Security situation alarm noise reduction method based on time window modeling

Abstract

The invention discloses a security situation alarm noise reduction method based on time window modeling. In order to effectively filter false alarms and false alarms, alarm feature vectors are extracted from three dimensions from fine to coarse on the basis of a source IP, a target IP and an alarm type of an alarm event from a network attack process, the first dimension takes the source IP, the target IP and the alarm type as references, the second dimension takes the source IP and the target IP as references, and the alarm feature vectors are extracted from three dimensions from fine to coarse. The third dimension is based on the source IP and the total number of alarm types; and according to the alarm feature vectors extracted from the three dimensions, utilizing an alarm model to judge the authenticity of an alarm event. The method is simple in process, high in practicability, low in resource consumption and easy to implement in an engineering mode. The method is suitable for the field of network security situation awareness.

Description

Technical Field

[0001] The present invention relates to the field of network security situation awareness, and in particular to a security situation alarm denoising method based on time window modeling. Background Art

[0002] With the development of society, the Internet has been increasingly used in people's daily life and work. However, while the Internet provides convenience to users, network security issues are becoming increasingly prominent, especially the concealment and complexity of network attacks have greatly increased, posing a great challenge to the maintenance of network security.

[0003] Network security situation awareness is an emerging network security protection concept, which transforms from traditional passive defense to active protection and intelligent protection. Network security situation awareness refers to the acquisition, understanding, and display of security factors that can cause changes in network situation in a large-scale network environment, and predicts the development trend of future network security based on this, so as to achieve the detection of advanced threats and unknown threats. Therefore, the network security situation awareness system usually has the following capabilities: the ability to continuously monitor the security of cyberspace and timely discover various network attacks, network threats and anomalies; the ability to investigate, analyze and visualize network threats, and quickly identify the impact scope, attack path, purpose, and means related to network threats, so as to support effective security decision-making and response; establish a security early warning mechanism, so as to improve the level of risk control, emergency response and overall security protection.

[0004] In general, the basic ability of a network security situation awareness system is to receive or collect security events reported by various devices and software. However, there are usually various types of devices and software in the network, and the reported alarm events are numerous and the information is complex. Most of the existing technologies are based on intrusion rule detection, which can easily generate a large number of false alarms and false alarms. For example, in a real network, a certain business flow may just match a certain intrusion rule, which will generate a large number of such alarms. However, as an upper-level system, it is difficult for network security situation awareness to accurately identify whether these alarm events are real network attacks or threats. How to effectively filter false alarms and false alarms to improve the accuracy of risk identification by the network security situation awareness system is a technical problem that needs to be solved urgently in this field. Summary of the invention

[0005] In order to alleviate or partially alleviate the above technical problems, the solution of the present invention is as follows:

[0006] A network security management device based on time window modeling, comprising:

[0007] An input module, used for receiving alarm events;

[0008] A generalization and normalization module is used to perform generalization and normalization processing on the information of the received alarm events;

[0009] The feature extraction module collects statistics on the generalized and normalized information within the time window, and extracts alarm feature vectors from three dimensions from fine to coarse based on the source IP, destination IP and alarm type of the alarm event;

[0010] The alarm noise reduction module uses the alarm model to determine the authenticity of alarm events based on the alarm feature vectors extracted from three dimensions;

[0011] Output module, outputs real alarms.

[0012] Further, within the time window, statistics are performed based on the first dimension to obtain an alarm feature vector of the first dimension, statistics are performed based on the second dimension to obtain an alarm feature vector of the second dimension, and statistics are performed based on the third dimension to obtain an alarm feature vector of the third dimension;

[0013] Among them, the first dimension is based on the source IP, destination IP and alarm type, the second dimension is based on the source IP and destination IP, and the third dimension is based on the source IP and the total number of alarm types.

[0014] Furthermore, the use of the alarm model to judge the authenticity of the alarm event includes the following steps:

[0015] Step S201: Perform first dimension matching on the alarm feature vector of the first dimension and the alarm model of the first dimension. If the first dimension matching is successful, proceed to the next step, otherwise exit;

[0016] Step S202: while performing second dimension matching on the alarm feature vector of the second dimension and the alarm model of the second dimension, performing third dimension matching on the alarm feature vector of the third dimension and the alarm model of the third dimension;

[0017] If the second dimension matches successfully or / and the third dimension matches successfully, the alarm event is judged to be a true alarm, otherwise it is a false alarm.

[0018] Furthermore, when performing the first dimension matching, if the first condition is met, the first dimension matching is successful;

[0019] For scanning attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is greater than or equal to the first total number of destination ports threshold, and the total number of alarms is greater than or equal to the first total number of alarms threshold;

[0020] For other types of attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is less than the first total number of destination ports threshold, and the total number of alarms is greater than or equal to the first total number of alarms threshold.

[0021] Furthermore, when performing the second dimension matching, if the second condition is met, the second dimension matching is successful;

[0022] The second condition is: within the time window, the total number of alarm types is greater than or equal to the total number threshold of alarm types, and the total number of alarms is greater than or equal to the second total number threshold of alarms.

[0023] Furthermore, when performing the third dimension matching, if the third condition is met, the third dimension matching is successful;

[0024] The third condition is: within the time window, the total number of destination IP addresses or the total number of destination ports of the alarm event meets the standard, and the total number of alarms is greater than or equal to the third total number of alarms threshold;

[0025] For scanning attacks or worm attacks, the standard is met when the total number of destination IP addresses is greater than or equal to the total number of destination IP addresses threshold, or the total number of destination ports is greater than or equal to the second total number of destination ports threshold;

[0026] For other types of attacks, the standard is met when the total number of destination IPs is less than the total number threshold of destination IPs, and the total number of destination ports is less than the total number threshold of the second alarm type.

[0027] Furthermore, the generalized and normalized information includes source IP, destination IP, alarm type, destination port and total number of alarms.

[0028] Furthermore, the output module combines the real alarms of the same type according to the time window and outputs them.

[0029] Furthermore, after the output module outputs a true alarm, no repeated alarm is issued in the subsequent N time windows, where N is a positive integer.

[0030] A network security management method based on time window modeling includes the following steps:

[0031] Step S301: generalize and normalize the received alarm events, and perform statistical aggregation based on the time window;

[0032] Step S302: Based on the information obtained in step S301, extract the alarm feature vector from three dimensions from fine to coarse;

[0033] Step S303: Based on the extracted alarm feature vectors of three dimensions, the alarm model is used to determine the authenticity of the alarm event.

[0034] Furthermore, the three-dimensional warning feature vectors include:

[0035] The alarm feature vector of the first dimension is based on the source IP, destination IP and alarm type. The total number of alarm types and the total number of alarms are counted within the time window.

[0036] The second dimension of the alarm feature vector is based on the source IP and destination IP. The total number of alarm types and the total number of alarms are counted within the time window.

[0037] The third dimension of the alarm feature vector is based on the source IP and alarm type. Within the time window, the total number of destination IPs, the total number of alarm types, and the total number of alarms are counted;

[0038] The total number of alarm types refers to the total number of destination ports involved in the alarm event within the time window; the total number of alarms refers to the total number of alarms within the time window; the total number of alarm types refers to the total number of alarm types of the alarm event; and the total number of destination IPs refers to the total number of destination IPs of the alarm event.

[0039] Furthermore, the step S303 includes:

[0040] Perform first dimension matching of the alarm feature vector of the first dimension with the alarm model of the first dimension, and if the first dimension matching is successful, continue with the subsequent matching, otherwise exit;

[0041] While performing second dimension matching on the extracted alarm feature vector of the second dimension and the alarm model of the second dimension, performing third dimension matching on the extracted alarm feature vector of the third dimension and the alarm model of the third dimension;

[0042] If the second dimension matches successfully or / and the third dimension matches successfully, the alarm event is judged to be a true alarm, otherwise it is a false alarm.

[0043] Furthermore, when performing the first dimension matching, if the first condition is met, the first dimension matching is successful;

[0044] For scanning attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is greater than or equal to the first total number of destination ports threshold, and the total number of alarms is greater than or equal to the first total number of alarms threshold;

[0045] For other types of attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is less than the first total number of destination ports threshold, and the total number of alarms is greater than or equal to the first total number of alarms threshold.

[0046] Furthermore, when performing the second dimension matching, if the second condition is met, the second dimension matching is successful;

[0047] The second condition is: within the time window, the total number of alarm types is greater than or equal to the total number threshold of alarm types, and the total number of alarms is greater than or equal to the second total number threshold of alarms.

[0048] Furthermore, when performing the third dimension matching, if the third condition is met, the third dimension matching is successful;

[0049] The third condition is: within the time window, the total number of destination IP addresses or the total number of destination ports of the alarm event meets the standard, and the total number of alarms is greater than or equal to the third total number of alarms threshold;

[0050] For scanning attacks or worm attacks, the standard is met when the total number of destination IP addresses is greater than or equal to the total number of destination IP addresses threshold, or the total number of destination ports is greater than or equal to the second total number of destination ports threshold;

[0051] For other types of attacks, the standard is met when the total number of destination IPs is less than the total number threshold of destination IPs, and the total number of destination ports is less than the total number threshold of the second alarm type.

[0052] The technical solution of the present invention has one or more of the following beneficial technical effects:

[0053] (1) The network security management device based on time window modeling of the present invention extracts the characteristics of alarm events from three dimensions from fine to coarse, has a simple process, strong practicality, consumes little server computing power, and is easy to implement in engineering.

[0054] (2) The network security management device based on time window modeling of the present invention can effectively determine the authenticity of alarm events, perform alarm noise reduction, and improve the accuracy of risk identification.

[0055] (3) The present invention processes alarm events in real time and merges real attacks, effectively reducing the number of alarm events and further achieving noise reduction of alarm events.

[0056] In addition, other beneficial effects of the present invention will be mentioned in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A complete network attack flow chart;

[0058] Figure 2 A network security management device based on time window modeling according to a preferred embodiment of the present invention;

[0059] Figure 3 is the first dimension of the alarm model in a preferred embodiment of the present invention;

[0060] Figure 4 The second dimension of the alarm model in a preferred embodiment of the present invention;

[0061] Figure 5 It is the third dimension of the alarm model in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] In order to clearly describe the technical solutions of the embodiments of the present invention, in the embodiments of the present invention, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0064] Based on the characteristics of the network attack chain, the present invention performs statistical analysis on alarm events from three dimensions, utilizes the alarm model to filter out false alarms and misalarms generated by business traffic, and identifies alarm events generated by real intrusion attacks.

[0065] Figure 1 This is a complete network attack flow chart, including 7 steps:

[0066] Step S101: reconnaissance and tracking: the attacker searches for the target's weaknesses, such as scanning, detecting, and collecting intelligence.

[0067] Step S102: Weapon construction: creating a sendable weapon carrier based on vulnerability and backdoor information.

[0068] Step S103: Payload delivery: delivering the network weapon package to the target, such as uploading files, sending emails, etc.

[0069] Step S104: exploit the vulnerability to perform malicious operations on the victim's system, such as escalating privileges, creating new users, etc.

[0070] Step S105: Install the implant, and install malicious software at the target location, such as installing a Trojan horse.

[0071] Step S106, command and control, establishes a path for the attacker to remotely control the target system, such as intranet penetration, connecting to a botnet, etc.

[0072] Step S107: The goal is achieved. The attacker remotely controls the system to complete its intended goal, such as system downtime, data theft, etc.

[0073] Among them, step S102 is the behind-the-scenes work of the attacker, which is invisible or imperceptible to the network security situation awareness management system, and any other steps may trigger an alarm in the defense system. In addition, a real intrusion attack must have multiple attempts before the final successful attack, that is, before step S107 is implemented, the previous steps are usually executed in a loop, multiple times of reconnaissance and tracking, layer by layer of invasion, and deep into the target network.

[0074] Since the customer's business traffic is generally relatively fixed, the false alarms generated by attacks triggered by standard business are often relatively fixed. Based on the source IP, destination IP and alarm type of the alarm event, the present invention analyzes the alarm event based on the time window from three dimensions to identify the real alarm.

[0075] Among them, the first dimension performs statistical analysis based on the source IP, destination IP and alarm type of the alarm event to form the alarm feature vector of the first dimension. In the first dimension, the source IP, destination IP and alarm type are fixed. Since attackers cannot guarantee a successful invasion in one go, they often achieve their goals through scanning detection, vulnerability exploitation, etc. At this time, a source IP launches the same type of attack on a destination IP, generating multiple alarm events of the same type.

[0076] Among them, the second dimension performs statistical analysis based on the source IP and destination IP to form the second dimension alarm feature vector. In the second dimension, the source IP and destination IP are fixed, but the alarm type is not fixed. The second dimension is broader than the first dimension. According to the aforementioned network attack process, before the attacker achieves the goal, such as invading and controlling the target host, there must be multiple attack actions, including scanning detection, payload delivery, vulnerability exploitation, etc., which will generate different alarm types.

[0077] Among them, the third dimension performs statistical analysis based on the source IP and the alarm type to form the third dimension alarm feature vector. In the third dimension, the source IP is fixed, but the destination IP and the alarm type are not fixed. The third dimension is broader than the second dimension, which is the broadest dimension. According to the aforementioned network attack process, before achieving the goal, such as invading and controlling the target host, the attacker scans and detects the target network and makes various intrusion attempts, generating various types of alarms.

[0078] Figure 2 A network security management device based on time window modeling in a preferred embodiment of the present invention includes an input module, a generalization and normalization module, a feature extraction module, an alarm noise reduction module and an output module.

[0079] Input module, used to receive alarm events.

[0080] The generalization and normalization module is used to perform generalization and normalization processing on the information of the received alarm events.

[0081] Since the network security management device based on time window modeling receives multiple types of alarm events from multiple security devices and software, different manufacturers have different classifications and names for alarm events, and different devices or software generate different types of alarm events. In order to facilitate subsequent feature extraction and analysis, the generalization and normalization module centrally processes all types of alarm events received, unifies fields and ranges, such as source IP, source port, destination IP, destination port, alarm type, alarm details, etc., so that different alarm events can be compared, thereby improving the comparability of different alarm events.

[0082] Preferably, the following information is generalized and normalized from the alarm event: source IP, destination IP, alarm type, and destination port.

[0083] The feature extraction module statistically summarizes the generalized and normalized information within the time window and extracts the alarm feature vector from three dimensions.

[0084] Since real attacks usually have typical time characteristics, the real alarms generated by the corresponding security equipment or software also have corresponding time characteristics. The present invention analyzes alarm events based on time windows. The selection of time windows affects the accuracy of alarm noise reduction. If the time window is too long, the filtering effect of false alarms and missed alarms is poor. If the time window is too short, some confirmed alarms will be missed. Preferably, the time window is greater than or equal to five minutes and less than or equal to ten minutes.

[0085] Within the time window, analysis is performed based on the first dimension to form an alarm feature vector of the first dimension, where the first dimension is based on the source IP, destination IP and alarm type.

[0086] Within the time window, analysis is performed based on the second dimension to form an alarm feature vector of the second dimension, where the second dimension is based on the source IP and the destination IP.

[0087] Within the time window, analysis is performed based on the third dimension to form an alarm feature vector of the third dimension, where the third dimension is based on the source IP and the total number of alarm types.

[0088] The alarm noise reduction module uses the alarm model to judge the authenticity of the alarm event based on the extracted alarm feature vectors in three dimensions.

[0089] Output module, outputs real alarms.

[0090] Preferably, real alarms of the same type are merged according to the time window and then output.

[0091] Preferably, after the real alarm is output, no repeated alarm is issued in the subsequent N time windows, where N is a positive integer. Thus, the number of alarm events can be significantly reduced, and the noise reduction of alarm events can be further achieved.

[0092] Preferably, the network security management device based on time window modeling is applied to the network security situation awareness system.

[0093] The alarm model of the present invention is a multi-dimensional model based on a time window. Alarm models of different dimensions need to determine corresponding feature thresholds. The learning and modeling process of the alarm model is the process of determining the corresponding feature thresholds.

[0094] Figure 3 is the first dimension of the alarm model in a preferred embodiment of the present invention, Figure 4 is the second dimension of the alarm model in a preferred embodiment of the present invention, Figure 5 It is the third dimension of the alarm model in a preferred embodiment of the present invention. Among them, source IP refers to the source IP information obtained from the alarm event, destination IP refers to the destination IP information obtained from the alarm event, alarm type refers to the alarm type information obtained from the alarm event, the total number of alarm types refers to the total number of alarm types involved in the alarm event within the time window, the destination port refers to the destination port information obtained from the alarm event, the total number of destination ports refers to the total number of destination ports involved in the alarm event within the time window, and the total number of alarms refers to the total number of alarm events within the time window.

[0095] For the alarm model of the first dimension, based on the source IP, destination IP and alarm type, the total number of destination ports and the total number of alarms are counted within the time window, and based on the first total number of destination ports threshold and the first total number of alarms threshold, it is determined which alarm events within the time window are real alarms. The first total number of destination ports threshold is the total number of destination ports threshold determined based on the first dimension for alarm events within the time window, and the first total number of alarms threshold is the total number of alarm events threshold determined based on the first dimension for alarm events within the time window. Different alarm types have different judgment methods. For example, for scanning attacks, if the total number of destination ports ≥ the first total number of destination ports threshold, and the total number of alarms ≥ the first total number of alarms threshold, then the corresponding alarm event under the first dimension is valid and is a real alarm.

[0096] For the alarm model of the second dimension, based on the source IP and destination IP, within the time window, based on the total alarm type threshold and the second total alarm threshold, the authenticity of the alarm event is judged under this dimension. The total alarm type threshold is the total alarm type threshold determined based on the second dimension for the alarm event within the time window, and the second total alarm threshold is the total alarm event threshold determined based on the second dimension for the alarm event within the time window. If the total alarm type threshold ≥ the total alarm threshold, and the total alarm threshold ≥ the second total alarm threshold, the corresponding alarm event is valid under the second dimension. Under this dimension, since the total number of destination ports is related to the alarm type, the threshold corresponding to the total number of destination ports is not considered for the time being.

[0097] For the third dimension alarm model, based on the source IP and alarm type, the total destination IP threshold, the second total destination port threshold and the third total alarm threshold are determined within the time window. The total destination IP threshold is the total destination IP threshold determined based on the third dimension for alarm events within the time window, the second total destination port threshold is the total destination port threshold determined based on the third dimension for alarm events within the time window, and the third total alarm threshold is the total alarm event threshold determined based on the third dimension for alarm events within the time window. Different alarm types require different judgment methods. For example, for scanning / worm attacks, the following conditions must be met at the same time: (1) the total destination IP ≥ the total destination IP threshold, or the total destination port ≥ the second total destination port threshold; (2) the total alarm ≥ the third total alarm threshold. For other types of attacks, the following two conditions must be met at the same time: (1) the total destination IP < the total destination IP threshold, and the total destination port < the second total destination port threshold; (2) the total alarm ≥ the third total alarm threshold.

[0098] The alarm model method based on the above feature threshold is simple and practical. A machine learning model can also be established based on the above features to distinguish the authenticity of alarm events through training, but the machine learning-based solution is relatively more complex and consumes more computing power.

[0099] The present invention uses an alarm model to judge the authenticity of an alarm event, which specifically includes the following steps:

[0100] Step S201: Perform first dimension matching on the extracted alarm feature vector of the first dimension and the alarm model of the first dimension. If the first condition is met, the first dimension matching is successful and the subsequent steps are continued, otherwise, the alarm event in this time window is a false alarm.

[0101] The first condition is related to the alarm type. For scanning attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is greater than or equal to the first destination port total threshold, and the total number of alarms is greater than or equal to the first alarm total threshold;

[0102] For other types of attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is less than the first total number of destination ports threshold, and the total number of alarms is greater than or equal to the first total number of alarms threshold.

[0103] Step S202: While performing second dimension matching of the extracted alarm feature vector of the second dimension with the alarm model of the second dimension, the extracted alarm feature vector of the third dimension is matched with the alarm model of the third dimension. If the second dimension match or / and the third dimension match are successful, the alarm event in this time window is a true alarm, otherwise it is a false alarm.

[0104] When performing the second dimension matching, if the second condition is met, the second dimension matching is successful. The second condition is: within the time window, the total number of alarm types is greater than or equal to the total number of alarm types threshold, and the total number of alarms is greater than or equal to the second total number of alarms threshold.

[0105] Among them, when performing the third dimension match, if the third condition is met, the third dimension match is successful. The third condition is: within the time window, the total number of destination IPs or the total number of destination ports of the alarm event meets the standard, and the total number of alarms is greater than or equal to the third total number of alarms threshold. For scanning attacks or worm attacks, the standard is met means that the total number of destination IPs is greater than or equal to the total number of destination IPs threshold, or the total number of destination ports is greater than or equal to the second total number of destination ports threshold; for other types of attacks, the standard is met means that the total number of destination IPs is less than the total number of destination IPs threshold, and the total number of destination ports is less than the second alarm type total threshold.

[0106] The present invention also relates to a network security management method based on time window modeling, comprising the following steps:

[0107] Step S301: generalize and normalize the received alarm events, and perform statistical aggregation based on the time window.

[0108] Step S302: Based on the information obtained in step S301, extract the alarm feature vector from three dimensions from fine to coarse;

[0109] Step S303: Based on the extracted alarm feature vectors of three dimensions, the alarm model is used to determine the authenticity of the alarm event.

[0110] Specifically, the alarm feature vectors of the three dimensions are matched with the dimensions corresponding to the alarm model respectively. If the first dimension matches successfully and any dimension in the second dimension and the third dimension matches successfully, the corresponding alarm event is a true alarm, otherwise it is a false alarm.

[0111] The present invention starts from the network attack process, extracts features of alarm events from three dimensions from fine to coarse, and identifies real attacks. The process of the present invention is simple, practical, consumes little server computing power, and is easy to implement in engineering.

[0112] In order to better illustrate the present invention, numerous specific details are provided in the above specific embodiments. It should be understood by those skilled in the art that the present invention can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present invention.

[0113] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A network security management device based on time window modeling, characterized in that: include: An input module, used for receiving alarm events; A generalization and normalization module is used to perform generalization and normalization processing on the information of the received alarm events; The feature extraction module collects statistics on the generalized and normalized information within the time window, and extracts alarm feature vectors from three dimensions from fine to coarse based on the source IP, destination IP and alarm type of the alarm event; The alarm noise reduction module uses the alarm model to determine the authenticity of alarm events based on the alarm feature vectors extracted from three dimensions; Output module, outputs real alarms.

2. The network security management device based on time window modeling according to claim 1 is characterized in that: In the time window, statistics are performed based on the first dimension to obtain an alarm feature vector of the first dimension, statistics are performed based on the second dimension to obtain an alarm feature vector of the second dimension, and statistics are performed based on the third dimension to obtain an alarm feature vector of the third dimension; Among them, the first dimension is based on the source IP, destination IP and alarm type, the second dimension is based on the source IP and destination IP, and the third dimension is based on the source IP and the total number of alarm types.

3. The network security management device based on time window modeling according to claim 2 is characterized in that: The method of using the alarm model to judge the authenticity of the alarm event includes the following steps: Step S201: Perform first dimension matching on the alarm feature vector of the first dimension and the alarm model of the first dimension. If the first dimension matching is successful, proceed to the next step, otherwise exit; Step S202: while performing second dimension matching on the alarm feature vector of the second dimension and the alarm model of the second dimension, performing third dimension matching on the alarm feature vector of the third dimension and the alarm model of the third dimension; If the second dimension matches successfully or / and the third dimension matches successfully, the alarm event is judged to be a true alarm, otherwise it is a false alarm.

4. The network security management device based on time window modeling according to claim 3 is characterized in that: When performing first dimension matching, if the first condition is met, the first dimension matching is successful; For scanning attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is greater than or equal to the first total number of destination ports threshold, and the total number of alarms is greater than or equal to the first total number of alarms threshold; For other types of attacks, the first condition is: within the time window, the total number of destination ports involved in the alarm event is less than the first total number of destination ports threshold, and the total number of alarms is greater than or equal to the first total number of alarms threshold.

5. The network security management device based on time window modeling according to claim 4 is characterized in that: When performing the second dimension matching, if the second condition is met, the second dimension matching is successful; The second condition is: within the time window, the total number of alarm types is greater than or equal to the total number threshold of alarm types, and the total number of alarms is greater than or equal to the second total number threshold of alarms.

6. The network security management device based on time window modeling according to claim 5 is characterized in that: When performing third dimension matching, if the third condition is met, the third dimension matching is successful; The third condition is: within the time window, the total number of destination IP addresses or the total number of destination ports of the alarm event meets the standard, and the total number of alarms is greater than or equal to the third total number of alarms threshold; For scanning attacks or worm attacks, the standard is met when the total number of destination IP addresses is greater than or equal to the total number of destination IP addresses threshold, or the total number of destination ports is greater than or equal to the second total number of destination ports threshold; For other types of attacks, the standard is met when the total number of destination IPs is less than the total number threshold of destination IPs, and the total number of destination ports is less than the total number threshold of the second alarm type.

7. The network security management device based on time window modeling according to any one of claims 1 to 6, characterized in that: The generalized and normalized information includes source IP, destination IP, alarm type, destination port and total number of alarms.

8. A network security management method based on time window modeling, characterized in that: The following steps are involved: Step S301: generalize and normalize the received alarm events, and perform statistical aggregation based on the time window; Step S302: Based on the information obtained in step S301, extract the alarm feature vector from three dimensions from fine to coarse; Step S303: Based on the extracted alarm feature vectors of three dimensions, the alarm model is used to determine the authenticity of the alarm event.

9. The network security management method based on time window modeling according to claim 8 is characterized in that: The three-dimensional warning feature vectors include: The alarm feature vector of the first dimension is based on the source IP, destination IP and alarm type. The total number of alarm types and the total number of alarms are counted within the time window. The second dimension of the alarm feature vector is based on the source IP and destination IP. The total number of alarm types and the total number of alarms are counted within the time window. The third dimension of the alarm feature vector is based on the source IP and alarm type. Within the time window, the total number of destination IPs, the total number of alarm types, and the total number of alarms are counted; The total number of alarm types refers to the total number of destination ports involved in the alarm event within the time window; the total number of alarms refers to the total number of alarms within the time window; the total number of alarm types refers to the total number of alarm types of the alarm event; and the total number of destination IPs refers to the total number of destination IPs of the alarm event.

10. The network security management method based on time window modeling according to claim 9 is characterized in that: The step S303 includes: Perform first dimension matching of the alarm feature vector of the first dimension with the alarm model of the first dimension, and if the first dimension matching is successful, continue with the subsequent matching, otherwise exit; While performing second dimension matching on the extracted alarm feature vector of the second dimension and the alarm model of the second dimension, performing third dimension matching on the extracted alarm feature vector of the third dimension and the alarm model of the third dimension; If the second dimension matches successfully or / and the third dimension matches successfully, the alarm event is judged to be a true alarm, otherwise it is a false alarm.

Images