vector of the alarm nodes among the nodes mentioned above. Figure 3 This is a structural example diagram of an alarm node relationship diagram provided in Embodiment 2 of the present invention, as shown below. Figure 3 As shown, the feature graph structure containing the above four IP nodes is illustrated, and each side is a directional feature vector of the alarm node used to indicate attack information.

[0070] S205. Determine the alarm graph feature vector based on the feature vector of each alarm node and the graph structure of the alarm node relationship graph.

[0071] S206. Input the alarm graph feature vector into the pre-built handling scheme generation model to determine the alarm handling scheme for each alarm node corresponding to the alarm information.

[0072] The pre-built treatment scheme generation model is a graph convolutional neural network model with a hybrid normalization layer and a self-attention layer added between each adjacent convolutional layer; the adjacent convolutional layers are residually connected through the hybrid normalization layer and the self-attention layer.

[0073] The processing of the hybrid normalization layer includes left normalization and symmetric normalization.

[0074] In this embodiment, the Graph Convolutional Networks (GCN) model can be understood as a deep learning model specifically designed for processing graph-structured data.

[0075] In this embodiment of the invention, by adding a hybrid normalization layer and a self-attention layer between every two adjacent convolutional layers in the existing graph convolutional neural network model, residual connections between adjacent convolutional layers are achieved based on the added hybrid normalization layer and self-attention layer. This can better balance local and global information, improve the expressive power of the feature, and effectively capture the complex relationships between alarm content and alarm nodes. As a result, the trained response model can provide more accurate and comprehensive response solutions when facing complex network attacks.

[0076] For example, Figure 4 This is an example diagram of the overall structure of a treatment scheme generation model provided in Embodiment 2 of the present invention, as shown below. Figure 4 As shown, where e u The initial layer nodes of the model are generated for the disposal plan. To generate L convolutional layers in the model for the treatment plan, The final embedding vector, determined by the model after L-layer aggregation, is used to generate the alarm handling scheme for each alarm node. Decoding this vector yields the alarm handling scheme for each alarm node. Figure 4 It can be seen that residual connections can be aggregated between different convolutional layers through a mixture of normalization layers and self-attention layers. The outputs of each convolutional layer can also be combined with the output of the last convolutional layer through an overall connection to obtain the final embedding vector.

[0077] Following the example above, Figure 5 This is a partial structural example diagram of a treatment scheme generation model provided in Embodiment 2 of the present invention, taking the initial layer node to the first convolutional layer layer0 in the treatment scheme generation model as an example, based on as follows Figure 5 The structure shown clearly illustrates how the residual connections between each convolutional layer are implemented, as illustrated below:

[0078] 1) Input the output of the previous convolutional layer in a set of adjacent convolutional layers into the hybrid normalization layer to determine the left normalization result and the symmetric normalization result.

[0079] 2) Input the left normalization result and the symmetric normalization result into the self-attention layer to determine the left normalization attention score and the symmetric normalization attention score.

[0080] 3) The sum of the output of the previous convolutional layer, the product of the left normalized attention score and the left normalized result, and the product of the symmetric normalized attention score and the symmetric normalized result is used as the input of the next convolutional layer in the adjacent convolutional layer.

[0081] The above steps are illustrated by way of a formula. Assuming a pair of adjacent convolutional layers are the l-th and (l+1)-th layers in the processing scheme generation model, the value corresponding to the u-th node of the (l+1)-th layer is... It can be represented as:

[0082]

[0083] Where, N u Let v be the set of adjacent nodes of node u; v is an adjacent node of u. This is the normalized form of the adjacency matrix, and

[0084] like Figure 5 As shown, the initial layer node e can be... u The output of the previous convolutional layer is fed into the hybrid normalization layer, which performs left normalization and symmetric normalization on it. The resulting left normalization result is expressed as follows: The symmetric normalization result is expressed as

[0085] in,

[0086] Furthermore, the left-normalized result and the symmetric normalized result are input into the self-attention layer to determine the left-normalized attention score and the symmetric normalized attention score, respectively. Optionally, in order to reduce computational complexity and improve efficiency in this embodiment of the invention, the attention network of the attention layer is simplified by average aggregation. The simplified self-attention layer can be represented as follows:

[0087]

[0088] in, This represents the attention score before normalization. The results represent different normalizations for the (l+1)th layer. After processing with the softmax function, attention scores for different normalizations can be obtained. The specific method for determining it is as follows:

[0089]

[0090] By combining the output of the previous convolutional layer, the left-normalized attention score, the left-normalized result, the symmetric-normalized attention score, and the symmetric-normalized result, the value corresponding to the u-th node in the (l+1)-th layer can be determined. This can be expressed as:

[0091]

[0092] Following this pattern, after L layers of aggregation, global joins are used to integrate the representations of all layers, and average aggregation is used as the fusion scheme for the final layer, resulting in the following: Figure 4 The final embedding vector shown It can be represented as:

[0093]

[0094] By decoding the final embedded vector, the alarm handling scheme for each alarm node corresponding to the alarm information can be obtained. The handling scheme may include: isolating the source address, blocking the target interface, enabling the Web application firewall, triggering security alarms, and increasing access control, etc. Multiple handling schemes can be given for the same alarm node, and this embodiment of the invention does not limit this.

[0095] The technical solution of this embodiment involves extracting at least two sets of alarm content containing source address, destination address, alarm level, and attack type from the alarm information, based on the different source and destination addresses corresponding to different alarms. Since different information in each set of alarm content requires different feature transformation methods, feature transformation of each piece of information is achieved through methods such as encoding, word embedding, and conversion. The transformed features are then concatenated to determine the alarm node feature vector corresponding to the alarm content. Furthermore, based on each alarm node feature vector, graph nodes and edges are determined to construct the alarm node relationship graph, thus completing the construction of the alarm node relationship graph. Simultaneously, the structure of the pre-constructed handling solution generation model is clarified, as well as the processing method for the graph features of the input handling solution generation model based on the new model structure. This enables automated alarm handling solution generation, allowing for full consideration of the complex correlations between different alarms when determining alarm handling solutions. This improves the detection and response capabilities for complex and unknown alarm threats, making the generated alarm handling solutions more adaptable and improving the generation efficiency of alarm handling solutions.

[0096] Example 3

[0097] Figure 6 This is a schematic diagram of the structure of an alarm handling device based on graph deep learning provided in Embodiment 3 of the present invention, as shown below. Figure 6As shown, the alarm handling scheme generation device includes an information acquisition module 31, a relationship diagram determination module 32, an image quantity determination module 33, and a scheme generation module 34.

[0098] The system includes: an information acquisition module 31 for acquiring alarm information; a relationship graph determination module 32 for generating at least two alarm node feature vectors based on the alarm information and determining an alarm node relationship graph based on each alarm node feature vector; a graph vector determination module 33 for determining alarm graph feature vectors based on the feature vectors of each alarm node and the graph structure of the alarm node relationship graph; and a solution generation module 34 for inputting the alarm graph feature vectors into a pre-built solution generation model to determine the alarm handling solution for each alarm node corresponding to the alarm information. The alarm node relationship graph is a directed graph with attack sending and receiving addresses as nodes and attack information as edges between them.

[0099] The technical solution of this invention, after obtaining alarm information, extracts the feature vectors of alarm nodes corresponding to each individual alarm information based on the alarm information, and constructs an alarm node relationship graph with each attack sending and receiving address as a node, considering the attack transmission relationship between the feature vectors of each alarm node, thereby obtaining an alarm graph feature vector containing the correlation between alarms. The alarm graph feature vector is processed by a pre-built handling scheme generation model to achieve automated alarm handling scheme generation. This allows for full consideration of the complex correlations between different alarms when determining the alarm handling scheme, improving the detection and response capabilities for complex and unknown alarm threats, making the generated alarm handling scheme more adaptable, and improving the generation efficiency of alarm handling schemes.

[0100] Optionally, the relationship diagram determination module 32 is specifically used for:

[0101] Extract at least two sets of alarm content from the alarm information; wherein the alarm content includes at least the source address, destination address, alarm type, alarm level, and attack type;

[0102] For each set of alarm content, the source address, destination address, alarm type, alarm level, and attack type are encoded, word-embedded, converted, and concatenated to determine the alarm node feature vector corresponding to the alarm content; wherein, the direction of the alarm node feature vector is from the alarm node corresponding to the source address to the alarm node corresponding to the destination address.

[0103] An alarm node relationship graph is constructed using the alarm nodes corresponding to the feature vectors of each alarm node as graph nodes and the feature vectors of each alarm node as edges.

[0104] Optionally, the pre-built treatment scheme generation model is a graph convolutional neural network model with a hybrid normalization layer and a self-attention layer added between each adjacent convolutional layer; wherein, each adjacent convolutional layer is residually connected through the hybrid normalization layer and the self-attention layer.

[0105] Optionally, the processing of the hybrid normalization layer includes left normalization and symmetric normalization.

[0106] Optional implementations of residual connections include:

[0107] The output of the previous convolutional layer in a set of adjacent convolutional layers is input into the hybrid normalization layer to determine the left normalization result and the symmetric normalization result;

[0108] The left normalization result and the symmetric normalization result are input into the self-attention layer to determine the left normalization attention score and the symmetric normalization attention score;

[0109] The sum of the output of the previous convolutional layer, the product of the left-normalized attention score and the left-normalized result, and the product of the symmetric-normalized attention score and the symmetric-normalized result is used as the input of the next convolutional layer in the adjacent convolutional layers.

[0110] Optional methods for determining attention scores include:

[0111]

[0112] in, The attention scores for different normalization results of the l-th layer; The attention score before normalization at layer l; LN represents left normalization; SN represents symmetric normalization;

[0113] Correspondingly, The attention score before normalization at layer l+1;

[0114] in,

[0115] in, For the different normalization results of the (l+1)th layer; N u Let u be the set of adjacent nodes; The value corresponding to the u-th node of the l-th convolutional layer in the model is generated for the treatment plan.

[0116] The alarm handling device based on graph deep learning provided in this embodiment of the invention can execute the alarm handling method based on graph deep learning provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0117] Example 4

[0118] Figure 7This is a schematic diagram of a graph deep learning-based alarm handling device according to Embodiment 4 of the present invention. The graph deep learning-based alarm handling device 40 can represent various forms of digital computers, such as laptops, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The graph deep learning-based alarm handling device 40 can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0119] like Figure 7 As shown, the graph deep learning-based alarm handling device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 and a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores a programmable program executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the programmable program stored in the ROM 42 or loaded from storage unit 48 into the RAM 43. The RAM 43 can also store various programs and data required for the operation of the graph deep learning-based alarm handling device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44. Optionally, the processor can be an FPGA.

[0120] The graph deep learning-based alarm handling device 40 has multiple components connected to an I / O interface 45, including: an input unit 46, such as a keyboard or mouse; an output unit 47, such as various types of displays or speakers; a storage unit 48, such as a hard disk or optical disk; and a communication unit 49, such as a network interface card (NIC), a modem, or a wireless transceiver. The communication unit 49 allows the graph deep learning-based alarm handling device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0121] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as an alarm handling method based on graph deep learning.

[0122] In some embodiments, the graph deep learning-based alarm handling method can be implemented as a programmable program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the programmable program can be loaded and / or installed onto the graph deep learning-based alarm handling device 40 via ROM 42 and / or communication unit 49. When the programmable program is loaded into RAM 43 and executed by processor 41, one or more steps of the graph deep learning-based alarm handling method described above can be performed. Alternatively, in other embodiments, processor 41 can be configured to perform the graph deep learning-based alarm handling method by any other suitable means (e.g., by means of firmware).

[0123] Optionally, embodiments of the present invention also provide a programmable program product, including a programmable program that, when executed by a processor, implements the graph deep learning-based alarm handling method provided in any embodiment of the present invention.

[0124] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more programmable programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a memory system, at least one input device, and at least one output device, and transmitting data and instructions to the memory system, the at least one input device, and the at least one output device.

[0125] Programmable programs for implementing the methods of the present invention can be written in any combination of one or more programming languages. These programmable programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the programmable programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The programmable programs can be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0126] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a programmable program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0127] To provide user interaction, the systems and techniques described herein can be implemented on a graph deep learning-based alarm handling device, which includes: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the graph deep learning-based alarm handling device. Other types of devices can also be used to provide user interaction; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0128] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0129] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by programmable programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0130] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0131] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An alarm handling method based on graph deep learning, characterized in that, include: Obtain alarm information; At least two alarm node feature vectors are generated based on the alarm information, and an alarm node relationship graph is determined based on each of the alarm node feature vectors. The alarm graph feature vector is determined based on the feature vector of each alarm node and the graph structure of the alarm node relationship graph; The alarm graph feature vector is input into a pre-built handling scheme generation model to determine the alarm handling scheme for each alarm node corresponding to the alarm information; The alarm node relationship graph is a directed graph with the attack sending and receiving addresses as nodes and the attack information between the attack sending and receiving addresses as edges. The pre-built treatment scheme generation model is a graph convolutional neural network model with a hybrid normalization layer and a self-attention layer added between each adjacent convolutional layer. Each of the adjacent convolutional layers is residually connected through the hybrid normalization layer and the self-attention layer; The processing of the hybrid normalization layer includes left normalization and symmetric normalization.

2. The alarm handling method based on graph deep learning according to claim 1, characterized in that, The step of generating at least two alarm node feature vectors based on the alarm information includes: At least two sets of alarm content are extracted from the alarm information; wherein the alarm content includes at least the source address, destination address, alarm type, alarm level, and attack type; For each set of alarm content, the source address, destination address, alarm type, alarm level, and attack type are encoded, word-embedded, converted, and concatenated to determine the alarm node feature vector corresponding to the alarm content; The direction of the alarm node feature vector is such that the alarm node corresponding to the source address points to the alarm node corresponding to the destination address.

3. The alarm handling method based on graph deep learning according to claim 2, characterized in that, The step of determining the alarm node relationship graph based on the feature vectors of each alarm node includes: An alarm node relationship graph is constructed using the alarm nodes corresponding to the feature vectors of each alarm node as graph nodes and the feature vectors of each alarm node as edges.

4. The alarm handling method based on graph deep learning according to claim 1, characterized in that, The residual connection is implemented in the following ways: The output of the previous convolutional layer in a set of adjacent convolutional layers is input into the hybrid normalization layer to determine the left normalization result and the symmetric normalization result; The left normalization result and the symmetric normalization result are input into the self-attention layer to determine the left normalized attention score and the symmetric normalized attention score; The sum of the output of the previous convolutional layer, the product of the left normalized attention score and the left normalized result, and the product of the symmetric normalized attention score and the symmetric normalized result is determined as the input of the next convolutional layer in the adjacent convolutional layers.

5. The alarm handling method based on graph deep learning according to claim 4, characterized in that, The methods for determining attention scores include: Among them, the The attention scores for different normalization results at layer l; The attention score before normalization at layer l; LN represents left normalization; SN represents symmetric normalization; Correspondingly, The attention score before normalization at layer l+1; in, ; in, For the different normalization results of the (l+1)th layer; Let u be the set of adjacent nodes; The value corresponding to the u-th node of the l-th convolutional layer in the model is generated for the treatment plan.

6. An alarm handling device based on graph deep learning, characterized in that, include: The information acquisition module is used to acquire alarm information; The relationship graph determination module is used to generate at least two alarm node feature vectors based on the alarm information, and to determine the alarm node relationship graph based on each of the alarm node feature vectors. The graph vector determination module is used to determine the alarm graph feature vector based on the feature vectors of each alarm node and the graph structure of the alarm node relationship graph; The solution generation module is used to input the alarm graph feature vector into the pre-built solution generation model to determine the alarm handling solution for each alarm node corresponding to the alarm information. The alarm node relationship graph is a directed graph with the attack sending and receiving addresses as nodes and the attack information between the attack sending and receiving addresses as edges. The pre-built treatment scheme generation model is a graph convolutional neural network model with a hybrid normalization layer and a self-attention layer added between each adjacent convolutional layer. Each of the adjacent convolutional layers is residually connected through the hybrid normalization layer and the self-attention layer; The processing of the hybrid normalization layer includes left normalization and symmetric normalization.

7. An alarm handling device based on graph deep learning, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a programmable program that can be executed by the at least one processor, and the programmable program is executed by the at least one processor to enable the at least one processor to perform the alarm handling method based on graph deep learning as described in any one of claims 1-5.

8. A storage medium containing executable instructions, characterized in that, The executable instructions, when executed by a programmable processor, are used to perform the alarm handling method based on graph deep learning as described in any one of claims 1-5.

9. A program product comprising a programmable program that, when executed by a processor, implements the alarm handling method based on graph deep learning as described in any one of claims 1-5.

Images