A method, system, device, and medium for intelligently determining security events

Abstract

The present invention belongs to the field of network security technology, and specifically relates to a method, system, device, and medium for intelligently determining security events. The method comprises: collecting and parsing security logs of product objects; classifying and aggregating the parsed security logs to generate security events with multi-dimensional information; and for each security event, calculating a true and effective determination value for the security event based on the historical determination success rate of similar security events to determine whether the security event is a real event. The present invention improves the efficiency and accuracy of event determination by using manual feedback during initial deployment, then enters a self-evolutionary learning state with manual participation and assistance. It can be applied to different scenarios to assist security management personnel in their work, greatly reducing the workload and correspondingly improving work efficiency.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an intelligent determination method, system, device, and medium for security events. Background Art

[0002] A security incident is a record of the relevant records, alerts, and associated data generated when a security risk occurs. However, in practice, various security products, such as firewalls, application firewalls, and IDS / IPS devices, often generate corresponding logs and alerts based on their own security functions. Consequently, security managers often face the problem of large, confusing, and fragmented security logs. This severely impacts the efficiency of security managers in early warning, handling, and tracing incidents when real security incidents occur, hindering their ability to truly perceive the actual threats to the security management targets.

[0003] To address this, security managers often redefine security incidents based on their own understanding, aggregating logs from various security products into higher-dimensional, more informative records according to established rules. Intelligently identifying the authenticity and validity of this multidimensional information as a security incident is a pressing issue. Summary of the Invention

[0004] In view of the shortcomings of the prior art described above, the purpose of the present invention is to use AI big models to intelligently identify the authenticity and effectiveness of security incidents, thereby assisting security management personnel in their work, greatly reducing the workload and correspondingly improving work efficiency.

[0005] To achieve the above-mentioned objectives and other related objectives, the present invention provides an intelligent method for determining security events, comprising: collecting and parsing security logs of product objects; classifying and aggregating the parsed security logs to generate security events with multi-dimensional information; and for each security event, calculating a true and effective determination value of the security event based on the historical determination success rate of similar security events to determine whether the security event is a real event.

[0006] According to a specific embodiment of the present invention, the step of calculating the authenticity and validity judgment value of the security event based on the historical judgment success rate of similar security events to determine whether the security event is a real event includes: using the AI big model to calculate the authenticity and validity judgment value of the security event based on the historical judgment success rate of similar security events: if the authenticity and validity judgment value exceeds the preset threshold, the security event is preliminarily judged to be a real event; otherwise, the security event is preliminarily judged to be a false event; and the preliminary judgment result of the AI big model is fed back to the user for further confirmation to obtain the final judgment result.

[0007] According to a specific embodiment of the present invention, the step of feeding back the preliminary judgment result of the AI large model to the user for further confirmation to obtain the final judgment result includes: when the judgment result fed back by the user is not received within the preset time, the preliminary judgment result is used as the final judgment result; when the modification suggestions fed back by the user are received within the preset time, the judgment result fed back by the user is used as the final judgment result.

[0008] According to a specific embodiment of the present invention, it also includes: optimizing the AI big model based on the security event and the corresponding final judgment result.

[0009] According to a specific embodiment of the present invention, the step of calculating the judgment value of the authenticity of the security event based on the historical judgment success rate of similar security events includes: calculating the historical judgment success rate of the security event with respect to similar security events as a first weight parameter based on the number of historical occurrences of similar security events of the security event and the correct number of times the AI big model is used to judge whether each security event is a real event; and calculating the judgment value of the authenticity of the security event based on the first weight parameter.

[0010] According to a specific embodiment of the present invention, the step of calculating the judgment value of the authenticity and validity of the security event based on the first weight parameter includes: calculating the importance index of the security event according to the severity level of the security event as the second weight parameter; and calculating the judgment value of the authenticity and validity of the security event based on the first weight parameter and the second weight parameter.

[0011] According to a specific embodiment of the present invention, the step of calculating the judgment value of whether the security event is true and valid based on the first weight parameter and the second weight parameter includes: calculating the frequency index of the security event as the third weight parameter based on the number of times the security event occurs within a preset time and a preset maximum number threshold; calculating the judgment value of whether the security event is true and valid based on the first weight parameter, the second weight parameter, and the third weight parameter.

[0012] According to a specific embodiment of the present invention, the step of calculating the true and valid judgment value of the security event based on the first weight parameter, the second weight parameter, and the third weight parameter includes: identifying whether the security event is high-risk based on whether the target field of each security log in the security event hits the corresponding field value in the preset threat intelligence library: when the security event is high-risk, the true and valid judgment value of the security event is greater than the preset threshold; when the security event is not high-risk, the true and valid judgment value of the security event is calculated based on the first weight parameter, the second weight parameter, and the third weight parameter.

[0013] An intelligent security event determination system includes: a log parsing module for collecting and parsing security logs of product objects; a log aggregation module for classifying and aggregating the parsed security logs to generate security events with multi-dimensional information; and a security event determination module for calculating, for each security event, a true and valid determination value of the security event based on the historical determination success rate of similar security events, so as to determine whether the security event is a real event.

[0014] An electronic device includes a processor, wherein the processor is coupled to a memory, and the memory stores program instructions. When the program instructions stored in the memory are executed by the processor, the above-mentioned method is implemented.

[0015] A computer-readable storage medium includes a program. When the program is run on a computer, the computer is caused to execute the method described above.

[0016] The present invention provides an intelligent method for determining security incidents. This method uses manual feedback during initial deployment to improve the efficiency and accuracy of incident determination. The method then enters a self-evolutionary learning state with manual participation and assistance. The method can be applied to different scenarios to assist security management personnel in their work, greatly reducing the workload and correspondingly improving work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a specific embodiment of an intelligent security event determination method provided by the present invention;

[0018] Figure 2 This is a structural diagram of a specific embodiment of an intelligent security event determination system provided by the present invention;

[0019] Figure 3 This is a structural block diagram of a specific embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] To facilitate understanding of the present application, the present application will be described more fully below with reference to the accompanying drawings. The accompanying drawings provide embodiments of the present application. However, the present application may be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to make the disclosure of the present application more thorough and comprehensive.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application pertains. The terms used herein in the specification of this application are for the purpose of describing specific embodiments only and are not intended to limit this application.

[0022] The following describes the embodiments of the present invention through specific examples. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other unless they conflict.

[0023] It should be noted that the illustrations provided in the following embodiments are merely schematic illustrations of the basic concept of the present invention. Therefore, the illustrations only show components related to the present invention and are not drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component may be changed arbitrarily, and the component layout may also be more complex.

[0024] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the embodiments of the present invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring the embodiments of the present invention.

[0025] Example 1

[0026] See Figure 1 The intelligent determination method for security events shown includes:

[0027] Step S100: Collect and parse the security log of the product object.

[0028] Step S200 , classifying and aggregating the parsed security logs to generate security events with multi-dimensional information.

[0029] In step S300 , for each security event, a determination value of whether the security event is real or not is calculated based on a historical determination success rate of similar security events, so as to determine whether the security event is a real event.

[0030] First, the security logs of product objects need to be collected and parsed. It is understandable that since the network security monitoring platform manages security products of different categories from different manufacturers, the security logs generated by the product objects are collected accordingly. Afterwards, the security logs can be intelligently parsed using the AI large model in the network security monitoring platform. Alternatively, security management personnel can assist the network security monitoring platform in log parsing. For example, the security management personnel can input a corresponding regular expression based on the corresponding type of security log so that the network security monitoring platform can parse the security log based on the regular expression and generate the corresponding parsing results. Alternatively, the security management personnel can match the fields in the security log with a preset field template so that the network security monitoring platform can perform field mapping based on the matching results. There are no excessive restrictions on the log parsing methods, including but not limited to the above. For example, a combination of the above two parsing methods can be used, that is, using the AI large model for intelligent parsing and feedback to the security management personnel for review and confirmation. Modifications and embellishments made to the embodiments of the present invention by those skilled in the art without departing from the spirit of the present invention still fall within the scope of the invention application of the present invention. Finally, the successfully parsed security logs are stored in a database.

[0031] Furthermore, in order to avoid the problems of large data volume, data dispersion, data duplication, etc. caused by massive logs, it is also necessary to classify and aggregate the successfully parsed security logs to superimpose the related security logs, thereby forming a security event aggregated by multi-dimensional information, and finally sending it to the security management personnel for processing. The classification and aggregation of security logs can be customized according to actual needs. For example, for some simple events, security logs containing the same target field can be classified into one category. For some frequency events, security logs generated by the same IP with high frequency can be classified into one category. For some diverse events, security logs of the same type can be classified into one category, etc., or security logs can be aggregated according to other established rules. There are no excessive restrictions on this. Without departing from the spirit of the present invention, modifications and embellishments made to the embodiments of the present invention by those skilled in the art still fall within the scope of the invention patent application of the present invention.

[0032] Based on the above, the authenticity and validity of generated security incidents must be verified to ensure that the measures subsequently taken by security managers can resolve the issues encountered by the corresponding product objects. To this end, this embodiment comprehensively assesses whether a security incident is a real incident based on the severity of the security incident, the number of occurrences within a specific period of time, the threat intelligence system's query and determination of the attack source, and the handling feedback of similar security incidents in the past.

[0033] Specifically, for a security incident, the historical judgment success rate of similar security incidents is calculated, that is, the handling feedback of the above-mentioned historical similar security incidents is used as the first weight parameter, the importance index is calculated, that is, the severity is calculated as the second weight parameter, the frequency index is calculated, that is, the number of occurrences within the above-mentioned specific time is used as the third weight parameter, and whether the target field of each security log hits the corresponding field value in the preset threat intelligence library to identify whether the security incident is high-risk, that is, the query judgment result of the above-mentioned threat intelligence system on the attack source is used as the fourth weight parameter, so as to comprehensively calculate the judgment value of the security incident by combining the first weight parameter, the second weight parameter, the third weight parameter, and the fourth weight parameter to further identify whether the security incident is a real incident.

[0034] In one embodiment, the calculation formula of the determination value is as follows:

[0035] ,

[0036] in, Indicates the true and effective judgment value of a security event x, Indicates the importance of security incidents. Represents the frequency index of security events, Indicates the threat intelligence query index of the security event, that is, whether the target field of each security log in the security event hits the corresponding field value in the preset threat intelligence library. It represents the feedback index of similar security incidents in history, that is, the historical success rate of similar security incidents.

[0037] For important indexes It can be further expressed as: ,

[0038] Indicates the severity of the current security incident, which can be divided into multiple severity levels in advance, namely arrive (For example, it can be set to 5 levels: normal, low risk, medium risk, high risk, and severe), and It represents the weight parameter of the severity level corresponding to the current security incident. For example, the lower the level, the smaller the weight parameter can be set, and the higher the level, the larger the weight parameter can be set. As a result, when the severity of the security incident is higher, the corresponding importance index will also be larger. There are no excessive restrictions on how to set the weight parameter, and it can be customized according to actual needs.

[0039] As for how to identify the severity of a security incident, there are no excessive restrictions. For example, whether the security incident needs to be paid special attention to can be determined by the label carried by the security incident, or the type of the security incident, etc. In this regard, the severity levels of different security incidents can be pre-set according to actual needs or the operating conditions that need to be paid special attention to for different product objects, or rules for identifying the severity of security incidents can be set. Without departing from the spirit of the present invention, modifications and improvements made to the embodiments of the present invention by those skilled in the art still fall within the scope of the invention application of the present invention.

[0040] For frequency index It can be further expressed as: ,

[0041] Indicates the number of times the current security event occurs within the preset time T. It represents the maximum number of times the security event occurs within the preset time T. In this regard, the more times the security event occurs within the preset time T, the larger the corresponding frequency index will be.

[0042] For threat intelligence query index It can be further expressed as: ,

[0043] Specifically, it queries whether the field value corresponding to the target field of each security log in a security event hits the field value set for the target field in the threat intelligence library. If it hits, it means that the security event has a high risk, and the corresponding threat intelligence query index That is, 1. If no hit occurs, it means the security incident is low risk. The corresponding threat intelligence query index is That is 0. Of course, the target fields to be queried for different security events will vary accordingly. For example, for security events with different flows, the corresponding entry IP or exit IP can be queried. Therefore, the target fields to be queried can be pre-set for different types of security events to identify their corresponding threat intelligence query index. In addition, if the target field to be queried does not exist in the security incident, it is also considered to be low risk, that is, the threat intelligence query index is 0.

[0044] For the feedback index It can be further expressed as: ,

[0045] Indicates the number of times the current security incident is correctly judged as a real incident. Indicates the number of historical security events similar to the current security event. Similar security events include: attack-related security events (such as web attacks, DDoS attacks, and virus attacks), security events with the same attack source, and security events with the same attack target.

[0046] It should be noted that in this embodiment, the above method is executed by utilizing the AI big model, that is, the security event is input into the AI big model to output the corresponding result of whether it is a real event, and then the result output by the AI big model is fed back to the security management personnel for manual confirmation to confirm whether the result output by the AI big model is incorrect. That is, the result output by the AI big model of whether the AI big model is a real event is the preliminary judgment result, and the result of the AI big model of whether it is a real event after confirmation or modification by the security management personnel is the final result. Therefore, when the security management personnel changes the result output by the AI big model, it means that the result of the AI big model's judgment of whether the security event is a real event is incorrect, that is, the judgment failed, and accordingly cannot be counted in the number of correct judgments.

[0047] It can be seen that the feedback index It can show the accuracy of the AI big model's judgment. When the AI big model is used to determine whether a security incident is a real incident, the more successful the number of times, the corresponding feedback index The larger the value, the higher the judgment value of the security incident. When the number of successful times of using the AI big model to determine whether a security incident is a real incident is less, the corresponding feedback index The smaller it is, the smaller the judgment value corresponding to the security incident is, and the accuracy of the AI big model in identifying whether a security incident is a real incident is continuously optimized through the feedback loop, thereby realizing the self-learning evolution of the AI big model.

[0048] Finally, based on the judgment value of the security event, we can confirm whether it is a real event. There are two specific situations:

[0049] When the threat intelligence query index When it is 1, it will be automatically judged directly , that is, the judgment value exceeds the preset threshold. It can be understood that when the threat intelligence query index of a security event If it is 1, the AI model will directly determine that the security incident is a real incident.

[0050] When the threat intelligence query index When it is 0, the corresponding calculation and identify the value of Whether it exceeds the threshold , that is, only when Only when the security incident is detected is it considered a real incident, otherwise it is a false incident (with a high probability of false alarm, or the urgency is not high and can be ignored).

[0051] Furthermore, the results output by the AI big model are fed back to the security manager for confirmation. If the judgment result fed back by the security manager is not received within the preset time, the preliminary judgment result output by the AI big model is directly used as the final judgment result, which is deemed to be a successful judgment by the AI big model. If the modification opinions fed back by the security manager are received within the preset time, the judgment result fed back by the user, that is, when the security manager confirms that the result output by the AI big model is correct, is regarded as a successful judgment by the AI big model, and the preliminary judgment result output by the AI big model can be directly used as the final judgment result. When the security manager modifies the result output by the AI big model, it is regarded as a failure of the AI big model judgment, and the result fed back by the security manager is used as the final judgment result. Accordingly, the AI big model can be learned and optimized based on the security incident and its corresponding final judgment result.

[0052] It can be seen that the intelligent judgment method provided in this embodiment improves the efficiency and accuracy of event judgment through manual feedback during initial deployment, and then enters self-evolutionary learning and manual participation auxiliary state, thereby realizing intelligent judgment of security incidents, reducing the workload of security management personnel, greatly improving event processing efficiency, and being applicable to different scenarios.

[0053] It can also be understood that the security event mentioned in this embodiment is a collection of multiple security logs. Therefore, the above method can also be applied to identify and judge a single security log. The specific settings can be customized according to actual needs. The modifications and embellishments made to the embodiments of the present invention by those skilled in the art without departing from the spirit of the present invention still fall within the scope of the invention application of the present invention.

[0054] It should be noted that the step division of the various methods above is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they contain the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0055] Example 2

[0056] See Figure 2 As shown, this embodiment also provides an intelligent security event determination system, which is characterized by including:

[0057] The log parsing module 10 is used to collect and parse the security logs of the product objects.

[0058] The log aggregation module 20 is used to classify and aggregate the parsed security logs to generate security events with multi-dimensional information.

[0059] The security event determination module 30 is configured to calculate, for each security event, a determination value of the security event's authenticity and validity based on a historical determination success rate of similar security events, so as to determine whether the security event is a real event.

[0060] It should be noted that the intelligent security event determination system provided in the above embodiment and the intelligent security event determination method provided in Example 1 above are based on the same concept. The specific manner in which each module and unit performs operations has been described in detail in the method embodiment and will not be repeated here. In actual applications, the intelligent security event determination method provided in Example 1 above can allocate the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0061] Example 3

[0062] See Figure 3 As shown, an embodiment of the present application further provides an electronic device, comprising a memory 2, a processor 1, and a program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above methods when executing the program.

[0063] The memory includes at least one type of readable storage medium, including flash memory, a mobile hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory can be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory can also be an external storage device of the electronic device, such as a plug-in mobile hard disk, a smart memory card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device. Furthermore, the memory can also include both an internal storage unit of the electronic device and an external storage device. The memory can be used not only to store application software installed in the electronic device and various types of data, but also to temporarily store data that has been output or is about to be output.

[0064] In some embodiments, the processor may be comprised of an integrated circuit, such as a single packaged integrated circuit or multiple packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and a combination of various control chips. The processor is the control core (control unit) of the electronic device, connecting the various components of the electronic device using various interfaces and circuits. It executes programs or modules stored in the memory and accesses data stored in the memory to perform various functions of the electronic device and process data.

[0065] The processor executes the operating system of the electronic device and various installed application programs. The processor executes the application programs to implement the steps in the above method embodiment.

[0066] Exemplarily, the program may be divided into one or more modules, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules may be a series of program instruction segments capable of implementing specific functions, and the instruction segments are used to describe the execution process of the program in the electronic device.

[0067] The above-mentioned integrated units implemented in the form of software functional modules can be stored in a computer-readable storage medium. The above-mentioned software functional modules stored in a storage medium include a number of instructions for causing a computer device (which may be a personal computer, computer equipment, or network equipment, etc.) or a processor to perform some of the functions of various embodiments of the present invention.

[0068] In summary, the present invention provides an intelligent judgment method for security incidents. This method uses manual feedback during initial deployment to improve the efficiency and accuracy of event judgment, and then enters a self-evolutionary learning state with manual participation and auxiliary status. It can be applied to different scenarios and assist security management personnel in their work, greatly reducing the workload and correspondingly improving work efficiency.

[0069] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the present invention. Anyone skilled in the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by one of ordinary skill in the art without departing from the spirit and technical principles disclosed herein are intended to be covered by the claims of the present invention.

Claims

1. An intelligent method for determining security events, characterized in that: include: Collect and parse security logs of product objects; Categorize and aggregate the parsed security logs to generate security events with multi-dimensional information; For each security event, a determination value of the security event's authenticity is calculated based on the historical success rate of similar security events to determine whether the security event is a real event. The steps include: The AI model is used to calculate the authenticity and validity judgment value of the security incident based on the historical judgment success rate of similar security incidents. If the authenticity and validity judgment value exceeds the preset threshold, the security incident is preliminarily judged to be a real incident; otherwise, the security incident is preliminarily judged to be a false incident. Feedback the preliminary judgment result of the AI large model to the user for further confirmation to obtain the final judgment result; The step of calculating the authenticity and validity determination value of the security event based on the historical determination success rate of similar security events includes: Based on the number of historical occurrences of similar security events of the security event and the number of correct determinations of whether each security event is a real event using the AI large model, the historical determination success rate of the security event with respect to similar security events is calculated as a first weight parameter; and the historical determination success rate is the ratio of the number of correct determinations of whether similar security events of the security event are real events to the number of historical occurrences of similar security events of the security event; A determination value of the authenticity and validity of the security event is calculated based on the first weight parameter.

2. The intelligent security event determination method according to claim 1, characterized in that: Feedback of the preliminary determination result of the AI large model to the user for further confirmation to obtain the final determination result includes the following steps: If no judgment result is received from the user within the preset time, the preliminary judgment result will be used as the final judgment result; When the modification opinions fed back by the user are received within the preset time, the judgment result fed back by the user is taken as the final judgment result.

3. The intelligent determination method for security events according to claim 1, characterized in that: Also includes: The AI big model is optimized based on the security event and the corresponding final judgment result.

4. The intelligent determination method for security events according to claim 1, characterized in that: The step of calculating the authenticity and validity determination value of the security event based on the first weight parameter includes: Calculating an importance index of the security event according to the severity level of the security event to serve as a second weight parameter; A determination value of whether the security event is real and valid is calculated based on the first weight parameter and the second weight parameter.

5. The intelligent determination method for security events according to claim 4, characterized in that: The step of calculating the authenticity and validity determination value of the security event based on the first weight parameter and the second weight parameter includes: Calculate the frequency index of the security event according to the number of times the security event occurs within a preset time and a preset maximum number threshold, as a third weight parameter; A determination value of whether the security event is true and valid is calculated based on the first weight parameter, the second weight parameter, and the third weight parameter.

6. The intelligent security event determination method according to claim 5, characterized in that: The step of calculating the authenticity and validity determination value of the security event based on the first weight parameter, the second weight parameter, and the third weight parameter includes: Identify whether the security event is high-risk based on whether the target field of each security log in the security event matches the corresponding field value in the preset threat intelligence library: When the security event is high risk, the determination value of the security event being true and valid is greater than a preset threshold; When the security event is not a high risk event, a determination value of whether the security event is real and valid is calculated based on the first weight parameter, the second weight parameter, and the third weight parameter.

7. An intelligent security event determination system, characterized in that: include: Log parsing module, used to collect and parse security logs of product objects; Log aggregation module, used to classify and aggregate the parsed security logs to generate security events with multi-dimensional information; A security event determination module is used to calculate, for each security event, a true and valid determination value of the security event based on the historical determination success rate of similar security events, so as to determine whether the security event is a real event. The module includes: using an AI large model to calculate the true and valid determination value of the security event based on the historical determination success rate of similar security events; if the true and valid determination value exceeds a preset threshold, the security event is preliminarily determined to be a real event; otherwise, the security event is preliminarily determined to be a false event; and the preliminary determination result of the AI large model is fed back to the user for further confirmation to obtain a final determination result; Among them, the judgment value of the security event being true and valid is calculated based on the historical judgment success rate of similar security events, including: calculating the historical judgment success rate of the security event with respect to similar security events according to the number of historical occurrences of similar security events of the security event, and the number of correct times of using the AI big model to judge whether each security event is a real event, as the first weight parameter; and the historical judgment success rate is the ratio of the number of correct times of judging whether the same security events of the security event are real events to the number of historical occurrences of similar security events of the security event; the judgment value of the security event being true and valid is calculated based on the first weight parameter.

8. An electronic device, characterized in that: The method comprises a processor coupled to a memory, wherein the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that The invention comprises a program, which, when being run on a computer, causes the computer to execute the method according to any one of claims 1 to 6.

Images