Network security alarm method, device, equipment and storage medium

Abstract

The invention discloses a network security alarm method, device and equipment and a storage medium, which are applied to the field of network security, and are characterized in that an alarm element language set is extracted from structured knowledge and semi-structured knowledge, and an alarm aggregation rule is constructed based on the alarm element language set; establishing rule trees based on the alarm aggregation rule, determining inter-tree similarity among the rule trees, clustering the rule trees through a clustering algorithm based on the inter-tree similarity, and merging the rule trees in each cluster; and after merging is completed, associating the rule tree based on the rule relationship to generate a directed association graph, and aggregating the alarm data based on the rule tree and the directed association graph to generate a network security event. According to the method, the rule trees are constructed through the alarm aggregation rules, the similar rule trees are combined, association between the rule trees is carried out based on the rule relation, the repetition degree between the rules is reduced, the logic relation is obtained and maintained from the rule level, and the situation of repetition or suppression of triggering of security events is avoided.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security alarm method, a network security alarm method device, a network security alarm device and a computer-readable storage medium. Background Art

[0002] In the scenario of security operations, security personnel are responsible for monitoring, protecting and maintaining the overall security of the target organization's security system. In response to different types of network attacks, security personnel need to deal with different types of security equipment, such as firewalls, intrusion detection systems, vulnerability scanning systems, bastion hosts, honeypots, etc. When a security incident occurs, multiple devices may simultaneously generate duplicate, similar or conflicting logs. The alarm storm caused by a large number of duplicate alarms makes the security operator's attention drowned in the massive alarms, making it impossible to conduct an overall analysis of the security incident and make effective disposal measures, which further increases the losses caused by the security incident.

[0003] The existing technology generally aggregates alarms to form security events by means of rule aggregation, but the rules used for aggregation may be similar, overlapping, or opposite, resulting in duplication or suppression of the triggering of security events. Summary of the invention

[0004] The purpose of the present invention is to provide a network security alarm method, device, equipment and storage medium, which are applied to the field of network security. The method constructs a rule tree through alarm aggregation rules, merges similar rule trees, and merges the associations between rule trees based on rule relationships, thereby reducing the duplication between rules, obtaining and maintaining logical relationships at the rule level, and avoiding duplication or suppressing the occurrence of triggering security incidents.

[0005] In order to solve the above technical problems, the present invention provides a network security alarm method, comprising:

[0006] Extracting alarm meta-words from structured knowledge and semi-structured knowledge, and constructing alarm aggregation rules based on the alarm meta-words;

[0007] A rule tree is constructed based on the alarm aggregation rule; the root node in the rule tree is the alarm primitive set, the child nodes are entities in the alarm primitive set, and the node parent-child relationship is the pre-order of entities within the alarm primitive set;

[0008] Determine the inter-tree similarity between the Ruled Trees, cluster the Ruled Trees using a clustering algorithm based on the inter-tree similarity, and merge the Ruled Trees in each cluster;

[0009] After the merging is completed, the rule trees are associated based on the rule relationships to generate a directed association graph; the vertices of the directed association graph are the rule trees, and the edges are the rule relationships;

[0010] Acquire alarm data, and aggregate the alarm data based on the rule tree and the directed association graph to generate a network security event.

[0011] Optionally, determining the inter-tree similarity between the rule trees, and clustering the rule trees by a clustering algorithm based on the inter-tree similarity, comprises:

[0012] Extracting node features from node attributes of the rule tree based on a feature extraction function;

[0013] Determine a hash feature value of the node feature based on a SimHash algorithm, and determine a first inter-tree similarity between the rule trees based on the hash feature value;

[0014] Determine a first similarity threshold, classify the rule trees whose first inter-tree similarities are greater than the first similarity threshold, and obtain a preliminarily screened similar tree set;

[0015] In the initially screened similar tree set, a tree edit distance between the regular trees is determined based on the Zhang-Shasha algorithm, and a second inter-tree similarity between the regular trees is determined based on the tree edit distance;

[0016] A second similarity threshold is determined, and the regular trees in each of the preliminarily screened similar tree sets are clustered by the clustering algorithm based on the second inter-tree similarity until the inter-cluster similarity is lower than the second similarity threshold.

[0017] Optionally, merging the rule trees in the clusters includes:

[0018] Determine a reference tree in each of the clusters, and align the remaining regular trees in each of the clusters with the reference tree based on a tree alignment algorithm;

[0019] The aligned nodes are merged, and the characteristic branches and characteristic nodes of each of the rule trees are retained.

[0020] Optionally, the network security alarm method further includes:

[0021] When generating a new Rule Tree, determining the hash feature values ​​of the new Rule Tree and the node features in the Rule Tree based on the SimHash algorithm;

[0022] Determine a first inter-tree similarity between the new Ruled Tree and the Ruled Tree based on the Hash feature value, and determine a maximum first inter-tree similarity from the first inter-tree similarities;

[0023] When the maximum first inter-tree similarity is greater than a first similarity threshold, merging the new Rule-Tree with the corresponding most similar Rule-Tree, and updating the directed association graph;

[0024] When the maximum first inter-tree similarity is less than the first similarity threshold, determining a tree edit distance between the rule trees based on the Zhang-Shasha algorithm, and determining a second inter-tree similarity between the new rule tree and the rule tree based on the tree edit distance;

[0025] A maximum second inter-tree similarity is determined from the second inter-tree similarities, and when the second inter-tree similarity is greater than a second similarity threshold, the new Rule-Tree is merged with the corresponding most similar Rule-Tree, and the directed association graph is updated.

[0026] Optionally, aggregating the alarm data based on the rule tree and the directed association graph to generate a network security event includes:

[0027] Converting the rule tree and the directed association graph into SQL-like rule statements;

[0028] Creating an alarm aggregation engine, and loading the rule statement into the alarm aggregation engine;

[0029] Acquire the alarm data, and input the alarm data into a normalizer and a diverter of the alarm aggregation engine for processing, so as to divert the normalized alarm data to a corresponding alarm aggregation processor in the alarm aggregation engine;

[0030] The network security event is generated based on the alarm data aggregated and normalized by the alarm aggregation processor.

[0031] Optionally, the basic grammatical structure of the rule statement includes: a WITH clause, used to define intermediate variables and aliases within the alarm aggregation rule; a FROM clause, used to define the alarm source; a WHERE clause, used to define the pre-filtering conditions for the alarm; a SELECT clause, used to perform field projection and conversion; a GROUP BY clause, used to group alarms according to preset dimensions; and a HAVING clause, used to define the triggering conditions for the network security event.

[0032] Optionally, the network security alarm method further includes:

[0033] Determine a disposal plan for the network security incident based on a predefined security knowledge graph, and send the disposal plan to the operation and maintenance end;

[0034] After receiving the information that the handling of the network security event is completed, the aggregation period of the alarm aggregation engine is updated.

[0035] In order to solve the above technical problems, the present invention provides a network security alarm device, comprising:

[0036] The first module is used to extract alarm meta-words from structured knowledge and semi-structured knowledge, and construct alarm aggregation rules based on the alarm meta-words;

[0037] The second module is used to construct a rule tree based on the alarm aggregation rule; the root node in the rule tree is the alarm primitive set, the child node is the entity in the alarm primitive set, and the node parent-child relationship is the pre-order of the entity in the alarm primitive set;

[0038] The third module is used to determine the inter-tree similarity between the rule trees, cluster the rule trees by a clustering algorithm based on the inter-tree similarity, and merge the rule trees in each cluster to obtain a merged rule tree;

[0039] A fourth module is used to associate the merged rule trees based on rule relationships to generate a directed association graph; the vertices of the directed association graph are the merged rule trees, and the edges are the rule relationships;

[0040] The fifth module is used to obtain alarm data, and aggregate the alarm data based on the merge rule tree and the directed association graph to generate a network security event.

[0041] In order to solve the above technical problems, the present invention provides a network security alarm device, comprising:

[0042] Memory, for storing computer programs;

[0043] A processor is used to implement the above-mentioned network security alarm method when executing the computer program.

[0044] In order to solve the above technical problems, the present invention provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, the above-mentioned network security alarm method is implemented.

[0045] It can be seen that the method of the present invention extracts alarm meta-words from structured knowledge and semi-structured knowledge, and constructs alarm aggregation rules based on the alarm meta-words; constructs a rule tree based on the alarm aggregation rules; the root node in the rule tree is the alarm meta-words, the child nodes are the entities in the alarm meta-words, and the node parent-child relationship is the pre-order of the entities inside the alarm meta-words; determines the inter-tree similarity between each rule tree, clusters the rule trees through a clustering algorithm based on the inter-tree similarity, and merges the rule trees in each cluster; after the merger is completed, associates the rule trees based on the rule relationship to generate a directed association graph; the vertices of the directed association graph are the rule trees, and the edges are the rule relationships; obtains alarm data, and aggregates the alarm data based on the rule tree and the directed association graph to generate a network security event.

[0046] By building a rule tree through alarm aggregation rules, similar rule trees are merged, and the association between rule trees is merged based on rule relationships, the duplication between rules is reduced, and logical relationships are obtained and maintained at the rule level, avoiding duplication or suppressing the triggering of security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0048] Figure 1 A flowchart of a network security alarm method provided by an embodiment of the present invention;

[0049] Figure 2 A structural framework diagram of an alarm aggregation engine provided by an embodiment of the present invention;

[0050] Figure 3 An example diagram of an alarm aggregation process provided by an embodiment of the present invention;

[0051] Figure 4 This is a structural block diagram of a network security alarm device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] In the scenario of security operations, security personnel are responsible for monitoring, protecting and maintaining the overall security of the target organization's security system. To target different types of network attacks, security personnel need to handle different types of security equipment, such as firewalls, intrusion detection systems, vulnerability scanning systems, bastion hosts, honeypots, etc. When a security incident occurs, multiple devices may simultaneously generate duplicate, similar, or conflicting logs. The alarm storm caused by a large number of duplicate alarms drowns the attention of security operators in the massive amount of alarms, making it impossible to conduct an overall analysis of security incidents and take effective measures to deal with them, which further increases the losses caused by security incidents.

[0054] In the complete and effective life cycle of a security incident handling, the generation of an alarm only marks the beginning of the process. Next, it is necessary to aggregate the related alarms into a security incident, build the correlation between the events, and then evaluate the effectiveness, threat level, and impact range of the event. Then, the handling means and responsible persons of the event are assigned, and finally the handling results are included in the event to facilitate the subsequent post-event review of the event. In the alarm aggregation stage, it is necessary to accurately identify the correlation between alarms, aggregate duplicate alarms, and associate logically related alarms to form a tractable security incident. In order to improve the response speed and response rate of security operators, the event needs to provide corresponding handling means, and the events must be sorted according to indicators such as threat level and impact range, so that security operators can give priority to handling incidents with greater harm.

[0055] In order to solve the alarm storm problem, the existing technical solutions generally use rule engines to dynamically load and execute alarm aggregation rules, and at the same time declare methods for distributing, storing, loading, and updating the status of the rules. The above scheme mainly aggregates alarms with relatively simple attributes in the power industry, such as the magnitude of voltage, the change cycle, etc., while the attributes of alarms in the network security industry are more complex, and there are more complex correlations between alarms. In the aggregation process, more correlation analysis and dynamic adjustment of the aggregation status are required to improve the aggregation effect. This scheme cannot effectively handle the duplication of alarm aggregation rules, the need for dynamic updates of the aggregation status, and the correlation between alarms after aggregation. The fields designed for alarm aggregation in this scheme are relatively simple, and the method of directly triggering security events by individual rules is not suitable for complex alarm logs in network security scenarios. Network security alarms have the characteristics of complex alarm attributes and complex correlations between alarms. Therefore, this scheme cannot be well migrated from the power industry to the network security industry.

[0056] There are also solutions using rules + flow engine (Flink) in the prior art. For network security scenarios, the correlation analysis capability is improved by classifying aggregation rules. The classification includes configuration type, statistical type, and correlation type. Feature type rules represent rules that directly generate security event notifications. Once these aggregation rules trigger the threshold, a security event will be generated. Statistical type and correlation type are combined aggregation types. The statistical type is responsible for quantitative relationship aggregation based on meta-information (such as network address, port, etc.). The correlation type performs a retrospective analysis based on the triggered statistical type to further aggregate multiple related alarms. The above solution splits the alarm aggregation process into statistical type and correlation type, and enhances the correlation analysis degree between alarms through secondary aggregation to improve the aggregation effect. However, the solution does not effectively manage the composition of rules. There may be similar, overlapping, and opposite problems between rules, which eventually leads to repeated or suppressed triggering of security events. At the same time, the correlation analysis during secondary aggregation requires retrospective analysis of all alarms contained in the current aggregation type, which has a large computational overhead and cannot guarantee real-time performance. Using Flink as a stream processing engine also makes it impossible to dynamically track the aggregated status of triggered security events, and it is impossible to dynamically update the status of remaining security events based on the security events that have been processed by security operators.

[0057] In order to solve the problems in the current network security alarm discovery and processing process, such as the single and difficult maintenance of duplicate alarm aggregation rules, duplication and conflict between alarm aggregation rules, inability to perform real-time hierarchical aggregation or high aggregation performance overhead, and inability to dynamically change the aggregation status, this application proposes a network security alarm method based on the actual needs of real-time aggregation, hierarchical notification and disposal of alarms to solve the above-mentioned alarm technical problems.

[0058] The following combination Figure 1 , Figure 1 A flowchart of a network security alarm method provided by an embodiment of the present invention, the method may include:

[0059] S101: extracting alarm meta-words from structured knowledge and semi-structured knowledge, and constructing alarm aggregation rules based on the alarm meta-words.

[0060] The knowledge graph is a structured semantic knowledge base that is used to describe concepts and their relationships in the physical world in a symbolic form. The basic components of the knowledge graph are "entity-relationship-entity" triples, as well as entities and their related attribute-value pairs. Entities are interconnected through relationships to form a network-like knowledge structure. The knowledge graph can realize the transformation of the Web from web page links to concept links, support users to search by topic rather than string, and truly realize semantic retrieval. Search engines based on knowledge graphs can provide users with structured knowledge in a graphical way, so that users can accurately locate and deeply acquire knowledge without browsing a large number of web pages.

[0061] This embodiment does not limit the data source of the alarm aggregation rules. Generally, the alarm aggregation rules can be extracted from structured knowledge and semi-structured knowledge. Generally, structured knowledge can include target rules constructed by domain experts, structured threat intelligence data, and STIX (Structured Threat Information Expression, a standardized language for describing and sharing network threat information) 2.1 threat intelligence data. Semi-structured knowledge can include domain expert experience, security forum and blog content, MITRE (Network Security Agency) knowledge base, and national information security vulnerability database.

[0062] For structured knowledge, this embodiment can directly obtain entities, relationships and attributes through the structured data access algorithm, and then convert them into alarm primitives of relevant safety devices through a mapping table, and further compose alarm aggregation rules based on the alarm primitive set.

[0063] For semi-structured knowledge, this embodiment can use natural language processing technology to extract entities and related relationships and attributes in the knowledge, perform semi-structured conversion, and then process it according to the process of semi-structured knowledge.

[0064] For example, for the report content of EternalBlue for CVE-2017-0143 (a high-risk vulnerability), the attack sequence extracted through natural language technology includes: scanning port 443 or 139, brute force cracking of port 443 or 139, constructing and transmitting SMB (Server Message Block, network sharing protocol) remote overflow attack, SMB service vulnerability exploitation, and subsequent possible Trojan implantation and lateral movement. These alarms are mapped into the corresponding device alarm primitives through the mapping table. For example, the firewall alarm firewall_alert_id corresponding to scanning port 443 is 1, the SMB remote overflow attack corresponds to the IDS (Intrusion Detection Systems) device alarm ids_alert_id is 2, and the lateral movement corresponds to the APT (Advanced Persistent Threat) detection device alarm apt_id is 3. Combining this information can obtain the alarm primitive set.

[0065] This embodiment can construct an alarm aggregation rule based on the extracted alarm primitives. Due to the rich knowledge sources, this embodiment can construct multiple alarm aggregation rules.

[0066] This embodiment does not limit the specific form of a complete alarm aggregation rule, which may generally include: an alarm primitive set, a condition set, a time window size, a threshold of a target field, and the like.

[0067] S102: construct a rule tree based on the alarm aggregation rule; the root node in the rule tree is the alarm primitive set, the child nodes are the entities in the alarm primitive set, and the node parent-child relationship is the pre-order of the entities in the alarm primitive set.

[0068] Since the knowledge sources that constitute the alarm aggregation rules are diverse, it is inevitable that there will be duplication and inclusion relationships between the rules. At the same time, the knowledge related to security incidents is constantly updated, which means that the alarm aggregation rules need to be continuously updated. In the existing technology, there is no step to merge or establish mutual correlation between alarm aggregation rules. Therefore, when new knowledge is added, the established rules cannot be updated synchronously and efficiently in a timely manner. For example, the Eternal Blue family has produced a new attack variant. From the perspective of handling security incidents, this aggregation rule should be merged with the existing Eternal Blue security alarm aggregation, but the existing technology cannot achieve this function quickly and efficiently.

[0069] In this embodiment, a rule tree can be constructed based on the obtained alarm aggregation rules. The root node in the rule tree is the alarm meta-word set, and the child nodes are entities in the alarm meta-word set, such as port scanning, port blasting-443, and vulnerability exploit-Payload.

[0070] The node parent-child relationship is the preceding order of entities within the alarm meta-language. For example, in the EternalBlue security incident, there must be an SMB vulnerability exploitation alarm before the SMB blasting alarm can be aggregated. Therefore, the SMB blasting node in the rule tree needs to be a child node of the SMB vulnerability exploitation node.

[0071] In this embodiment, the rule tree can be defined as T=(V,E,R), where V represents the node set of the rule tree, V={v0,v1,…,v n}, v0 represents the root node (i.e., the warning primitive set), v i (i>0) represents each entity node.

[0072] E represents the edge set, E V×V,E={(v i ,v j )},v i Yes j The parent node of .

[0073] R is the mapping function from the node set to the attribute set P, R:V→P, P={p1,p2,…,p m} is for any v i ∈V,R(v i ) The set of attributes of P.

[0074] S103: determining the inter-tree similarity between the rule trees, clustering the rule trees by a clustering algorithm based on the inter-tree similarity, and merging the rule trees in each cluster.

[0075] After constructing the rule trees of each alarm aggregation rule, this embodiment can determine the inter-tree similarity between the rule trees, cluster the rule trees through a clustering algorithm based on the inter-tree similarity, merge the rule trees in each cluster, and obtain a merged rule tree.

[0076] Specifically, the constructed rule trees can be combined into a rule tree set {T1, T2, …, T n}, a single rule tree can be represented as T i =(V i ,E i ,R i ), the subscript is the number.

[0077] This embodiment does not limit the specific process of determining the inter-tree similarity between rule trees, which can generally be divided into preliminary calculation and precise calculation. Specifically, node features are extracted from node attributes of the rule tree based on a feature extraction function; hash feature values ​​of the node features are determined based on the SimHash algorithm, and the first inter-tree similarity between the rule trees is determined based on the hash feature values; a first similarity threshold is determined, and the rule trees whose first inter-tree similarity is greater than the first similarity threshold are classified to obtain a preliminary screening similar tree set; in the preliminary screening similar tree set, the tree edit distance between the rule trees is determined based on the Zhang-Shasha algorithm, and the second inter-tree similarity between the rule trees is determined based on the tree edit distance.

[0078] This embodiment does not limit the specific type of feature extraction function, which can be determined based on actual applications. The feature extraction function F can be used to extract the feature from the rule tree T i Extract the feature F(T i ), F(T i ) = {f1,f2,…,f m}, where f j is from the rule tree T i Node features extracted from node attributes.

[0079] SimHash itself is a local sensitive hash algorithm. The hash signature it generates can represent the similarity of the original content to a certain extent. Therefore, in this embodiment, the SimHash algorithm can be used to determine the hash feature value H(T) of the node feature corresponding to each rule tree. i )=SimHash(F(T i )).

[0080] In this embodiment, the first inter-tree similarity between the rule trees may be determined based on the hash feature value. Specifically, the hash feature values ​​of the two rule trees may be input into a first similarity calculation function to obtain the first inter-tree similarity. In this embodiment, the specific type of the similarity function is not limited, and it may generally be:

[0081] Sim1(T i ,T j )=1–HammingDistance(H(T i ),H(T j ))÷k;

[0082] Where, Sim1(T i ,T j ) are two regular trees T i With T j The first inter-tree similarity between i ) is T i The hash feature value of Hamming Distance is the Hamming distance calculation function, H(T j ) is T j The hash characteristic value of , k is the number of digits of SimHash.

[0083] After calculating the first inter-tree similarity between the rule trees, the present embodiment may set a first similarity threshold θ1, classify similar rule trees based on the first similarity threshold, and obtain a pre-screened similar tree set.

[0084] Specifically, when the first inter-tree similarity between two rule trees is greater than the first similarity threshold, the two rule trees can be determined to be similar rule trees after preliminary screening. The corresponding formula is: Define the total set of preliminary screening similar trees S={S1,S2,…,S p}, where the initial screening similar tree set S q ={T i ,T j ,…},satisfy T i ,T j ∈S q ,Sim1(T i ,T j )≥θ1.

[0085] After the preliminary screening, this embodiment can further perform an accurate calculation of the similarity between trees. Specifically, the Zhang-Shasha algorithm is used to calculate the accurate tree edit distance for the tree pairs after the preliminary screening. The tree edit distance can represent the minimum number of operations to convert one tree into another tree, that is, in each preliminary screening similar tree set S qIn the method, the tree edit distance between each regular tree in the set is calculated by the Zhang-Shasha algorithm, and the second inter-tree similarity between the regular trees is determined based on the tree edit distance.

[0086] This embodiment does not limit the specific method of determining the second inter-tree similarity between regular trees based on the tree edit distance. Generally, the tree edit distance can be input into the second similarity calculation function to determine the second inter-tree similarity. The expression of the second similarity calculation function can be:

[0087] Sim2(T i ,T j )=1-(EditDistance(T i ,T j ) / MaxEditDistance);

[0088] Where, Sim2(T i ,T j ) are two regular trees T i With T j The second tree similarity between i ,T j ) are two regular trees T i With T j The tree edit distance between them, MaxEditDistance is the regular tree T i With T j The maximum possible tree edit distance.

[0089] In this embodiment, two similarity calculations are performed successively mainly for efficiency considerations. SimHash is a local sensitive hashing algorithm that maps high-dimensional features to low-dimensional space and can quickly determine similarity, but there will be certain misjudgments. Zhang-Shasha is an algorithm for calculating the tree edit distance. The tree edit distance represents the minimum number of edit operations (insertion, deletion, and replacement of nodes) required to convert one tree into another. This distance does more accurately reflect the similarity of the tree structure. In the first stage, SimHash and Hamming distance are used to calculate the similarity. The calculation complexity is low and trees that are obviously dissimilar can be quickly screened out. In the second stage, the Zhang-Shasha algorithm is used to calculate the similarity. Although the complexity is increased, the similarity between trees can be accurately determined.

[0090] SimHash may have false positives (judged similar but actually dissimilar), but is unlikely to have false negatives (judged dissimilar but actually similar). The Zhang-Shasha algorithm not only gives the distance, but also the specific editing operation sequence. The effect of the two-stage filtering depends on the first similarity threshold setting of SimHash, which requires a trade-off between accuracy and efficiency and can be set based on actual application scenarios.

[0091] Furthermore, after calculating the second inter-tree similarity, the present embodiment may set a second similarity threshold θ2, and cluster the regular trees in each preliminarily screened similar tree set by a clustering algorithm based on the second inter-tree similarity until the inter-cluster similarity is lower than the second similarity threshold.

[0092] The second similarity threshold in this embodiment is used to determine whether two rule trees are exactly similar trees. i ,T j )≥θ2, it can be determined that T i With T j is an exact similarity tree.

[0093] Therefore, this embodiment can cluster the regular trees in the initial screening similar tree set based on the second similarity threshold. In each initial screening similar tree set, a hierarchical clustering algorithm is used to group similar trees, and a bottom-up agglomerative hierarchical clustering method is adopted. Clustering is stopped when the similarity between clusters is lower than the threshold.

[0094] After clustering is completed, this embodiment can merge the rule trees in the clusters. This embodiment does not limit the method of merging rule trees. Generally, a benchmark tree can be determined in each cluster, and the remaining rule trees in each cluster are aligned with the benchmark tree based on the tree alignment algorithm; the aligned nodes are merged, and the characteristic branches and characteristic nodes of each rule tree are retained to obtain a merged rule tree.

[0095] This embodiment does not limit the method for determining the reference tree, and generally the tree with the largest tree length or number of nodes can be selected. Further, a tree alignment algorithm such as the maximum common subtree algorithm can be used to align other regular trees in the cluster with the base tree, merge the aligned nodes, and retain all unique branches and nodes.

[0096] In this embodiment, if there is a single Rule Tree that is not similar to any other Rule Tree, there is no need to merge the single Rule Tree.

[0097] This embodiment does not limit the merging process of the rule tree. Generally, the total cluster set J={J1,J2,…,J p}, for any cluster J q , determine J qThe node set union of all rule trees in V union =∪V i |T i ∈J q .

[0098] For V union For each tree node v in, define support(v)=|{T i |v∈V i ,Ti∈S q}|÷|S q |.

[0099] In this embodiment, the support Support(v) can be expressed in J q The proportion of trees that contain node v.

[0100] We can further construct the merge tree T merged =(V merged ,E merged ,R merged ), where V merged =v|v∈V union ,Support(v)≥σ,σ is the node retention threshold,E merged ={(v i ,v j )| T k ∈J q ,(v i ,v j )∈E k ,v i ,v j ∈V merged , R merged (v)=MergeAttributes(R i (v)|T i ∈J q ,v∈V i ).

[0101] In this embodiment, MergeAttributes is an attribute merging function. The specific MergeAttributes function can represent the empirical process of attribute merging, including but not limited to: when merging the attribute sets of the same node v in multiple rule trees, if the attribute is a numerical type (such as a time window, a threshold), take the maximum value (to ensure that all scenarios are covered); if the attribute is an enumeration type (such as an alarm type), take the union. The attribute merging method of MergeAttributes can be determined based on the actual empirical process.

[0102] S104: After the merging is completed, the rule trees are associated based on the rule relationships to generate a directed association graph; the vertices of the directed association graph are the merged rule trees, and the edges are the rule relationships.

[0103] In this embodiment, after similar rule trees are merged, this embodiment can associate the rule trees based on rule relationships to generate a directed association graph; the vertices of the directed association graph are the merged rule trees, and the edges are the rule relationships.

[0104] Specifically, this embodiment can construct and maintain the association relationship between these rule trees based on the rule relationship extracted from the structured knowledge and the semi-structured knowledge.

[0105] There may be multiple relationships between rules, such as temporal relationship, causal relationship, and combination relationship. Temporal relationship indicates the order of occurrence between rules, causal relationship indicates that the triggering of some rules depends on the satisfaction of other rules, and combination relationship indicates that multiple rules together constitute different aspects of a certain type of security incident.

[0106] This embodiment does not limit the specific method of extracting and storing rule relationships. Generally, a directed association graph can be used as the basic data structure. The directed association graph can be expressed as G=(M,N), where the vertex M represents the rule tree and the edge N represents the relationship between the rules. The directed association graph is implemented using an adjacency list structure, and each vertex maintains its outgoing and incoming edge lists to facilitate rapid search for related rules.

[0107] Each edge N records the type of relationship between rules, which can be directly determined by prior knowledge. Relationship types include pre-triggering (requires strict time sequence), simultaneous triggering (needs to appear together within a specified time window), mutual exclusion (rules cannot be triggered at the same time), etc. For example, for the rule tree T i and T j , if T is known i The behavior described is T j The necessary prerequisite and must occur within a specific time window, then a line from T i to T j and label it T i T j Pre-trigger relationship.

[0108] Furthermore, this embodiment can construct upper-level rules and identify closely related rule subsets based on the structural characteristics of the directed association graph. By analyzing the relationship type of the edge, the rules with a complete attack link or constituting a specific security event are grouped together. For each rule subset, the upper-level composite rule is constructed according to the relationship type of the edge, and its triggering logic is determined, including required rules, optional rules, and mutually exclusive rules. This structure can accurately express specific attack scenarios and complete security events. Finally, the specific rule content can be converted according to the rule format required by the target analysis engine.

[0109] Furthermore, in the prior art, when new knowledge is added, the established rules cannot be updated synchronously and efficiently in a timely manner. Therefore, in this embodiment, when a new alarm aggregation rule is added, a new rule tree can be constructed based on the new alarm aggregation rule, and the directed association graph can be updated.

[0110] Specifically, when a new rule tree is generated, the hash feature values ​​of the new rule tree and the node features in the rule tree are determined based on the SimHash algorithm; the first inter-tree similarity between the new rule tree and the rule tree is determined based on the hash feature value, and the maximum first inter-tree similarity is determined from the first inter-tree similarities; when the maximum first inter-tree similarity is greater than (or equal to) the first similarity threshold, the new rule tree is merged with the corresponding most similar rule tree, and the directed association graph is updated.

[0111] When the maximum first inter-tree similarity is less than the first similarity threshold, the tree edit distance between the rule trees is determined based on the Zhang-Shasha algorithm, and the second inter-tree similarity between the new rule tree and the rule tree is determined based on the tree edit distance; the maximum second inter-tree similarity is determined from the second inter-tree similarities, and when the second inter-tree similarity is greater than (or equal to) the second similarity threshold, the new rule tree is merged with the corresponding most similar rule tree, and the directed association graph is updated.

[0112] In order to improve the computational efficiency, when a new rule tree is added, the present embodiment may firstly use the SimHash algorithm to preliminarily determine whether the new rule tree can be merged with the existing rule tree, determine the hash feature values ​​of the new rule tree and the node features in the rule tree based on the SimHash algorithm, and determine the first inter-tree similarity between the new rule tree and the rule tree based on the hash feature values.

[0113] In this embodiment, the new rule tree can be merged with the corresponding most similar rule tree, that is, the maximum first inter-tree similarity is determined from the first inter-tree similarities; when the maximum first inter-tree similarity is greater than the first similarity threshold, the new rule tree is merged with the most similar rule tree corresponding to the maximum first inter-tree similarity.

[0114] When the SimHash algorithm determines that there is no existing tree similar to the new Ruled Tree, the Zhang-Shasha algorithm can be used for further determination. That is, when the maximum first inter-tree similarity is less than the first similarity threshold, the tree edit distance between the Ruled Trees is determined based on the Zhang-Shasha algorithm, and the second inter-tree similarity between the new Ruled Tree and the Ruled Tree is determined based on the tree edit distance.

[0115] In this embodiment, the new rule tree can be merged with the most similar rule tree, that is, the maximum second inter-tree similarity is determined from the second inter-tree similarities, and when the second inter-tree similarity is greater than the second similarity threshold, the new rule tree is merged with the most similar rule tree corresponding to the maximum second inter-tree similarity, and the directed association graph is updated.

[0116] If the second inter-tree similarity is less than the second similarity threshold, it can be considered that there is no similarity relationship between the existing Rule-Tree and the new Rule-Tree, and there is no need to merge the new Rule-Tree.

[0117] S105: Acquire alarm data, and aggregate the alarm data based on the rule tree and the directed association graph to generate a network security event.

[0118] This embodiment can obtain alarm data, aggregate the alarm data based on the rule tree and the directed association graph to generate a network security event.

[0119] The rules of security events are the basis for alarm aggregation. By matching the original alarm data with the rule tree and determining whether a security event is triggered, a large number of alarms can be reduced to specific security event notifications. The noise reduction ratio calculation formula is: 1-(event volume / original alarm volume)*100%.

[0120] This embodiment does not limit the specific method of performing alarm aggregation. An alarm aggregation engine can be created and rule statements can be loaded into the alarm aggregation engine; alarm data can be obtained and input into the normalizer and diverter of the alarm aggregation engine for processing so as to divert the normalized alarm data to the corresponding alarm aggregation processor in the alarm aggregation engine; and network security events can be generated based on the aggregation of normalized alarm data by the alarm aggregation processor.

[0121] Specifically, the overall process can be as follows Figure 2 As shown in the figure, the engine is mainly composed of the following core parts:

[0122] Data input layer: includes two data channels: alarm data access and rule configuration. In the alarm data access channel, the alarm data is processed by the normalizer and splitter. The output of the splitter is pre-filtered to pre-check the alarm information, identify and exclude non-critical or repeated alarms, reduce the burden of subsequent processing, and ensure that the main alarms are paid attention to and processed in time; in the rule configuration data channel, it is used to load and parse the converted rule content, that is, to convert the alarm aggregation rules into a tree structure, including rule API (Application Programming Interface) parsing, syntax parsing, semantic parsing and AST (Abstract Syntax Tree) construction. The constructed rule tree needs to complete similarity calculation, aggregation, rule tree merging, association and other operations in the aggregation primitive workflow.

[0123] Processing core layer: It is composed of alarm aggregation processors, which process the normalized alarm stream according to the loaded rule content, including pre-filtering and aggregation logic defined by the rules. The alarm aggregation processor can adjust its processing strategy in real time according to the dynamic update of the rules.

[0124] Aggregation output layer: includes aggregation status maintenance, security event generation, event alarm notification and event processing result feedback, forming a complete alarm processing closed loop.

[0125] In this embodiment, in order to facilitate the maintenance and intuitive display of rules, and to ensure that the rules can be efficiently executed in the engine designed in this chapter, the graph structure and tree structure in this embodiment can be mapped to SQL-Like (SQL-like) rule statements. This mapping not only retains the semantic integrity of the rules, but also provides a clear way to express the rules. The basic grammatical structure of the rule statement may include: a WITH clause, which is used to define the intermediate variables and aliases within the alarm aggregation rules; a FROM clause, which is used to define the alarm source; a WHERE clause, which is used to define the pre-filtering conditions of the alarm; a SELECT clause, which is used to perform field projection and conversion; a GROUP BY clause, which is used to group alarms according to preset dimensions; and a HAVING clause, which is used to define the triggering conditions of the network security events.

[0126] SQL (Structured Query Language) is a declarative language that can clearly express the intention of data processing, making the semantics of rules easier to understand and maintain. Secondly, the various components of the rules naturally correspond to the processing flow of the alarm aggregation engine. FROM and WHERE correspond to the preprocessing and filtering stages, and GROUP BY and HAVING correspond to the aggregation processing stage. Finally, this structured rule format facilitates rule verification, optimization, and conversion. The engine can directly parse the rule statements and build an efficient execution plan. This mapping method not only ensures the expressiveness of the rules, but also ensures that the rules can be executed efficiently in the engine. At the same time, the modification and maintenance of the rules have become more intuitive and convenient. Security analysts can focus on the semantic design of the rules without having to pay attention to the underlying implementation details.

[0127] The reference structure of the rule is as follows:

[0128] [WITH <alias definition>];

[0129] FROM <alarm source>;

[0130] [WHERE <filter condition>];

[0131] SELECT <projection definition>;

[0132] [GROUP BY <grouping field>];

[0133] [HAVING <security event trigger condition>].

[0134] In this embodiment, the alarm aggregation engine dynamically processes SQL-Like rule statements through the rule loading module (rule configuration data channel). The rule loading module first uses the AST syntax parser to parse the rule statement into an abstract syntax tree. The parsing process strictly follows the rule syntax definition to ensure the integrity of the rule semantics. The AST tree structure obtained by parsing reflects the logical order of rule processing: FROM and WHERE nodes correspond to alarm source selection and pre-filtering logic, SELECT nodes represent field projection and conversion operations, and GROUP BY and HAVING nodes correspond to group aggregation and event trigger judgment logic.

[0135] The alarm aggregation engine converts each processing node into a corresponding operator according to the structure of the AST tree, and assembles these operators into a complete alarm aggregation processor according to the execution order of the rules. As the runtime carrier of the rules, the alarm aggregation processor is responsible for maintaining the status information during the rule execution process, including group counts, time windows, threshold statistics, etc.

[0136] When the alarm data stream passes through the alarm aggregation processor, the processor will update the internal state according to the logic defined by the rule and trigger a security event when the conditions defined by the HAVING clause are met. This rule loading mechanism based on SQL-Like syntax enables the engine to flexibly adapt to different alarm aggregation scenarios while ensuring the efficiency of rule execution and the reliability of state management.

[0137] This embodiment does not limit the specific process of polymerization. Generally, it can be as follows Figure 3 As shown, the input source is first normalized. This embodiment can simultaneously connect multiple alarm input sources, such as firewalls, gateways, bastion hosts, IDS and other protective devices of different brands in an organization. This embodiment can use pre-trained machine learning models and natural language processing algorithms to extract and normalize metadata in the original alarm text to unify the input entity type. The normalized data needs to conform to the unified data model defined by the engine to ensure the standardization of subsequent processing procedures.

[0138] Furthermore, the input source is split. After the alarm data enters the alarm aggregation engine, the alarm aggregation engine splits the normalized alarm data to the corresponding alarm aggregation processor through the splitter according to the FROM and WHERE clause definitions of the loaded SQL-Like rules. The splitting process will take into account the activation status and priority of the rules to ensure that the alarm data can be correctly routed to the corresponding alarm aggregation processor.

[0139] The alarm aggregation processor aggregates the acquired alarm data. During the aggregation process, alarm processing and status maintenance can be performed. As the execution carrier of the rules, the alarm aggregation processor is responsible for maintaining various status information during the rule runtime. This status information includes: alarm counts based on the grouping dimension defined by the GROUP BY clause, aggregation window information defined in the HAVING clause (such as start time and duration), trigger conditions and processing status of security events, and precondition status related to other rules.

[0140] In this embodiment, the alarm aggregation processor can check whether the triggering conditions of the network security event are all in the triggering state; if so, the corresponding network security event can be triggered to be generated; if not, the alarm aggregation can continue to be performed based on the input data of the input source.

[0141] In the network security event triggering process, the previous security event triggering status is checked. Specifically, based on the constructed directed association graph, the previous dependency status of the corresponding rule is checked when processing each alarm. This dependency relationship is declared through the WITH clause of the SQL-Like rule, making the status sharing between rules clearer.

[0142] For example, port scanning and blasting security events, as basic events, are often the prerequisites for other advanced threat events. When such basic events are triggered, their status will be recorded and shared with all subsequent rules that depend on them, thereby activating the detection logic of these rules and effectively avoiding repeated calculations.

[0143] During the alarm aggregation process, this embodiment can update and check the aggregation state of the alarm aggregation processor. After the alarm is diverted, it enters the corresponding alarm aggregation processor. The alarm aggregation processor updates its internal state according to the grouping conditions defined by GROUP BY in the rule and the aggregation conditions in the HAVING clause. These states include information such as count statistics, time windows, and threshold accumulation. After the state update is completed, the processor will check whether the trigger conditions defined by the rule are met. If they are met, it will enter the network security event generation process, otherwise it will continue to maintain the aggregation state.

[0144] In the process of generating network security alarm events, when the alarm aggregation processor confirms that all trigger conditions are met, a corresponding security event will be generated. Furthermore, this embodiment can also determine the disposal plan for network security events based on the predefined security knowledge graph and send the disposal plan to the operation and maintenance end; after receiving the disposal completion information of the network security event, the aggregation state of the alarm aggregation processor can be reset and the aggregation cycle of the alarm aggregation processor can be updated.

[0145] The system automatically retrieves and associates applicable disposal plans and processes through the security knowledge graph predefined in the rules, and notifies security operations personnel of this information as extended attributes of the event, thereby improving response efficiency.

[0146] After the operator has completed the event handling, the event can be marked as handled. At this time, the aggregation processor that triggered the event will reset its internal state and start a new aggregation cycle. The handled event still retains its activation effect on subsequent rules. This is because even if the threat has been handled, its role as an indicator of a link in the attack chain is still valid. This processing mechanism ensures the integrity of the attack chain analysis.

[0147] This embodiment processes structured and semi-structured security knowledge by using natural prediction processing, converts it into an alarm aggregation primitive set, and then maintains the meta-information of the aggregation rule by converting the primitive set into an alarm aggregation rule tree. The final aggregation alarm rule is maintained and generated through the tree similarity algorithm, tree merging algorithm, subtree query algorithm, constructed relationship graph and corresponding graph search algorithm. Compared with the existing solutions, this solution can reduce the duplication between rules through the above technology, obtain and maintain logical relationships at the rule level, and reduce the cost of maintaining existing rules by adding new security knowledge.

[0148] This embodiment compiles through SQL-Like syntax rules, parses the alarm aggregation rules through the alarm aggregation engine and converts them into an alarm aggregation processor, and aggregates the alarms in real time through the alarm aggregation processor. Compared with some alarm aggregation solutions based on knowledge graphs or artificial intelligence technology, this solution has higher real-time performance, can discover and handle alarms in the early stages of the attack chain, and prevent security incidents from further threatening the organization.

[0149] This solution uses a rule tree and a directed association graph that marks the logical relationships between rules. It can easily apply technologies such as knowledge graphs to retrieve the handling methods corresponding to the alarm aggregation rules from the knowledge graph and bind them to the corresponding security events, making it easier for security operators to quickly handle and respond to threats.

[0150] Compared with the existing solutions using technologies such as Flink (streaming framework), the design of the alarm aggregation engine in this solution has better real-time dynamic state maintenance features. It can use the handling results of security incidents by security personnel to update the triggered security incidents, and use the logical relationship between security incidents to share the aggregation state of basic events, reduce the performance overhead of aggregation operations, and further improve real-time performance.

[0151] Based on the above embodiments, the method of the present invention constructs a rule tree through alarm aggregation rules, merges similar rule trees, and merges the associations between rule trees based on rule relationships, thereby reducing the duplication between rules, obtaining and maintaining logical relationships at the rule level, and avoiding duplication or suppressing the triggering of security incidents.

[0152] The following combination Figure 4 , Figure 4 A structural block diagram of a network security alarm device provided by an embodiment of the present invention, the device may include:

[0153] The first module 100 is used to extract alarm primitives from structured knowledge and semi-structured knowledge, and construct alarm aggregation rules based on the alarm primitives;

[0154] The second module 200 is used to construct a rule tree based on the alarm aggregation rule; the root node in the rule tree is the alarm primitive set, the child nodes are the entities in the alarm primitive set, and the node parent-child relationship is the pre-order of the entities in the alarm primitive set;

[0155] The third module 300 is used to determine the inter-tree similarity between the Rule-Trees, cluster the Rule-Trees by a clustering algorithm based on the inter-tree similarity, and merge the Rule-Trees in each cluster;

[0156] The fourth module 400 is used to associate the rule trees based on the rule relationships to generate a directed association graph after the merging is completed; the vertices of the directed association graph are the rule trees, and the edges are the rule relationships;

[0157] The fifth module 500 is used to obtain alarm data, and aggregate the alarm data based on the rule tree and the directed association graph to generate a network security event.

[0158] Based on the above embodiments, the method of the present invention constructs a rule tree through alarm aggregation rules, merges similar rule trees, and merges the associations between rule trees based on rule relationships, thereby reducing the duplication between rules, obtaining and maintaining logical relationships at the rule level, and avoiding duplication or suppressing the triggering of security incidents.

[0159] Based on the above embodiment, the third module 300 may include:

[0160] The first unit is used to extract node features from node attributes of the rule tree based on a feature extraction function;

[0161] A second unit is used to determine a hash feature value of the node feature based on a SimHash algorithm, and determine a first inter-tree similarity between the rule trees based on the hash feature value;

[0162] The third unit is used to determine a first similarity threshold, classify the rule trees whose first inter-tree similarities are greater than the first similarity threshold, and obtain a pre-screened similar tree set;

[0163] A fourth unit is used to determine, in the pre-screened similar tree set, a tree edit distance between the regular trees based on the Zhang-Shasha algorithm, and determine a second inter-tree similarity between the regular trees based on the tree edit distance;

[0164] The fifth unit is used to determine a second similarity threshold, and cluster the regular trees in each of the preliminarily screened similar tree sets by the clustering algorithm based on the second inter-tree similarity until the inter-cluster similarity is lower than the second similarity threshold.

[0165] Based on the above embodiments, the third module 300 may include:

[0166] A sixth unit is used to determine a reference tree in each of the clusters, and align the remaining regular trees in each of the clusters with the reference tree based on a tree alignment algorithm;

[0167] The seventh unit is used to merge the aligned nodes and retain the characteristic branches and characteristic nodes of each of the rule trees.

[0168] Based on the above embodiments, the device may further include:

[0169] The sixth module is used to determine the hash feature values ​​of the new Rule Tree and the node features in the Rule Tree based on the SimHash algorithm when generating a new Rule Tree;

[0170] A seventh module is used to determine a first inter-tree similarity between the new Ruled Tree and the Ruled Tree based on the Hash feature value, and determine a maximum first inter-tree similarity from the first inter-tree similarities;

[0171] An eighth module, configured to merge the new Rule Tree with the corresponding most similar Rule Tree when the maximum first inter-tree similarity is greater than a first similarity threshold, and update the directed association graph;

[0172] A ninth module, configured to determine, when the maximum first inter-tree similarity is less than a first similarity threshold, a tree edit distance between the regular trees based on a Zhang-Shasha algorithm, and determine a second inter-tree similarity between the new regular tree and the regular tree based on the tree edit distance;

[0173] The tenth module is used to determine the maximum second inter-tree similarity from the second inter-tree similarities, and when the second inter-tree similarity is greater than a second similarity threshold, merge the new rule tree with the corresponding most similar rule tree, and update the directed association graph.

[0174] Based on the above embodiments, the fifth module 500 may include:

[0175] An eighth unit, used for converting the rule tree and the directed association graph into SQL-like rule statements;

[0176] A ninth unit is used to create an alarm aggregation engine and load the rule statement into the alarm aggregation engine;

[0177] A tenth unit, used for acquiring the alarm data, inputting the alarm data into the normalizer and the diverter of the alarm aggregation engine for processing, so as to divert the normalized alarm data to the corresponding alarm aggregation processor in the alarm aggregation engine;

[0178] The eleventh unit is used to generate the network security event based on the alarm data aggregated and normalized by the alarm aggregation processor.

[0179] Based on the above embodiments, the basic grammatical structure of the rule statement includes: a WITH clause, used to define intermediate variables and aliases within the alarm aggregation rule; a FROM clause, used to define the alarm source; a WHERE clause, used to define the pre-filtering conditions of the alarm; a SELECT clause, used to perform field projection and conversion; a GROUP BY clause, used to group alarms according to preset dimensions; and a HAVING clause, used to define the triggering conditions of the network security event.

[0180] Based on the above embodiments, the fifth module 500 may further include:

[0181] A twelfth unit is used to determine a disposal plan for the network security incident based on a predefined security knowledge graph, and send the disposal plan to an operation and maintenance end;

[0182] The thirteenth unit is used to update the aggregation period of the alarm aggregation engine after receiving the handling completion information of the network security event.

[0183] Based on the above embodiments, the present invention further provides a network security alarm device, which may include a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps provided in the above embodiments may be implemented. Of course, the device may also include various necessary network interfaces, power supplies, and other components.

[0184] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by an execution terminal or a processor, the network security alarm method provided by the embodiment of the present invention can be implemented; the storage medium may include: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0185] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. A network security alarm method, characterized in that: include: Extracting alarm meta-words from structured knowledge and semi-structured knowledge, and constructing alarm aggregation rules based on the alarm meta-words; Constructing a rule tree based on the alarm aggregation rule; The root node in the rule tree is the alarm primitive set, the child nodes are entities in the alarm primitive set, and the node parent-child relationship is the pre-order of entities within the alarm primitive set; Determine the inter-tree similarity between the Ruled Trees, cluster the Ruled Trees using a clustering algorithm based on the inter-tree similarity, and merge the Ruled Trees in each cluster; After the merging is completed, the rule trees are associated based on the rule relationships to generate a directed association graph; the vertices of the directed association graph are the rule trees, and the edges are the rule relationships; Acquire alarm data, and aggregate the alarm data based on the rule tree and the directed association graph to generate a network security event.

2. The network security alarm method according to claim 1, characterized in that: Determining the inter-tree similarity between the rule trees, and clustering the rule trees by a clustering algorithm based on the inter-tree similarity, comprising: Extracting node features from node attributes of the rule tree based on a feature extraction function; Determine a hash feature value of the node feature based on a SimHash algorithm, and determine a first inter-tree similarity between the rule trees based on the hash feature value; Determine a first similarity threshold, classify the rule trees whose first inter-tree similarities are greater than the first similarity threshold, and obtain a preliminarily screened similar tree set; In the initially screened similar tree set, a tree edit distance between the regular trees is determined based on the Zhang-Shasha algorithm, and a second inter-tree similarity between the regular trees is determined based on the tree edit distance; A second similarity threshold is determined, and the regular trees in each of the preliminarily screened similar tree sets are clustered by the clustering algorithm based on the second inter-tree similarity until the inter-cluster similarity is lower than the second similarity threshold.

3. The network security alarm method according to claim 1, characterized in that: Merging the rule trees in each of the clusters, comprising: Determine a reference tree in each of the clusters, and align the remaining regular trees in each of the clusters with the reference tree based on a tree alignment algorithm; The aligned nodes are merged, and the characteristic branches and characteristic nodes of each of the rule trees are retained.

4. The network security alarm method according to claim 1, characterized in that: Also includes: When generating a new Rule Tree, determining the hash feature values ​​of the new Rule Tree and the node features in the Rule Tree based on the SimHash algorithm; Determine a first inter-tree similarity between the new Ruled Tree and the Ruled Tree based on the Hash feature value, and determine a maximum first inter-tree similarity from the first inter-tree similarities; When the maximum first inter-tree similarity is greater than a first similarity threshold, merging the new Rule-Tree with the corresponding most similar Rule-Tree, and updating the directed association graph; When the maximum first inter-tree similarity is less than the first similarity threshold, determining a tree edit distance between the rule trees based on the Zhang-Shasha algorithm, and determining a second inter-tree similarity between the new rule tree and the rule tree based on the tree edit distance; A maximum second inter-tree similarity is determined from the second inter-tree similarities, and when the second inter-tree similarity is greater than a second similarity threshold, the new Rule-Tree is merged with the corresponding most similar Rule-Tree, and the directed association graph is updated.

5. The network security alarm method according to claim 1, characterized in that: Aggregating the alarm data based on the rule tree and the directed association graph to generate a network security event includes: Converting the rule tree and the directed association graph into SQL-like rule statements; Creating an alarm aggregation engine, and loading the rule statement into the alarm aggregation engine; Acquire the alarm data, and input the alarm data into a normalizer and a diverter of the alarm aggregation engine for processing, so as to divert the normalized alarm data to a corresponding alarm aggregation processor in the alarm aggregation engine; The network security event is generated based on the alarm data aggregated and normalized by the alarm aggregation processor.

6. The network security alarm method according to claim 5, characterized in that: The basic grammatical structure of the rule statement includes: a WITH clause, which is used to define the intermediate variables and aliases within the alarm aggregation rule; a FROM clause, which is used to define the alarm source; a WHERE clause, which is used to define the pre-filtering conditions of the alarm; a SELECT clause, which is used to perform field projection and conversion; a GROUP BY clause, which is used to group the alarms according to preset dimensions; and a HAVING clause, which is used to define the triggering conditions of the network security event.

7. The network security alarm method according to claim 5, characterized in that: Also includes: Determine a disposal plan for the network security incident based on a predefined security knowledge graph, and send the disposal plan to the operation and maintenance end; After receiving the information that the handling of the network security event is completed, the aggregation period of the alarm aggregation engine is updated.

8. A network security alarm device, characterized in that: include: The first module is used to extract alarm meta-words from structured knowledge and semi-structured knowledge, and construct alarm aggregation rules based on the alarm meta-words; The second module is used to construct a rule tree based on the alarm aggregation rule; The root node in the rule tree is the alarm primitive set, the child nodes are entities in the alarm primitive set, and the node parent-child relationship is the pre-order of entities within the alarm primitive set; The third module is used to determine the inter-tree similarity between the Rule-Trees, cluster the Rule-Trees by a clustering algorithm based on the inter-tree similarity, and merge the Rule-Trees in each cluster; The fourth module is used for associating the rule trees based on the rule relationships to generate a directed association graph after the merging is completed; the vertices of the directed association graph are the rule trees, and the edges are the rule relationships; The fifth module is used to obtain alarm data, and aggregate the alarm data based on the rule tree and the directed association graph to generate a network security event.

9. A network security alarm device, characterized in that: include: Memory, for storing computer programs; A processor, used to implement the network security alarm method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the network security alarm method according to any one of claims 1 to 7 is implemented.

Images