Alarm data reduction method, device, equipment, medium and product

Abstract

The invention relates to the field of network security, in particular to an alarm data reduction method and device, equipment, a medium and a product, and the method comprises the steps: obtaining alarm data and equipment information corresponding to a plurality of pieces of equipment in a current time window; according to the alarm data and the equipment information, risk scoring is carried out on each piece of equipment, and the potential risk of the equipment can be quantitatively evaluated; based on the danger score, screening out a plurality of target attack paths from a plurality of possible attack paths determined according to a network topological graph of the target equipment; and according to the node equipment corresponding to each target attack path, the alarm data corresponding to the equipment irrelevant to the target attack path is reduced. According to the method, the quantitative value of the equipment is determined in combination with the alarm data and the equipment information, the risk path and the key node are dynamically evaluated from the overall perspective, and the maximum probability attack path is predicted, so that the alarm data is reduced, the possibility of false alarm is greatly reduced, and the final alarm data is more accurate.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to an alarm data reduction method, device, equipment, medium and product. Background Art

[0002] With the rapid development of information technology, various monitoring systems are playing an increasingly important role in all walks of life. These systems can monitor various indicators in real time and issue alarms when abnormalities occur, thus helping operation and maintenance personnel to discover and handle problems in a timely manner.

[0003] Through the investigation of existing technologies in the industry, it is found that the current false alarm reduction is mainly based on time series anomaly analysis and simple rule merging. Time series anomaly analysis analyzes time series data to identify abnormal points that deviate from the normal pattern, thereby reducing false alarms. Simple rule merging merges multiple alarm rules to reduce duplicate alarms. The above technologies only reduce alarms from time series anomaly analysis, or rely heavily on expert rules, resulting in poor false alarm reduction effects. Summary of the invention

[0004] The purpose of this application is to provide an alarm data reduction method, device, equipment, medium and product, which can improve the effect of reducing false alarms.

[0005] In a first aspect, a method for reducing alarm data is provided, comprising:

[0006] Obtain multiple alarm data corresponding to multiple devices and device information corresponding to multiple devices in the current time window;

[0007] Determining a risk score corresponding to each of the plurality of devices according to the plurality of alarm data corresponding to each of the plurality of devices and the device information corresponding to each of the plurality of devices;

[0008] Determining multiple target attack paths from multiple attack paths according to the risk scores corresponding to each of the multiple devices, wherein the multiple attack paths are multiple attack paths that can be reached by an attacker determined according to a network topology diagram of the target device, and each attack path includes multiple node devices;

[0009] According to the node device corresponding to each target attack path, the alarm data corresponding to other devices in the multiple alarm data are eliminated, and the other devices are devices in the multiple devices except the node device corresponding to the target attack path.

[0010] In a preferred example, the present application can be further configured to: obtain multiple alarm data corresponding to multiple devices in the current time window, including:

[0011] Obtain multiple initial alarm data corresponding to multiple devices in the current time window;

[0012] Classifying a plurality of initial alarm data corresponding to a target device into categories to obtain a plurality of alarm categories; the target device is any one of the plurality of devices, and each alarm category includes at least one initial alarm data;

[0013] Characteristic information corresponding to each of the plurality of alarm categories is determined, and based on the characteristic information corresponding to each of the plurality of alarm categories, a plurality of initial alarm data corresponding to the target device is filtered to obtain a plurality of alarm data corresponding to the target device.

[0014] In a preferred example, the present application may be further configured as follows: the characteristic information includes: frequency, time and periodicity;

[0015] The filtering process of the multiple initial alarm data corresponding to the target device according to the characteristic information corresponding to each of the multiple alarm categories to obtain the multiple alarm data corresponding to the target device includes:

[0016] When the target alarm category satisfies a first condition, determining first initial alarm data corresponding to the target alarm category, the target alarm category being any one of a plurality of alarm categories, the first condition being that the time of the target alarm category exceeds a time threshold, or the target alarm category is periodic;

[0017] When the frequency of the target alarm category is greater than a preset frequency threshold, determining second initial alarm data of the target alarm category;

[0018] The multiple initial alarm data corresponding to the target device are processed to delete the first initial alarm data among the multiple initial alarm data corresponding to the target device, and the second initial alarm data is compressed to obtain the multiple alarm data corresponding to the target device.

[0019] In a preferred example, the present application may be further configured as follows: determining the risk scores corresponding to the multiple devices respectively according to the multiple alarm data corresponding to the multiple devices respectively and the device information corresponding to the multiple devices respectively, including:

[0020] Perform anomaly detection according to the multiple alarm data corresponding to each of the multiple devices, and determine the alarm score corresponding to each of the multiple devices;

[0021] Performing vulnerability analysis according to device information corresponding to each of the multiple devices to determine vulnerability scores corresponding to each of the multiple devices;

[0022] Determine the risk scores corresponding to the multiple devices respectively according to the alarm scores corresponding to the multiple devices respectively and the vulnerability scores corresponding to the multiple devices respectively.

[0023] In a preferred example, the present application may be further configured as follows: performing abnormality detection according to the multiple alarm data corresponding to each of the multiple devices, and determining the alarm scores corresponding to each of the multiple devices, including:

[0024] According to the current time window, multiple alarm data corresponding to the target device are cut to obtain multiple groups of alarm data;

[0025] Inputting multiple groups of alarm data corresponding to the target device into the anomaly detection model for anomaly detection to obtain an alarm score corresponding to the target device; the target device is any one of the multiple devices;

[0026] According to the alarm score corresponding to each device, the alarm scores corresponding to each of the multiple devices are obtained.

[0027] In a preferred example, the present application may be further configured as follows: performing vulnerability analysis according to the device information corresponding to each of the multiple devices to determine the vulnerability scores corresponding to each of the multiple devices includes:

[0028] Calculating multi-dimensional security factors according to device information corresponding to the target device, and determining scores corresponding to the multi-dimensional security factors; the target device is any device among the multiple devices; the dimensional security factors include at least two of the following: vulnerability exploitability factor, asset importance factor, and network topology factor;

[0029] A weighted calculation is performed according to the scores corresponding to each of the multi-dimensional security factors to obtain a vulnerability score corresponding to the target device.

[0030] In a preferred example, the present application may be further configured as follows: performing multi-dimensional security factor calculations according to device information corresponding to the target device, and determining scores corresponding to the multi-dimensional security factors, including:

[0031] Determine, according to the device information of the target device, the vulnerability value, the number of weak passwords, and the asset type corresponding to the high-risk vulnerability of the target device;

[0032] A score corresponding to the vulnerability exploitability factor is obtained by performing a weighted calculation based on the vulnerability values ​​and the number of weak passwords corresponding to the high-risk vulnerabilities of the target device;

[0033] Determining a score corresponding to the asset type of the target device according to an importance score mapping relationship, wherein the score represents a score corresponding to the asset importance factor; the importance score mapping relationship includes a correspondence relationship between multiple asset types and multiple importance scores;

[0034] According to the device network topology diagram, a score corresponding to the network topology factor of the target device is determined.

[0035] In a preferred example, the present application may be further configured as follows: before performing weighted calculation to obtain a score corresponding to the vulnerability exploitability factor based on the number of high-risk vulnerabilities and weak passwords of the target device, the method further includes:

[0036] Obtaining weight information corresponding to the current time window, wherein the weight information is obtained by adjusting the weight of historical weight information according to feedback information of false alarm reduction in the historical time window;

[0037] Accordingly, the score corresponding to the vulnerability exploitability factor is obtained by performing weighted calculation according to the number of high-risk vulnerabilities and weak passwords of the target device, including:

[0038] A weighted calculation is performed based on the weight information to determine the number of high-risk vulnerabilities and weak passwords of the target device to obtain a score corresponding to the vulnerability exploitability factor.

[0039] In a preferred example, the present application may be further configured as follows: determining the score corresponding to the network topology factor of the target device according to the device network topology diagram includes:

[0040] Determine a hierarchical score corresponding to the target device according to the network hierarchy, in-degree information, and out-degree information of the target device in the device network topology diagram;

[0041] The centrality score corresponding to the target device is determined according to the centrality score corresponding to the target device and the hierarchical score corresponding to the target device.

[0042] In a preferred example, the present application may be further configured to: determine multiple target attack paths from multiple attack paths according to the risk scores corresponding to the multiple devices, including:

[0043] Determine the number of node devices corresponding to each of the multiple attack paths;

[0044] Determining path scores corresponding to each of the multiple attack paths according to the risk scores corresponding to each of the multiple attack paths and the number of node devices corresponding to each of the multiple attack paths;

[0045] According to the path scores corresponding to the multiple attack paths respectively, a preset number of target attack paths with high scores are determined from the multiple attack paths.

[0046] In a second aspect, a false alarm data reduction device is provided, comprising:

[0047] An acquisition module, used to acquire a plurality of alarm data corresponding to a plurality of devices and device information corresponding to a plurality of devices in a current time window;

[0048] A risk scoring module, configured to determine a risk score corresponding to each of the plurality of devices according to the plurality of alarm data corresponding to each of the plurality of devices and the device information corresponding to each of the plurality of devices;

[0049] An attack path alarm reduction module is used to determine multiple target attack paths from multiple attack paths according to the risk scores corresponding to each of the multiple devices, wherein the multiple attack paths are multiple attack paths that can be reached by an attacker determined based on a network topology diagram of the target device, and each attack path includes multiple node devices; according to the node devices corresponding to each target attack path, the alarm data corresponding to other devices in the multiple alarm data are reduced, and the other devices are devices among the multiple devices except the node devices corresponding to the target attack path.

[0050] In a third aspect, an electronic device is provided, including:

[0051] one or more processors;

[0052] Memory;

[0053] One or more applications, wherein one or more applications are stored in a memory and configured to be executed by one or more processors, and the one or more programs are configured to: perform operations corresponding to the alarm data reduction method shown in any possible implementation of the first aspect.

[0054] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded by a processor and executes the steps of the alarm data reduction method shown in any possible implementation method of the first aspect.

[0055] In a fifth aspect, a computer program product is provided, including a computer program, which, when executed by a processor, implements operations corresponding to the alarm data reduction method shown in any possible implementation manner in the first aspect.

[0056] In summary, the method provided by this application includes the following beneficial technical effects:

[0057] Acquire multiple alarm data and device information corresponding to multiple devices in the current time window; perform a risk score on each device based on the alarm data and device information, and quantitatively evaluate the potential risk of the device; based on the risk score, screen out multiple target attack paths from multiple possible attack paths determined according to the network topology diagram of the target device; according to the node devices corresponding to each target attack path, eliminate the alarm data corresponding to the devices that are not related to the target attack path. The present application scheme combines the alarm data and device information to jointly determine the quantitative value of the device, dynamically evaluates the risk path and key nodes from an overall perspective, realizes the maximum probability attack path prediction, and eliminates the alarm data, which greatly reduces the possibility of false alarms, making the alarm data finally presented to the user more accurate.

[0058] In addition, the present application also provides a false alarm data reduction device, equipment, medium and product, all of which have the above-mentioned beneficial technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present application or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0060] Figure 1 A schematic diagram of a scenario for applying a method for reducing alarm data provided in an embodiment of the present application;

[0061] Figure 2 A flowchart of a method for reducing alarm data provided by an embodiment of the present application;

[0062] Figure 3 A schematic diagram of a process for acquiring multiple alarm data provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of a risk score determination process provided in an embodiment of the present application;

[0064] Figure 5 A schematic diagram of a process for determining scores corresponding to each of the multi-dimensional security factors provided in an embodiment of the present application;

[0065] Figure 6 A schematic diagram of a process for determining a target attack path provided in an embodiment of the present application;

[0066] Figure 7 A schematic diagram of an overall process provided for an embodiment of the present application;

[0067] Figure 8A schematic diagram of a process for reducing abnormal timing alarms provided in an embodiment of the present application;

[0068] Fig. 9 A schematic diagram of a vulnerability analysis process provided in an embodiment of the present application;

[0069] Fig.10 A schematic diagram of a process for attack path alarm mitigation provided in an embodiment of the present application;

[0070] Fig.11 A schematic diagram of the structure of a false alarm data reduction device provided in an embodiment of the present application;

[0071] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make non-creative modifications to the present embodiment as needed, but as long as they are within the scope of the present application, they are protected by the patent law.

[0073] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0074] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0075] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally indicates that the previous and subsequent associated objects are in an "or" relationship. In order to better understand and explain the solutions of the embodiments of the present application, some technical terms involved in the embodiments of the present application are briefly explained below.

[0076] APM (Attack Path Management): Attack path management refers to a solution that realizes attack path mapping, key blocking point discovery, risk mitigation and elimination from the perspective of attackers. By analyzing multi-dimensional information such as device vulnerabilities and real-time attack alerts, APM can identify and predict possible risk points in the system environment. Its security capabilities include but are not limited to: key node identification, attack path prediction, and attack matrix mapping. Security personnel can focus on key nodes of the system and cut off attack paths at bottlenecks to mitigate and eliminate security threats at the lowest cost.

[0077] IDS (Intrusion Detection System): An intrusion detection system that monitors activities in a computer system or network to detect and respond to potential security threats and attacks. Based on the application scenario, IDS can be divided into host IDS and network IDS. Host IDS is used to monitor abnormal terminal behavior, while network IDS is used to monitor abnormal network traffic. IDS can detect intrusions by analyzing abnormal behavior, specific attack patterns, or known attack signatures, and can take a variety of response measures, such as alerting administrators, blocking attack traffic, or isolating systems.

[0078] RRCF (Randomized Random Cut Forest): Random Cut Forest is an anomaly detection algorithm based on random matrix theory. It reduces the dimension of data by constructing a random matrix and uses recursive partitioning and clustering refinement to detect outliers. The RRCF algorithm has the advantages of high efficiency, strong scalability, and good adaptability to high-dimensional data. It is currently widely used in the field of anomaly detection.

[0079] Through the investigation of existing technologies in the industry, it is found that the current false alarm reduction is mainly based on time series anomaly analysis and simple rule merging. However, the existing solutions only reduce alarms from a single dimension and rely heavily on expert rules, resulting in poor false alarm reduction rate and positive alarm detection rate. In addition, due to the lack of real-time, dynamic and global analysis of system assets from a holistic perspective, the operational pressure of root cause location and traceability analysis in large-scale scenarios is still high.

[0080] In view of the existing problems of alarm fatigue solutions in the industry, the present invention aims to design an alarm data reduction method based on attack path management to overcome the difficulties of low false alarm reduction rate and true alarm detection rate, as well as high operational pressure in large-scale scenarios.

[0081] In order to better understand the solution provided by the embodiment of the present application, the solution is described below in conjunction with a specific application scenario.

[0082] Please refer to Figure 1 , Figure 1 A schematic diagram of an application scenario of an alarm data reduction method provided in an embodiment of the present application. The alarm data reduction method can be applied to a false alarm reduction system.

[0083] In some embodiments, the false alarm reduction system includes a terminal side device 100 and / or a network side device 200, and an electronic device 300. The electronic device 300 may be a server, which may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The electronic device 300 may also be a terminal device, which may be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto, and the embodiments of the present application are not limited thereto.

[0084] In one possible scenario, the electronic device 300 and the terminal side device 100 and the network side device 200 are directly or indirectly connected through wired or wireless communication. The electronic device can collect the alarm data and device information of the terminal side device 100 and the network side device 200, and then eliminate false alarms through analysis.

[0085] In another possible scenario, the false alarm reduction system also includes a third-party device, wherein the electronic device 300 and the third-party device are directly or indirectly connected via wired or wireless communication, and the third-party device and the terminal side device 100 and the network side device 200 are directly or indirectly connected via wired or wireless communication. The third-party device can collect the alarm data and device information of the terminal side device 100 and the network side device 200, and then the electronic device 300 obtains the alarm data and device information through the third-party device, and achieves false alarm reduction through analysis.

[0086] It is understandable that the above is only an example and is not limited to this embodiment.

[0087] The present application embodiment provides a method for reducing alarm data, such as Figure 2 As shown, the method provided in the embodiment of the present application can be executed by an electronic device, and the method includes:

[0088] S101, obtaining a plurality of alarm data corresponding to a plurality of devices and device information corresponding to a plurality of devices in a current time window;

[0089] The time size of the current time window can be a user-defined setting, such as the past 10 hours or the past 20 hours. Multiple devices refer to devices running in the network system, including but not limited to network-side devices and client devices, such as servers, routers, switches, IDS (Intrusion Detection System) engines, EDR (Endpoint Detection and Response), etc. Alarm data refers to warning information generated when the device is in an abnormal operating state, wherein the alarm data generally includes but is not limited to alarm type, alarm level, and occurrence time. Device information refers to various asset data related to the device, including asset type, device model, location, vulnerability information, etc.

[0090] In some embodiments, this step can be implemented in a variety of ways: Optionally, by means of database query, all relevant alarm records and device information of the device are retrieved from the information database according to the current time window and the identification information of multiple devices. Optionally, the electronic device interacts with the API interface of the third-party device to obtain the alarm data and device information of the device in real time or periodically. Of course, there are other ways, which are not limited in this embodiment, and the user can set according to actual needs.

[0091] S102, determining a risk score corresponding to each of the multiple devices according to multiple alarm data corresponding to each of the multiple devices and device information corresponding to each of the multiple devices;

[0092] Among them, the hazard score indicates the risk level of the equipment.

[0093] In some possible embodiments, the risk scores corresponding to each of the multiple devices can be calculated based on the alarm data and device information of the devices according to a risk score model with preset calculation rules; or, based on historical alarm data and device information, a training model can be used to learn the relationship between the risk score of the device and the alarm data and device information to obtain a trained model; then, the multiple alarm data corresponding to each of the multiple devices and the device information corresponding to each of the multiple devices are input into the trained model to predict the risk scores corresponding to each of the multiple devices.

[0094] It is understandable that other methods may be used to determine the risk score, which may be selected according to specific needs and are not limited here.

[0095] S103, determining multiple target attack paths from the multiple attack paths according to the risk scores corresponding to the multiple devices, wherein the multiple attack paths are multiple attack paths that can be reached by the attacker determined according to the network topology diagram of the target device, and each attack path includes multiple node devices;

[0096] The attack path refers to the path formed by a series of node devices that the attacker passes through from the attack starting device to the final device according to the target device network topology map in the network attack. The target device network topology map is a diagram of the connection relationship between all devices in the network, or a topology map obtained by connecting the exposed devices in the device network topology map to external entities. The external entity is obtained by abstracting the external attacker.

[0097] In some embodiments, the risk scores of the node devices on each path are accumulated to obtain the total score of each path; the top N paths are selected as target attack paths according to the total score sorting. Furthermore, since some paths are long and have too high scores, the predicted score can be divided by the average of the path lengths as the basis for selecting the top N paths as target attack paths.

[0098] In this step, in a complex network environment, by comprehensively considering the risk score and attack path of the device, dangerous target attack paths are identified. Furthermore, by determining the target attack path, technicians can also improve the security capabilities of the device and reduce potential security risks.

[0099] Furthermore, according to the risk scores corresponding to the multiple attack paths, before determining the target attack path from the multiple attack paths, it also includes: connecting the exposed devices in the device network topology diagram to the external entity to obtain the target device network topology diagram; the external entity is obtained by abstracting the external attacker; and determining multiple attack paths based on the target device network topology diagram. Specifically, all external attackers are abstracted into external entities external, and connected to the devices exposed to the outside to update the network topology. Then, all attack paths accessible to the attacker will be traversed starting from the external entity external.

[0100] S104. According to the node device corresponding to each target attack path, the alarm data corresponding to other devices in the multiple alarm data are eliminated, where the other devices are devices other than the node device corresponding to the target attack path in the multiple devices.

[0101] Among them, the list of node devices appearing in the target attack path is counted, and the alarms are filtered based on this list. Each node device on the target attack path is a device with low security, so the corresponding alarm data is valid alarm data. The alarm data corresponding to other devices in multiple alarm data are removed, and only the alarm data corresponding to each node device on the target attack path is retained, realizing the accurate elimination of alarm data.

[0102] It can be seen that in the embodiment of the present application, multiple alarm data and device information corresponding to multiple devices in the current time window are obtained; a risk score is performed on each device based on the alarm data and device information, so as to quantitatively evaluate the potential risk of the device; based on the risk score, multiple target attack paths are screened out from multiple possible attack paths determined according to the network topology diagram of the target device; according to the node devices corresponding to each target attack path, the alarm data corresponding to the devices irrelevant to the target attack path are eliminated. The present application scheme combines the alarm data and the device information to jointly determine the quantitative value of the device, dynamically evaluates the risk path and key nodes from an overall perspective, realizes the maximum probability attack path prediction, and eliminates the alarm data, which greatly reduces the possibility of false alarms, so that the alarm data finally presented to the user is more accurate.

[0103] It should be noted that many of the alarm data generated by devices (such as IDS engines, EDR) are caused by benign system behaviors. Through the analysis of a large number of alarms, it is found that there are very few high-risk alarms caused by real attacks. Most of them are medium- and low-risk system false alarms, and false alarms are usually repetitive. For example, alarms of the same behavior will reappear over a period of time, and false alarms are related to benign behaviors triggered by semantically similar commands. Therefore, in the embodiments of the present application, the alarm data can be initially reduced in combination with this attribute to improve the reduction efficiency. Specifically, a possible implementation method of the embodiments of the present application is shown in FIG. Figure 3 S101: Acquire multiple alarm data corresponding to multiple devices in the current time window, including:

[0104] S1011, obtaining multiple initial alarm data corresponding to multiple devices in the current time window;

[0105] In the embodiment of the present application, the initial alarm data is the original alarm data corresponding to each of the multiple devices.

[0106] S1012, classifying multiple initial alarm data corresponding to the target device into multiple alarm categories; the target device is any one of the multiple devices, and each alarm category includes at least one initial alarm data;

[0107] The initial alarm data is classified so that the alarm data of the same type can be grouped together to form multiple alarm categories. All alarm data of the same device in the current time window are aggregated, differentiated according to the alarm type and the process involved in the alarm, and the frequency and time (in hours) of each type of alarm are counted. At the same time, the key information of the alarm is recorded for subsequent tracing and judgment.

[0108] S1013: Determine characteristic information corresponding to each of the multiple alarm categories, and filter multiple initial alarm data corresponding to the target device according to the characteristic information corresponding to each of the multiple alarm categories to obtain multiple alarm data corresponding to the target device.

[0109] Among them, the characteristic information includes frequency, time and period. In an embodiment of the present application, after classification, the characteristic information such as the timing, frequency of occurrence and periodicity of the alarm can be analyzed according to the initial alarm data corresponding to each alarm category, so as to filter out false alarms from the original alarm data. Frequency refers to the number of times the alarm category occurs in a unit time or the current time window. Time refers to the duration of the occurrence of the alarm category, in hours. For example, if a certain alarm category occurs from 10:00 to 12:00, the time is 2 hours. In the embodiment of the present application, the method for determining the time is not set, and the actual duration can be used, and less than 1 hour can also be calculated. Periodicity refers to the periodic characteristics of the alarm category in time, such as occurrence at intervals of preset duration.

[0110] It can be seen that in the embodiment of the present application, the multiple initial alarm data corresponding to each device are classified, and then the multiple initial alarm data corresponding to the device are filtered and processed through the characteristic information corresponding to the multiple alarm categories. The multiple alarm data corresponding to the device can be obtained to facilitate the preliminary reduction of the alarm data, thereby improving the reduction efficiency.

[0111] In a possible implementation of an embodiment of the present application, characteristic information includes: frequency, time and periodicity; S1013, according to the characteristic information corresponding to each of the multiple alarm categories, the multiple initial alarm data corresponding to the target device are filtered and processed to obtain the multiple alarm data corresponding to the target device, including: when the target alarm category meets the first condition, the first initial alarm data corresponding to the target alarm category is determined, the target alarm category is any category of the multiple alarm categories, the first condition is that the time of the target alarm category exceeds the time threshold, or the target alarm category has periodicity; when the frequency of the target alarm category is greater than the preset frequency threshold, the second initial alarm data of the target alarm category is determined; the multiple initial alarm data corresponding to the target device are processed to delete the first initial alarm data in the multiple initial alarm data corresponding to the target device, and the second initial alarm data is compressed to obtain the multiple alarm data corresponding to the target device.

[0112] Specifically, in the embodiment of the present application, filtering is performed according to each category of the initial alarm data of each device. For a certain alarm category, according to the time series statistical characteristic information, judge in sequence: 1) whether the time (hours) of the alarm occurrence exceeds the time threshold Th; 2) whether the alarm occurrence is periodic; 3) whether the frequency of the same alarm occurrence exceeds the preset frequency threshold Ts; wherein the time threshold and the preset frequency threshold are set by technicians based on experience. If any of the above 1) and 2) is met, it is considered to be a false alarm, and the preset frequency threshold is filtered; if condition 3) is met, the alarm is compressed below the preset frequency threshold Ts to reduce redundancy.

[0113] A possible implementation method of the present application embodiment is shown in Figure 4 S102: Determine the risk scores corresponding to the multiple devices according to the multiple alarm data corresponding to the multiple devices and the device information corresponding to the multiple devices, including:

[0114] S1021, performing anomaly detection according to multiple alarm data corresponding to each of the multiple devices, and determining an alarm score corresponding to each of the multiple devices;

[0115] In one feasible method, multiple alarm data corresponding to the target device are cut according to the current time window to obtain multiple groups of alarm data; the multiple groups of alarm data corresponding to the target device are input into the anomaly detection model for anomaly detection to obtain the alarm score corresponding to the target device; the target device is any one of the multiple devices; according to the alarm score corresponding to each device, the alarm scores corresponding to the multiple devices are obtained.

[0116] In an embodiment of the present application, the alarm sequence within the time window is cut, and anomaly detection is performed using an anomaly detection model, and finally the alarm scores of all devices are output. The anomaly detection model can be a RRCF (Robust Random Cut Forest) model, which is an algorithm model for anomaly detection and an unsupervised learning algorithm for anomaly detection of large-scale data sets. It can effectively identify anomalies or abnormal patterns in the data, and the RRCF model can output the alarm score corresponding to each device.

[0117] In one feasible method, the alarm data is cut in chronological order to obtain alarm data groups of multiple time periods. The cutting method can be a fixed time interval, such as every hour, or a dynamic one, which is adjusted according to the density or quantity of the alarm data; the multiple groups of alarm data obtained by cutting are input into the RRCF model for anomaly detection, and the alarm score corresponding to the device is output. In another feasible method, the alarm data of the target device is cut according to the time window and the preset sliding step size to obtain multiple overlapping alarm data groups; each alarm data group is input into the RRCF model for anomaly detection to obtain the alarm score corresponding to each alarm data group; all the alarm scores of each device are weighted averaged and other operations are performed to obtain the alarm score corresponding to each device.

[0118] Furthermore, the alarm score can be displayed on the user interface for the administrator to view and process.

[0119] In an embodiment of the present application, multiple alarm data corresponding to the target device are segmented according to the current time window, and each group of alarm data contains the status information of the device within the time period. The multiple groups of alarm data obtained by segmentation are input into the anomaly detection model for anomaly detection, so that the anomaly detection model can perform a comprehensive analysis of the multiple groups of alarm data, thereby more accurately judging the degree of abnormality of the device and calculating an alarm score for each target device.

[0120] S1022, performing vulnerability analysis according to device information corresponding to each of the multiple devices, and determining vulnerability scores corresponding to each of the multiple devices;

[0121] Different devices in the same system may have different vulnerabilities due to different business environments and network topology locations. In the embodiment of the present application, the vulnerability of a device to external attackers can be analyzed by comprehensively considering multi-dimensional security factors.

[0122] S1023. Determine a risk score corresponding to each of the multiple devices according to the alarm scores corresponding to each of the multiple devices and the vulnerability scores corresponding to each of the multiple devices.

[0123] Specifically, for each device, the sum of the device's alarm score and vulnerability score can be used as the device's risk score; or, the value of the device's alarm score and vulnerability score after weighted calculation can be used as the device's risk score. It can be seen that in the embodiment of the present application, the present application performs anomaly detection through multiple alarm data to obtain the alarm score corresponding to the device; performs vulnerability analysis based on the device information corresponding to the device, and calculates a vulnerability score for each device; reflects the security risk of the device from two aspects, and then combines the two scores to determine the risk score, which can more comprehensively evaluate the security status of the device.

[0124] Regarding vulnerability scoring, a possible implementation method of an embodiment of the present application is, S1022, performing vulnerability analysis based on device information corresponding to each of the multiple devices to determine the vulnerability scores corresponding to each of the multiple devices, including: calculating multi-dimensional security factors based on the device information corresponding to the target device to determine the scores corresponding to each of the multi-dimensional security factors, where the target device is any one of the multiple devices; the dimensional security factors include at least two of the following: a vulnerability exploitability factor, an asset importance factor, and a network topology factor; performing weighted calculation based on the scores corresponding to each of the multi-dimensional security factors to obtain a vulnerability score corresponding to the target device.

[0125] Regarding vulnerability scoring, the embodiment of the present application focuses on three aspects: vulnerability exploitability, asset importance, and network topology. Of course, other security factors can also be used as indicators of vulnerability analysis, and this embodiment is no longer limited.

[0126] After calculating at least two of the vulnerability exploitability scores, asset importance scores, and network topology scores, they will be weighted to obtain the vulnerability score of each device.

[0127] A possible implementation method of the present application embodiment is shown in Figure 5 , calculate the multi-dimensional security factors according to the device information corresponding to the target device, and determine the scores corresponding to the multi-dimensional security factors, including:

[0128] Sa1. Determine the vulnerability value, number of weak passwords, and asset type corresponding to the high-risk vulnerabilities of the target device based on the device information of the target device;

[0129] Device information refers to various data and attributes related to the target device, which is used to evaluate the security status of the device. High-risk vulnerabilities refer to those that may cause serious security risks. The number of weak passwords refers to the number of passwords set on the target device that are not strong enough and can be easily guessed or cracked. Asset type refers to the category to which the target device belongs, for example, whether it is a database server, web server, middleware, gateway, firewall, or open port.

[0130] Sa2: Based on the vulnerability values ​​and number of weak passwords corresponding to the high-risk vulnerabilities of the target device, a weighted calculation is performed to obtain the score corresponding to the vulnerability exploitability factor;

[0131] Generally speaking, the more security vulnerabilities a device contains, the greater the probability that it will be successfully attacked by an attacker and then compromised. Among them, the problems of high-risk vulnerabilities (such as CVE) and weak passwords are particularly prominent, and they often become important means for attackers to implement boundary breakthroughs. High-risk vulnerabilities can be scored using the CVSS Common Vulnerability Scoring System (CVSS) to measure the vulnerability value. CVSS will give a score between 0 and 10 to quantify the severity of the vulnerability. A score between 9.0 and 10.0 means that the vulnerability can cause the system to fail completely or be completely controlled; a score between 7.0 and 8.9 means that the vulnerability can cause partial failure of the system or security issues such as data leakage; a score between 4.0 and 6.9 means that the vulnerability can cause partial failure of the system or security issues such as data leakage, but the impact is relatively small; a score between 0.1 and 3.9 means that the vulnerability has a small impact on the system, which may only be some restrictions on system functions or data leakage.

[0132] The embodiment of the present application takes these two security issues into consideration at the same time, and counts the vulnerability values ​​and the number of weak passwords corresponding to the high-risk vulnerabilities on each device respectively, and then calculates them with weighted scores to obtain the vulnerability exploitability score of each device. The higher the score, the higher the risk.

[0133] In some possible cases, the weights of high-risk vulnerabilities and weak passwords may be fixed, such as a weight of 0.05 for high-risk vulnerabilities and a weight of 1 for weak passwords.

[0134] In some other possible situations, false alarms may be eliminated based on initial weights first, and then after receiving user feedback, the weights may be adjusted dynamically to make the results more accurate.

[0135] Specifically, before performing weighted calculation to obtain the score corresponding to the vulnerability exploitability factor based on the number of high-risk vulnerabilities and weak passwords of the target device, it also includes: obtaining weight information corresponding to the current time window, wherein the weight information is obtained by adjusting the weight of historical weight information based on feedback information of false alarm reduction in the historical time window; accordingly, performing weighted calculation to obtain the score corresponding to the vulnerability exploitability factor based on the number of high-risk vulnerabilities and weak passwords of the target device, including: performing weighted calculation to obtain the score corresponding to the vulnerability exploitability factor based on the weight information.

[0136] Among them, historical time window: the historical time window corresponding to the current time window. Historical weight information represents the weight information used in the historical time window. Feedback information: refers to the information used to evaluate the reduction effect after the false alarm reduction is completed, which can be the feedback information of the technical staff. The level of reduction effect of high-risk vulnerabilities and weak passwords in the alarm data after reduction is determined through user feedback. Different levels correspond to different adjustment values, and then the weight information is dynamically adjusted as the weight of the next time window, that is, the current time window. This process is dynamic and continuous, and aims to continuously optimize the performance and accuracy of the system.

[0137] It can be seen that according to the feedback information of false alarm reduction in the historical time window, the weight information is dynamically adjusted as the weight information of the current time window. By continuously updating and optimizing the weight information, data can be evaluated and processed more accurately, and the alarm reduction effect can be improved.

[0138] Sa3. Determine a score corresponding to the asset type of the target device according to the importance score mapping relationship, where the score represents the score corresponding to the asset importance factor; the importance score mapping relationship includes a correspondence relationship between multiple asset types and multiple importance scores;

[0139] Regarding the importance of assets, the assets on the device (such as middleware, database, etc.) will vary depending on the business, but the harm caused to users by devices containing different assets after being compromised is completely different. For example, the importance of assets such as database servers and web servers is generally much greater than other asset categories. The embodiment of the present application can customize a list of common assets based on security experience, and specify a corresponding importance score mapping for each asset. Exemplary: {{database server, web server} corresponds to a score of 10.0, {middleware, gateway} corresponds to a score of 5.0, {firewall, open port} corresponds to a score of 2.0}. In this way, the importance scores of the assets contained in each device can be calculated.

[0140] Sa4. Determine the score corresponding to the network topology factor of the target device based on the device network topology diagram.

[0141] When determining the score corresponding to the network topology factor, it can be determined based on the hierarchical score and / or the hierarchical score.

[0142] A possible implementation method of the embodiment of the present application is to determine the centrality score corresponding to the target device according to the device network topology diagram; determine the hierarchical score corresponding to the target device according to the network hierarchy, in-degree information and out-degree information of the target device in the device network topology diagram; and determine the score corresponding to the network topology factor of the target device according to the centrality score corresponding to the target device and the hierarchical score corresponding to the target device.

[0143] Specifically, with regard to network topology, the different network topological positions of devices will have different impacts on the attacker's attack, mainly including the following two aspects: i) Network hierarchy. The difficulty of the attacker's attack will increase significantly with the increase of the number of attack hops, where the number of attack hops is the number of intermediate nodes or steps that the attacker needs to go through from the initial attack point (such as an infected computer or network node) to the target system (such as a specific server or database); ii) Network centrality. The explosion radius caused by the attacker's attack will vary depending on the central location of the current device.

[0144] Based on this, the embodiment of the present application first obtains the network topology diagram of the current system and correctly marks which devices are included in the external exposure surface; uses the closeiess_centrality function to calculate the centrality score of each node in the diagram, wherein the closeness centrality index in graph theory is used to calculate the importance of the node in the network; starting from the root node, a breadth-first traversal algorithm is used to obtain the network hierarchy, in-degree information, and out-degree information of each device in turn, and then calculate the hierarchical score, wherein the hierarchical score = 1 / network hierarchy + first factor * in-degree information + second factor * out-degree information, wherein the first factor and the second factor can be set according to empirical values; the sum of the comprehensive network hierarchy score and the network centrality score is obtained to obtain the network topology score of all current devices.

[0145] In an embodiment of the present application, the hierarchical score corresponding to the target device is determined based on the network level, in-degree information, and out-degree information of the target device in the device network topology diagram; the network topology score corresponding to the target device is comprehensively determined based on the centrality score corresponding to the target device and the hierarchical score corresponding to the target device, so that the result is more accurate.

[0146] It can be seen that in the embodiment of the present application, the vulnerability values ​​and the number of weak passwords corresponding to high-risk vulnerabilities are weightedly calculated to obtain a score corresponding to the vulnerability exploitability factor to characterize the possibility of the vulnerability being exploited; the score corresponding to the asset type of the target device is determined according to the importance score mapping relationship; the score corresponding to the network topology factor of the target device is determined according to the device network topology diagram; by comprehensively considering the high-risk vulnerabilities, number of weak passwords, asset type and network topology structure of the target device, a comprehensive multi-dimensional security factor quantification is performed.

[0147] A possible implementation method of the present application embodiment is shown in Figure 6 S103: determining multiple target attack paths from the multiple attack paths according to the risk scores corresponding to the multiple devices, including:

[0148] S1031, determining the number of node devices corresponding to each of the multiple attack paths;

[0149] S1032, determining path scores corresponding to the multiple attack paths according to the risk scores corresponding to the multiple attack paths and the number of node devices corresponding to the multiple attack paths;

[0150] The threat scores of multiple attack paths are calculated sequentially.

[0151] In an achievable embodiment, the vulnerability scores and alarm anomaly scores of all devices on a path are added together as the predicted score of the path. In addition, to balance the problem of too high scores for long paths, the predicted score is divided by the path length to obtain an average value as the path score.

[0152] In another feasible embodiment, the total score of the path may be logarithmically transformed by formula 1, and then divided by the number of devices; wherein formula 1 is: .

[0153] In another feasible embodiment, the long path coefficient β can be introduced through Formula 2. When β is greater than a preset value, β is less than 1, and the value can be customized by the user; otherwise, β is 1; wherein Formula 2 is: .

[0154] It is understandable that other methods may be used to determine the path score in order to balance the problem of too high a long path score, which is not limited here.

[0155] S1033. Determine a preset number of target attack paths with high scores from the multiple attack paths according to the path scores corresponding to the multiple attack paths.

[0156] The risk paths are sorted in descending order according to the scores, and the top k (k value is a preset number and can be customized) maximum probability attack paths are selected as the prediction results of the current time window.

[0157] It can be seen that in the embodiment of the present application, the path scores corresponding to the multiple attack paths are determined according to the risk scores corresponding to the multiple attack paths and the number of node devices corresponding to the multiple attack paths; the problem of too high scores on balanced long paths can more comprehensively evaluate the overall threat level of each attack path, and then, according to the path scores corresponding to the multiple attack paths, a preset number of target attack paths with high scores are determined from the multiple attack paths, so that the obtained target attack paths are more accurate.

[0158] Based on any of the above embodiments, see Figure 7 , Figure 7 An overall process architecture diagram is provided for an embodiment of the present application.

[0159] The alarm reduction method based on attack path management provided by the embodiment of the present application can be divided into three modules: timing anomaly alarm reduction, vulnerability analysis and attack path alarm reduction, wherein the results of timing anomaly alarm reduction and vulnerability analysis will be used as the input of attack path alarm reduction to achieve false alarm reduction of original alarms, positive attack detection and attack path prediction. Each module will be introduced in detail below.

[0160] For an explanation of the reduction of abnormal timing alarms, see Figure 8 , determine whether the current time window is reached; if not, wait for the step size to slide; if so, obtain the alarm data, classify and aggregate the alarm data, and record the statistical information, i.e., feature information; and then determine whether the time of the alarm category exceeds the time threshold, whether the alarm category is periodic, and whether the alarm frequency (i.e., number of times) is greater than the preset frequency threshold; if the time of the alarm category exceeds the time threshold, or the alarm category is periodic, perform alarm consideration; if the alarm frequency is greater than the preset frequency threshold, perform alarm compression, and achieve the initial filtering. Then, calculate the RRCF anomaly score based on the filtered alarm data to obtain the anomaly score.

[0161] For an explanation of vulnerability analysis, see Fig. 9 , format the device information to obtain vulnerability information, asset information and network topology; calculate the exploitability of vulnerabilities based on the number of high-risk vulnerabilities and weak passwords in the vulnerability information. Cluster the asset information to obtain the asset type and obtain the importance score mapping relationship to facilitate the calculation of asset importance scores. Construct a network topology and mark the exposed surface; then calculate the centrality and hierarchy based on the marked network topology, and then calculate the network topology score based on the calculation results. Weight the scores obtained from the three factors to obtain the device vulnerability score.

[0162] For an explanation of attack path alarm mitigation, see Fig.10 , abstract the external attack to facilitate the updating of the network topology; traverse the attack path based on the abstract external attack to obtain multiple attack paths; calculate the score of the attack path based on the score of each device in the timing anomaly alarm reduction and the score of each device in the vulnerability analysis; select the topk attack path, and the alarm data corresponding to the list of devices involved in the topk attack path needs to be stored; for the alarm after the timing anomaly reduction, if the corresponding device is not in this list, the alarm will be filtered; otherwise, the alarm data will be retained.

[0163] It can be seen that in the embodiments of the present application, the alarm data in the sliding time window is aggregated, filtered and compressed through information such as timing anomalies and periodicity, so as to achieve efficient false alarm reduction and true alarm detection; through vulnerability analysis, topology analysis and asset importance analysis, etc., the vulnerability of the current business system equipment is evaluated in multiple dimensions; by associating real-time attack alarms and vulnerability information, the risk path and key nodes are dynamically evaluated from an overall perspective to achieve the maximum probability attack path prediction. Combining real-time attack alarm data and equipment vulnerability information, the massive alarms generated by the terminal side and the network side in different scenarios can be generalized and reduced, and efficient true alarm detection and attack path prediction can be achieved. In addition, the embodiments of the present application comprehensively evaluate system threats in real time and dynamically from a global perspective, focusing on key nodes and the maximum probability attack path, which significantly improves the efficiency of attack root cause location and source tracing analysis in large-scale scenarios.

[0164] The following is an introduction to a device provided in an embodiment of the present application. The device described below and the method described above can be referred to each other. The device of this embodiment is set in an electronic device. Fig.11 , Fig.11 It is a structural block diagram of a device of one embodiment of the present application, comprising:

[0165] An acquisition module 10 is used to acquire a plurality of alarm data corresponding to a plurality of devices and device information corresponding to a plurality of devices in a current time window;

[0166] The risk scoring module 20 is used to determine the risk scores corresponding to the multiple devices according to the multiple alarm data corresponding to the multiple devices and the device information corresponding to the multiple devices;

[0167] The attack path alarm reduction module 30 is used to determine multiple target attack paths from multiple attack paths according to the risk scores corresponding to each of the multiple devices, wherein the multiple attack paths are multiple attack paths that can be reached by the attacker determined based on the network topology diagram of the target device, and each attack path includes multiple node devices; according to the node devices corresponding to each target attack path, the alarm data corresponding to other devices in the multiple alarm data are reduced, and the other devices are devices other than the node devices corresponding to the target attack path in the multiple devices.

[0168] In one achievable manner, the acquisition module 10 is specifically configured to:

[0169] Obtain multiple initial alarm data corresponding to multiple devices in the current time window;

[0170] Classifying multiple initial alarm data corresponding to the target device into multiple alarm categories; the target device is any one of the multiple devices, and each alarm category includes at least one initial alarm data;

[0171] Characteristic information corresponding to each of the plurality of alarm categories is determined, and based on the characteristic information corresponding to each of the plurality of alarm categories, a plurality of initial alarm data corresponding to the target device is filtered to obtain a plurality of alarm data corresponding to the target device.

[0172] In one possible implementation, the characteristic information includes: frequency, time and periodicity;

[0173] The acquisition module 10 is specifically used for:

[0174] When the target alarm category satisfies a first condition, determining first initial alarm data corresponding to the target alarm category, the target alarm category is any one of a plurality of alarm categories, the first condition is that the time of the target alarm category exceeds a time threshold, or the target alarm category has periodicity;

[0175] When the frequency of the target alarm category is greater than a preset frequency threshold, determining second initial alarm data of the target alarm category;

[0176] The multiple initial alarm data corresponding to the target device are processed to delete the first initial alarm data among the multiple initial alarm data corresponding to the target device and compress the second initial alarm data to obtain the multiple alarm data corresponding to the target device.

[0177] In one achievable manner, the risk scoring module 20 is specifically configured to:

[0178] Perform anomaly detection based on multiple alarm data corresponding to each of the multiple devices, and determine the alarm scores corresponding to each of the multiple devices;

[0179] Perform vulnerability analysis based on device information corresponding to each of the multiple devices to determine vulnerability scores corresponding to each of the multiple devices;

[0180] According to the alarm scores corresponding to the multiple devices and the vulnerability scores corresponding to the multiple devices, the risk scores corresponding to the multiple devices are determined.

[0181] In an achievable manner, the risk scoring module 20 is specifically used to cut multiple alarm data corresponding to the target device according to the current time window to obtain multiple groups of alarm data;

[0182] Input multiple groups of alarm data corresponding to the target device into the anomaly detection model for anomaly detection to obtain an alarm score corresponding to the target device; the target device is any one of the multiple devices;

[0183] According to the alarm score corresponding to each device, the alarm scores corresponding to the multiple devices are obtained.

[0184] In an achievable manner, the risk scoring module 20 is specifically used to calculate the multi-dimensional security factors according to the device information corresponding to the target device, and determine the scores corresponding to the multi-dimensional security factors; the target device is any device among the multiple devices; the dimensional security factors include at least two of the following: vulnerability exploitability factor, asset importance factor and network topology factor;

[0185] A weighted calculation is performed based on the scores corresponding to the multi-dimensional security factors to obtain the vulnerability score corresponding to the target device.

[0186] In an achievable manner, the risk scoring module 20 is specifically used to determine the vulnerability value, the number of weak passwords, and the asset type corresponding to the high-risk vulnerability of the target device according to the device information of the target device;

[0187] Based on the vulnerability values ​​and number of weak passwords corresponding to the high-risk vulnerabilities of the target device, a weighted calculation is performed to obtain the score corresponding to the vulnerability exploitability factor;

[0188] Determine a score corresponding to the asset type of the target device according to the importance score mapping relationship, where the score represents the score corresponding to the asset importance factor; the importance score mapping relationship includes a correspondence relationship between multiple asset types and multiple importance scores;

[0189] According to the device network topology diagram, determine the score corresponding to the network topology factor of the target device.

[0190] In one achievable manner, the present invention further includes:

[0191] A weight acquisition module is used to obtain weight information corresponding to the current time window, wherein the weight information is obtained by adjusting the weight of historical weight information according to the feedback information of false alarm reduction in the historical time window;

[0192] Accordingly, the risk scoring module 20 is specifically used for:

[0193] Based on the weight information, the number of high-risk vulnerabilities and weak passwords of the target device is weighted and calculated to obtain the score corresponding to the vulnerability exploitability factor.

[0194] In one achievable manner, the risk scoring module 20 is specifically configured to:

[0195] According to the network level, in-degree information and out-degree information of the target device in the device network topology diagram, determine the hierarchical score corresponding to the target device;

[0196] According to the centrality score corresponding to the target device and the hierarchical score corresponding to the target device, the centrality score corresponding to the target device is determined.

[0197] In an achievable manner, the attack path alarm mitigation module 30 is specifically used to determine the number of node devices corresponding to each of the plurality of attack paths;

[0198] Determine the path scores corresponding to the multiple attack paths according to the risk scores corresponding to the multiple attack paths and the number of node devices corresponding to the multiple attack paths;

[0199] According to the path scores corresponding to the multiple attack paths, a preset number of target attack paths with high scores are determined from the multiple attack paths.

[0200] An electronic device is provided in an embodiment of the present application, such as Fig.12 As shown, Fig.12 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0201] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0202] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0203] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0204] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0205] Fig.12 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0206] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0207] An embodiment of the present application provides a computer program product, including a computer program, which implements the corresponding contents of the aforementioned method embodiment when the computer program is executed by a processor.

[0208] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0209] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for reducing alarm data, characterized in that: include: Obtain multiple alarm data corresponding to multiple devices and device information corresponding to multiple devices in the current time window; Determining a risk score corresponding to each of the plurality of devices according to the plurality of alarm data corresponding to each of the plurality of devices and the device information corresponding to each of the plurality of devices; Determining multiple target attack paths from multiple attack paths according to the risk scores corresponding to each of the multiple devices, wherein the multiple attack paths are multiple attack paths that can be reached by an attacker determined according to a network topology diagram of the target device, and each attack path includes multiple node devices; According to the node device corresponding to each target attack path, the alarm data corresponding to other devices in the multiple alarm data are eliminated, and the other devices are devices in the multiple devices except the node device corresponding to the target attack path.

2. The method for reducing alarm data according to claim 1, characterized in that: Get multiple alarm data corresponding to multiple devices in the current time window, including: Obtain multiple initial alarm data corresponding to multiple devices in the current time window; Classifying a plurality of initial alarm data corresponding to a target device into categories to obtain a plurality of alarm categories; the target device is any one of the plurality of devices, and each alarm category includes at least one initial alarm data; Characteristic information corresponding to each of the plurality of alarm categories is determined, and based on the characteristic information corresponding to each of the plurality of alarm categories, a plurality of initial alarm data corresponding to the target device is filtered to obtain a plurality of alarm data corresponding to the target device.

3. The method for reducing alarm data according to claim 2, characterized in that: The characteristic information includes: frequency, time and periodicity; The filtering of the multiple initial alarm data corresponding to the target device according to the characteristic information corresponding to each of the multiple alarm categories to obtain the multiple alarm data corresponding to the target device includes: When the target alarm category satisfies a first condition, determining first initial alarm data corresponding to the target alarm category, the target alarm category being any one of a plurality of alarm categories, the first condition being that the time of the target alarm category exceeds a time threshold, or the target alarm category is periodic; When the frequency of the target alarm category is greater than a preset frequency threshold, determining second initial alarm data of the target alarm category; The multiple initial alarm data corresponding to the target device are processed to delete the first initial alarm data among the multiple initial alarm data corresponding to the target device, and the second initial alarm data is compressed to obtain the multiple alarm data corresponding to the target device.

4. The method for reducing alarm data according to claim 1 or 2, characterized in that: The determining, according to the plurality of alarm data corresponding to the plurality of devices and the device information corresponding to the plurality of devices, the risk scores corresponding to the plurality of devices respectively include: Perform anomaly detection according to the multiple alarm data corresponding to each of the multiple devices, and determine the alarm score corresponding to each of the multiple devices; Performing vulnerability analysis according to device information corresponding to each of the multiple devices to determine vulnerability scores corresponding to each of the multiple devices; Determine the risk scores corresponding to the multiple devices respectively according to the alarm scores corresponding to the multiple devices respectively and the vulnerability scores corresponding to the multiple devices respectively.

5. The method for reducing alarm data according to claim 4, characterized in that: Performing anomaly detection according to the plurality of alarm data corresponding to the plurality of devices respectively, and determining the alarm scores corresponding to the plurality of devices respectively, comprises: According to the current time window, multiple alarm data corresponding to the target device are cut to obtain multiple groups of alarm data; Inputting multiple groups of alarm data corresponding to the target device into the anomaly detection model for anomaly detection to obtain an alarm score corresponding to the target device; the target device is any one of the multiple devices; According to the alarm score corresponding to each device, the alarm scores corresponding to each of the multiple devices are obtained.

6. The method for reducing alarm data according to claim 4, characterized in that: The performing vulnerability analysis according to the device information corresponding to each of the multiple devices to determine the vulnerability scores corresponding to each of the multiple devices includes: Calculating multi-dimensional security factors according to device information corresponding to the target device, and determining scores corresponding to the multi-dimensional security factors; the target device is any device among the multiple devices; the dimensional security factors include at least two of the following: vulnerability exploitability factor, asset importance factor, and network topology factor; A weighted calculation is performed according to the scores corresponding to each of the multi-dimensional security factors to obtain a vulnerability score corresponding to the target device.

7. The method for reducing alarm data according to claim 6, characterized in that: Calculating multi-dimensional security factors according to the device information corresponding to the target device to determine the scores corresponding to the multi-dimensional security factors, including: Determine, according to the device information of the target device, the vulnerability value, the number of weak passwords, and the asset type corresponding to the high-risk vulnerability of the target device; A score corresponding to the vulnerability exploitability factor is obtained by performing a weighted calculation based on the vulnerability values ​​and the number of weak passwords corresponding to the high-risk vulnerabilities of the target device; Determining a score corresponding to the asset type of the target device according to an importance score mapping relationship, wherein the score represents a score corresponding to the asset importance factor; the importance score mapping relationship includes a correspondence relationship between multiple asset types and multiple importance scores; According to the device network topology diagram, a score corresponding to the network topology factor of the target device is determined.

8. The method for reducing alarm data according to claim 7, characterized in that: Before performing weighted calculation to obtain a score corresponding to the vulnerability exploitability factor based on the number of high-risk vulnerabilities and weak passwords of the target device, the method further includes: Obtaining weight information corresponding to the current time window, wherein the weight information is obtained by adjusting the weight of historical weight information according to feedback information of false alarm reduction in the historical time window; Accordingly, the score corresponding to the vulnerability exploitability factor is obtained by performing weighted calculation according to the number of high-risk vulnerabilities and weak passwords of the target device, including: A weighted calculation is performed based on the weight information to determine the number of high-risk vulnerabilities and weak passwords of the target device to obtain a score corresponding to the vulnerability exploitability factor.

9. The method for reducing alarm data according to claim 7, characterized in that: Determining the score corresponding to the network topology factor of the target device according to the device network topology diagram includes: Determine a hierarchical score corresponding to the target device according to the network hierarchy, in-degree information, and out-degree information of the target device in the device network topology diagram; The centrality score corresponding to the target device is determined according to the centrality score corresponding to the target device and the hierarchical score corresponding to the target device.

10. The method for reducing alarm data according to claim 1, characterized in that: Determining multiple target attack paths from the multiple attack paths according to the risk scores corresponding to the multiple devices, including: Determine the number of node devices corresponding to each of the multiple attack paths; Determining path scores corresponding to each of the multiple attack paths according to the risk scores corresponding to each of the multiple attack paths and the number of node devices corresponding to each of the multiple attack paths; According to the path scores corresponding to the multiple attack paths respectively, a preset number of target attack paths with high scores are determined from the multiple attack paths.

11. A false alarm data reduction device, characterized in that: include: An acquisition module, used to acquire a plurality of alarm data corresponding to a plurality of devices and device information corresponding to a plurality of devices in a current time window; A risk scoring module, configured to determine a risk score corresponding to each of the plurality of devices according to the plurality of alarm data corresponding to each of the plurality of devices and the device information corresponding to each of the plurality of devices; An attack path alarm reduction module is used to determine multiple target attack paths from multiple attack paths according to the risk scores corresponding to each of the multiple devices, wherein the multiple attack paths are multiple attack paths that can be reached by an attacker determined based on a network topology diagram of the target device, and each attack path includes multiple node devices; according to the node devices corresponding to each target attack path, the alarm data corresponding to other devices in the multiple alarm data are reduced, and the other devices are devices among the multiple devices except the node devices corresponding to the target attack path.

12. An electronic device, characterized in that: include: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: perform the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded by the processor and executes the steps of the method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The method comprises a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 10.

Images