Processing method and device of network security equipment, equipment and storage medium

Abstract

The invention provides a network security equipment processing method and device, equipment and a storage medium. The method comprises the following steps: acquiring network security event type information; determining a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set; determining a second network security event list of the network security device subset according to the network security event type information and the log information of the network security device subset; comparing the first network security event list with the second network security event list, and determining a target network security event list meeting a preset event reporting threshold requirement in the second network security event list; and determining a target network security device according to the target network security event list. According to the method provided by the invention, the false report and missing report conditions of the network security equipment are reduced, and the event report efficiency of the network security equipment is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a processing method, apparatus, device and storage medium for network security equipment. Background Art

[0002] In recent years, network security has been increasingly valued by enterprises, and enterprises have also selected a large number of network security devices for this purpose. In order to help security operation and maintenance personnel deal with massive network security device logs, enterprises will process security device logs to reduce false alarms and duplications.

[0003] In the prior art, when processing logs, enterprises will perform the following tasks: first, standardize and parse multi-source heterogeneous log data into a unified format; second, perform correlation analysis on the standardized log data in the unified format to effectively deduplicate log alarm events.

[0004] However, enterprises lack understanding of the repeated false alarms and missed alarms of a single device, as well as the repeated false alarms and missed alarms of some devices combined, and they also lack a basis when they need to replace security equipment. Summary of the invention

[0005] The present application provides a processing method, apparatus, device and storage medium for a network security device, which are used to solve the problem of repeated false alarms and missed alarms of a certain network security device or a combination of certain network security devices in an enterprise.

[0006] In a first aspect, the present application provides a processing method for a network security device, comprising:

[0007] Obtain network security event type information, where the network security event type information represents information about various types of network security events reported by a collection of network security devices;

[0008] Determine a first network security event list for each network security device according to the network security event type information and the log information of each network security device in the network security device set;

[0009] Determine, according to the network security event type information and the log information of the network security device subset, a second network security event list of the network security device subset, where the network security device subset is a subset of the network security device set;

[0010] Compare the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, where the preset event reporting threshold requirement represents a requirement for a false alarm rate or missed alarm rate of an event for a network security device in the network security device subset;

[0011] Determine the target network security devices based on the target network security event list.

[0012] In an embodiment of the present application, obtaining network security event type information includes:

[0013] Get the log collection of the network security device collection;

[0014] Perform standardized parsing on the log collection of the network security device collection to obtain a standardized log collection displayed in a unified format;

[0015] The logs obtained by reporting the same security incident in the standardized log set are deduplicated to obtain network security incident type information.

[0016] In an embodiment of the present application, according to network security event type information and log information of each network security device in the network security device set, a first network security event list of each network security device is determined, including:

[0017] Determine, according to the network security device set, log information of each network security device in the network security device set;

[0018] The network security event type information is compared with the log information of each network security device to determine a first network security event list for each network security device.

[0019] In an embodiment of the present application, determining a second network security event list of the network security device subset according to network security event type information and log information of the network security device subset includes:

[0020] Determine log information of a subset of network security devices according to the network security device set, where the subset of network security devices is a subset of the network security device set;

[0021] The log information of the network security device subset is compared with the network security event type information to determine a second network security event list of the network security device subset.

[0022] In an embodiment of the present application, the first network security event list is compared with the second network security event list to determine a target network security event list in the second network security event list that meets the preset event reporting threshold requirements, including:

[0023] Compare the first network security event list with the second network security event list to determine an initial network security event list in which the false positive and false negative rates of events in the second network security event list are the same as the false positive and false negative rates of events in the first network security event list;

[0024] Based on the initial network security event list, determine a target network security event list in which the false alarm and omission alarm rates of events in the initial network security event list meet the preset event reporting threshold requirements, and the preset event reporting threshold requirements represent the requirements for the false alarm and omission alarm rates of events of the network security devices in the network security device subset.

[0025] In an embodiment of the present application, determining a target network security device according to a target network security event list includes:

[0026] According to the target network security event list, determine the target log information in the log information of the network security device set that matches the target network security event list;

[0027] According to the target log information, a target network security device in the network security device set corresponding to the target log information is determined.

[0028] In the embodiment of the present application, after determining the target network security device according to the target network security event list, the following steps are included:

[0029] The network security device set is replaced with a target network security device, so that the target network security device completes the reporting of network security event type information.

[0030] In a second aspect, the present application provides a processing device of a network security device, including:

[0031] An acquisition module is used to acquire network security event type information, where the network security event type information represents information about various types of network security events reported by a network security device set;

[0032] A first determination module, configured to determine a first network security event list of each network security device according to network security event type information and log information of each network security device in the network security device set;

[0033] A second determination module, configured to determine a second network security event list of the network security device subset according to the network security event type information and the log information of the network security device subset, where the network security device subset is a subset of the network security device set;

[0034] A comparison module, configured to compare the first network security event list with the second network security event list, and determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, wherein the preset event reporting threshold requirement represents a requirement for a false alarm rate or missed alarm rate of an event of a network security device in a subset of network security devices;

[0035] The third determination module is used to determine the target network security device according to the target network security event list.

[0036] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0037] The memory stores computer-executable instructions;

[0038] The processor executes the computer-executable instructions stored in the memory to implement the method of the embodiment of the present application.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method of the embodiment of the present application.

[0040] The present application provides a method, apparatus, device and storage medium for processing network security devices, by obtaining network security event type information, the network security event type information represents information of various types of network security events reported by a network security device set; determining a first network security event list for each network security device according to the network security event type information and log information of each network security device in the network security device set; determining a second network security event list for a network security device subset according to the network security event type information and log information of a network security device subset, the network security device subset being a subset of the network security device set; comparing the first network security event list with the second network security event list, determining a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, the preset event reporting threshold requirement representing a network security event reported to the network Requirements on false alarm rate and missed alarm rate of events of network security devices in a subset of security devices; means of determining the target network security devices according to the target network security event list, thereby realizing the determination of the device log of a single security device and the device log of any device combination according to the security event set of the existing network security devices; by comparing the device log of a single security device and the device log of any device combination with the security event set of the network security devices respectively, the device combination in any device combination that can report any event in the security event set of the network security devices is determined; and based on the device combination and the single security device, the device in the device combination that has no effect on the event reporting rate of the device combination is determined, and the device is removed from the device combination to obtain the target network security device, thereby reducing the false alarm and duplication of network security device alarms and improving the efficiency of network security devices in handling security events. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] Figure 1 A flowchart of a processing method for a network security device provided in an embodiment of the present application;

[0043] Figure 2 A flowchart of another processing method of a network security device provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of the structure of a processing device of a network security device provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0046] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0047] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0048] In the prior art, although enterprises obtain a relatively accurate report on the overall enterprise network security situation after performing standardized log analysis and alarm deduplication and false alarm removal, they lack understanding of the repeated false alarms and missed alarms of a specific device and the repeated false alarms and missed alarms of some devices combined. When the enterprise needs to replace security equipment, it also lacks a basis.

[0049] In order to solve the above problems, the present application provides a method for handling network security incidents. By generating a security incident list of network security devices and comparing it with the incident lists of single security devices and security device combinations, and based on the comparison results of single security devices and security device combinations with the full security incident list, a better security device combination is given, which can effectively reduce the false alarms and missed alarms of network security devices and improve the efficiency of security incident reporting by network security devices.

[0050] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0051] The execution subject of the processing method of the network security device provided in the embodiment of the present application can be a server. Among them, the server can be a computer or other device. This embodiment does not impose any special restrictions on the implementation method of the execution subject, as long as the execution subject can obtain network security event type information, the network security event type information represents the information of various types of network security events reported by the network security device set; according to the network security event type information and the log information of each network security device in the network security device set, determine the first network security event list of each network security device; according to the network security event type information and the log information of the network security device subset, determine the second network security event list of the network security device subset, the network security device subset is a subset of the network security device set; compare the first network security event list with the second network security event list, and determine the target network security event list in the second network security event list that meets the preset event reporting threshold requirements, the preset event reporting threshold requirements represent the requirements for the event false alarm rate and missed alarm rate of the network security device in the network security device subset; according to the target network security event list, determine the target network security device.

[0052] Among them, the network security event type information is various network security events that have occurred, such as harmful program events, network attack events, information destruction events, information content security events, and equipment and facility failure events.

[0053] Log information may include the type of network security incident, the source IP address of the incident, the incident level, the incident result, and incident-related information.

[0054] The preset event reporting threshold requirement may refer to the requirement for the false alarm rate and missed alarm rate of the event of the network security device.

[0055] Figure 1 A flowchart of a processing method for a network security device provided in an embodiment of the present application. Figure 1 As shown, the method includes:

[0056] S101. Obtain network security event type information, where the network security event type information represents information of various types of network security events reported by a network security device set.

[0057] Among them, the network security event type information is various network security events that have occurred, such as harmful program events, network attack events, information destruction events, information content security events, and equipment and facility failure events.

[0058] Among them, in the embodiment of the present application, obtaining network security event type information includes:

[0059] Get the log collection of the network security device collection;

[0060] Perform standardized parsing on the log collection of the network security device collection to obtain a standardized log collection displayed in a unified format;

[0061] The logs obtained by reporting the same security incident in the standardized log set are deduplicated to obtain network security incident type information.

[0062] Among them, standardized parsing can refer to parsing out direct information and indirect information in the log and outputting it in a unified format, so as to improve the consistency and integrity of the log. For example, the event type of the network security event reported in the log is used as the log label, that is, when the network security event is a harmful program event, the harmful program event is set as the first log label, and when the network security event is a network attack event, the network attack event device is set as the second log label.

[0063] Deduplication processing may refer to when multiple network security devices report a network security event, multiple identical logs will be generated for the network security event. Therefore, deduplication processing is to retain any one of the multiple identical logs and remove other identical logs. For example, when the network security event is a harmful program event, the log tag for reporting the harmful program event includes a first log tag and a first updated log tag. Then, deduplication processing is to remove the first updated log tag and only retain the first log tag.

[0064] Based on the log set of all network security devices, the log set is parsed in a standardized manner so that the log information reported by each network security device is output in the same format, thereby obtaining an updated log set with the same format. Based on the updated log set, a log set obtained by reporting the same network security event can be obtained, and the logs are combined for simplification and deduplication, so that only one log information is retained for the same network security event, thereby obtaining the most simplified network security event type information.

[0065] S102: Determine a first network security event list for each network security device according to network security event type information and log information of each network security device in the network security device set.

[0066] The log information may include the network security event, event type, event source IP address, event level, event result, and event-related information.

[0067] Among them, in the embodiment of the present application, according to the network security event type information and the log information of each network security device in the network security device set, the first network security event list of each network security device is determined, including:

[0068] Determine, according to the network security device set, log information of each network security device in the network security device set;

[0069] The network security event type information is compared with the log information of each network security device to determine a first network security event list for each network security device.

[0070] Among them, based on the log information set of all network security devices, the log information reported by each network security device among all network security devices can be obtained, and based on the log information reported by each network security device, the standardized log set that can be reported by each network security device can be obtained. By comparing the standardized log set that can be reported by each network security device with the network security event type information, the network security event set that matches the standardized log set that can be reported by each network security device in the network security event type information can be determined, and the network security event set is the first network security event list for each network security device.

[0071] S103: Determine a second network security event list of the network security device subset according to the network security event type information and the log information of the network security device subset, where the network security device subset is a subset of the network security device set.

[0072] Among them, the network security device subset is all subsets of the network security device set. For example, the network security device set includes a first network security device, a second network security device, and a third network security device. Then the network security device subset includes a set consisting of the first network security device and the second network security device, a set consisting of the first network security device and the third network security device, and a set consisting of the second network security device and the third network security device.

[0073] In the embodiment of the present application, the second network security event list of the network security device subset is determined according to the network security event type information and the log information of the network security device subset, including:

[0074] Determine log information of a subset of network security devices according to the network security device set, where the subset of network security devices is a subset of the network security device set;

[0075] The log information of the network security device subset is compared with the network security event type information to determine a second network security event list of the network security device subset.

[0076] Among them, based on the network security device set, each subset in the network security device set can be obtained, and based on the network security event type information, the standardized log set reported by each subset in the network security device set can be determined, and by comparing the standardized log set of each subset in the network security device set with the network security event type set, a network security event set in the network security event type set that matches the standardized log set of each subset in the network security device set can be determined, and the network security event set is the second network security event list of the network security device subset.

[0077] S104. Compare the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, where the preset event reporting threshold requirement represents a requirement for a false alarm rate or missed alarm rate of events for network security devices in a subset of network security devices.

[0078] Among them, the difference between the first network security incident list and the second network security incident list is that the first network security incident list mainly refers to the set of network security incidents that can be reported by a single network security device in a network security device set, and the second network security incident list mainly refers to the set of network security incidents that can be reported by each device subset in the network security device set.

[0079] The preset event reporting threshold requirement may refer to the requirement for the false alarm and missed alarm rate of network security equipment. For example, if an enterprise's monitoring requirement for network security events is that the reporting accuracy of network security events cannot be lower than 95%, then the false alarm and missed alarm rate of network security equipment cannot be higher than 5%. Therefore, the preset event reporting threshold requirement is that the false alarm and missed alarm rate of events is lower than 5%.

[0080] Among them, in the embodiment of the present application, the first network security event list is compared with the second network security event list to determine the target network security event list in the second network security event list that meets the preset event reporting threshold requirements, including:

[0081] Compare the first network security event list with the second network security event list to determine an initial network security event list in which the false positive and false negative rates of events in the second network security event list are the same as the false positive and false negative rates of events in the first network security event list;

[0082] Based on the initial network security event list, determine a target network security event list in which the false alarm and missed alarm rates of events in the initial network security event list meet the preset event reporting threshold requirements, and the preset event reporting threshold requirements represent the requirements for the false alarm and missed alarm rates of events of the network security devices in the network security device subset.

[0083] Among them, a first network security event list that can be reported by each device in the network security device is compared with the network security event type set to determine the false alarm omission rate of the first event of the first network security event list for the network security event; a second network security event list that can be reported by all subsets in the network security device set is compared with the network security event type set to determine the false alarm omission rate of the second event of the second network security event list for the network security event; by comparing the second event false alarm omission rate with the first event false alarm omission rate, an initial network security event list in the second network security event list with the same event false alarm omission rate as that of the first network security event list can be determined; by comparing the initial network security event list with the network security event type set, a target network security event list in the network security event list that meets the preset event false alarm omission rate requirements can be determined.

[0084] S105. Determine the target network security device according to the target network security event list.

[0085] Among them, in the embodiment of the present application, determining the target network security device according to the target network security event list includes:

[0086] According to the target network security event list, determine the target log information in the log information of the network security device set that matches the target network security event list;

[0087] According to the target log information, a target network security device in the network security device set corresponding to the target log information is determined.

[0088] Among them, the target network security event list is compared with the network security device type information to determine the device log information in the network security device type information that matches the target network security event list; the device log information is matched with the network security device set to determine the target network security device in the network security device set that can report the device log information.

[0089] Among them, in the embodiment of the present application, after determining the target network security device according to the target network security event list, it includes:

[0090] The network security device set is replaced with a target network security device, so that the target network security device completes the reporting of network security event type information.

[0091] Among them, after determining the target network security device, the network security device set can be replaced with the target network security device, and the target network security device can report the network security event type information reported by the network security device set. In this way, while replacing the original large number of network security device combinations with a small number of network security device combinations, the function of not affecting the network security event reporting effect is achieved, thereby providing a basis for enterprises to replace network security equipment and save network security maintenance resources.

[0092] The processing method of the network security device provided by the present application can provide information on the type of network security events, where the network security event type information represents information on various types of network security events reported by a set of network security devices; a first network security event list of each network security device is determined based on the network security event type information and log information of each network security device in the set of network security devices; a second network security event list of a subset of network security devices is determined based on the network security event type information and log information of a subset of network security devices, where the subset of network security devices is a subset of the set of network security devices; the first network security event list is compared with the second network security event list to determine the events in the second network security event list that meet a preset event reporting threshold The required target network security event list and the preset event reporting threshold requirements represent the requirements for the event false alarm rate and missed alarm rate of the network security devices in the network security device subset; according to the target network security event list, the target network security device is determined, so that the log information of each security device in the network security device and the log information of the network security device subset can be determined through the obtained network security event type information, and at the same time, according to the log information of each security device in the network security device and the log information of the network security device subset, the network security device that meets the event false alarm rate and missed alarm rate requirements of the network security device is determined, which solves the problem of high false alarm rate and missed alarm rate of the device log of the network security device and improves the event reporting efficiency of the network security device for network security events.

[0093] Figure 2 A flowchart of another processing method of a network security device provided in an embodiment of the present application. Figure 2 As shown, the method includes:

[0094] S201. Collect all network security device logs and perform standardized parsing on the logs based on a frequent pattern tree algorithm.

[0095] Among them, the frequent pattern tree algorithm (English: Frequent Pattern Tree, abbreviated as: FP-growth) is an association analysis algorithm, which compresses the database providing frequent item sets into a frequent pattern tree and retains the item set association information. For example, when the network security event type is a harmful program event, the information obtained after processing by the FP-growth algorithm may include the first device that reports the harmful program event and the first log output by the first device.

[0096] Standardized parsing processing may refer to processing all device logs of network security devices in a unified format, for example, uniformly setting log information of reporting harmful program events as the first log tag.

[0097] S202. The logs after standardized analysis are merged and deduplicated, and security events that are difficult for the system to automatically determine whether they are false positives or missed positives are manually determined, and a full security event list is generated.

[0098] Among them, the full security incident list may refer to a list of all network security incidents reported by all network security devices.

[0099] Merging and deduplication can refer to simplifying the reporting log tags of the same network security event, and ultimately retaining only one log tag. For example, the various reporting log tags for harmful program events in the network security event type information are merged and concentrated to obtain a log tag set for reporting the harmful program event. The log tag set is simplified to retain only any one log tag in the set, and other tags are removed to obtain the target log tag for reporting the harmful program event.

[0100] S203: Compare the standardized log of a single security device with the full security event list, generate and store the duplication, false alarm, and missed alarm rates and the duplication, false alarm, and missed alarm list of the single security device.

[0101] Among them, the duplication, false alarm and missed alarm rates represent the reporting status of a single security device for security incidents in the full security incident list.

[0102] By comparing the standardized logs reported by a single network security device with the set of events in the full security incident list, we can determine the event reporting rate of a single network security device for events in the full security incident list. At the same time, we can determine the false alarms and missed reports of events that occur when a single network security device reports network security incidents, and then generate the duplication, false alarm, and missed report rates of a single security device for all security incidents.

[0103] S204: Combine and deduplicate the standardized logs of any number of security devices, and compare them with the full security event list to generate and store the false positive and false negative rates and the false positive and false negative lists of the security device combination.

[0104] Among them, any multiple security devices may refer to any subset of network security devices in the network security device set. For example, if the network security device set includes a first network security device, a second network security device and a third network security device, then any multiple security devices may refer to a device set consisting of the first network security device and the second network security device, or a device set consisting of the first network security device and the third network security device, or a device set consisting of the second network security device and the third network security device.

[0105] Merging and deduplication processing can refer to merging the standardized logs of any number of security devices to obtain a standardized log set, and processing repeated reports of the same security event in the standardized log set, and ultimately only saving one report of the security event.

[0106] By comparing the standardized logs reported by a security device set consisting of any number of network security devices with the event set in the full security event list, it is possible to determine the event reporting rate of the security device set for events in the full security event list, and at the same time determine the false alarms and missed alarms that occur when the security device set reports network security incidents, and then generate the duplication, false alarm, and missed alarm rates of all security events for the security device set.

[0107] S205. Compare the repetition, false alarm, omission rate and repetition, false alarm, omission list of a single safety device with the false alarm, omission rate and false alarm, omission list of a safety device combination to form a safety device combination with a lower false alarm, omission rate.

[0108] Among them, the event false alarm and omission list of a single security device is compared with the event false alarm and omission list of the security device combination to determine the initial security device combination that matches the event false alarm and omission list of the single security device in the security device combination. Based on the initial security device combination, the target security device combination with the lowest event false alarm and omission rate in the initial security device combination can be obtained.

[0109] S206. Determine, based on a single device in a security device combination with a low false alarm or missed alarm rate, the impact on the full security device list after the single device is replaced by other security devices or other security device combinations.

[0110] Among them, any single device is selected from the security device combination with a low false alarm and missed alarm rate, and the single device is removed from the security device combination with a low false alarm and missed alarm rate to obtain an updated security device combination. The list of network security incidents reported by the security device combination is compared with the list of all security incidents to determine the impact of the single device on the full list of security devices after it is replaced by other security devices or other security device combinations.

[0111] Another method for processing network security equipment provided by the embodiment of the present application can collect all network security equipment logs, and perform standardized parsing processing on the logs based on the FP-growth algorithm; merge and de-duplicate the logs after standardized parsing, and generate a full security event list; compare the standardized logs of a single security device with the full security event list, generate and store the duplication, false alarm, and omission rate of a single security device and the duplication, false alarm, and omission list; merge and de-duplicate the standardized logs of any multiple security devices, and compare them with the full security event list, generate and store the false alarm, omission rate and false alarm, omission list of the security device combination; form a recommendation for a security device combination with a low false alarm and omission rate, and for a specific device in the combination, give the impact on the full security device list after it is replaced by a certain security device or a certain security device combination. Thus, the system gives a better security device combination and the substitutability of a single security device based on the comparison results of a single security device and a security device combination with the full security event list.

[0112] Figure 3 A schematic diagram of the structure of a processing device of a network security device provided in an embodiment of the present application. Figure 3 As shown, the processing device 30 of the network security device includes an acquisition module 301, a first determination module 302, a second determination module 303, a comparison module 304, and a third determination module 305. Among them:

[0113] An acquisition module 301 is used to acquire network security event type information, where the network security event type information represents information about various types of network security events reported by a network security device set;

[0114] A first determining module 302, configured to determine a first network security event list of each network security device according to network security event type information and log information of each network security device in the network security device set;

[0115] A second determining module 303, configured to determine a second network security event list of the network security device subset according to the network security event type information and the log information of the network security device subset, where the network security device subset is a subset of the network security device set;

[0116] A comparison module 304 is used to compare the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, where the preset event reporting threshold requirement represents a requirement for a false alarm rate or missed alarm rate of an event of a network security device in a subset of network security devices;

[0117] The third determination module 305 is used to determine a target network security device according to the target network security event list.

[0118] In the embodiment of the present application, the acquisition module 301 may also be specifically used for:

[0119] Get the log collection of the network security device collection;

[0120] Performing standardized parsing on the log set of the network security device set to obtain a standardized log set;

[0121] The logs obtained by reporting the same security incident in the standardized log set are deduplicated to obtain network security incident type information.

[0122] In the embodiment of the present application, the first determining module 302 may also be specifically configured to:

[0123] Determine, according to the network security device set, log information of each network security device in the network security device set;

[0124] The network security event type information is compared with the log information of each network security device to determine a first network security event list for each network security device.

[0125] In the embodiment of the present application, the comparison module 303 may also be specifically used for:

[0126] Determine log information of a subset of network security devices according to the network security device set, where the subset of network security devices is a subset of the network security device set;

[0127] The log information of the network security device subset is compared with the network security event type information to determine a second network security event list of the network security device subset.

[0128] In the embodiment of the present application, the second determining module 304 may also be specifically configured to:

[0129] Compare the first network security event list with the second network security event list to determine an initial network security event list in which the false positive and false negative rates of events in the second network security event list are the same as the false positive and false negative rates of events in the first network security event list;

[0130] Based on the initial network security event list, determine a target network security event list in which the false alarm and missed alarm rates of events in the initial network security event list meet the preset event reporting threshold requirements, and the preset event reporting threshold requirements represent the requirements for the false alarm and missed alarm rates of events of the network security devices in the network security device subset.

[0131] In the embodiment of the present application, the third determining module 305 may also be specifically used for:

[0132] According to the target network security event list, determine the target log information in the log information of the network security device set that matches the target network security event list;

[0133] According to the target log information, a target network security device in the network security device set corresponding to the target log information is determined.

[0134] In the embodiment of the present application, the third determining module 305 may also be specifically used for:

[0135] The network security device set is replaced with a target network security device, so that the target network security device completes the reporting of network security event type information.

[0136] As can be seen from the above, the processing device 30 of the network security device in the embodiment of the present application is composed of an acquisition module 301, which is used to acquire network security event type information, where the network security event type information represents information on various types of network security events reported by the network security device set; a first determination module 302, which is used to determine a first network security event list for each network security device based on the network security event type information and the log information of each network security device in the network security device set; a second determination module 303, which is used to determine a second network security event list for a network security device subset based on the network security event type information and the log information of the network security device subset, where the network security device subset is a subset of the network security device set; a comparison module 304, which is used to compare the first network security event list with the second network security event list, and determine a target network security event list in the second network security event list that meets the preset event reporting threshold requirement, where the preset event reporting threshold requirement represents the requirement for the event false alarm rate and missed alarm rate of the network security device in the network security device subset; and a third determination module 305, which is used to determine the target network security device based on the target network security event list. Therefore, based on the network security event type information, the log information of each network security device, and the log information of a subset of network security devices, the target network security devices that meet the event false alarm rate and missed alarm rate requirements are determined among the network security devices, thereby reducing the event false alarm and missed alarm rates of the network security devices and improving the network security event reporting rate of the network security devices.

[0137] Figure 4This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown, the electronic device 40 includes:

[0138] The electronic device 40 may include a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a communication component 403 and other components. The processor 401 , the memory 402 and the communication component 403 are connected via a bus 404 .

[0139] In a specific implementation process, at least one processor 401 executes the computer execution instructions stored in the memory 402, so that at least one processor 401 executes the processing method of the network security device as described above.

[0140] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0141] In the above Figure 4 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0142] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0143] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0144] In some embodiments, a computer program product is also proposed, including a computer program or instructions, which implement the steps in any of the above-mentioned processing methods of the network security device when executed by a processor.

[0145] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0146] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0147] To this end, an embodiment of the present application provides a computer-readable storage medium, in which multiple instructions are stored. The instructions can be loaded by a processor to execute the steps in any one of the processing methods of the network security device provided in the embodiment of the present application.

[0148] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0149] According to one aspect of the present application, a computer program product or a computer program is provided. The computer program product or the computer program comprises computer instructions stored in a computer-readable storage medium.

[0150] Since the instructions stored in the storage medium can execute the steps in any of the processing methods for network security devices provided in the embodiments of the present application, any of the processing methods for network security devices provided in the embodiments of the present application can be implemented. The beneficial effects that can be achieved by the method are detailed in the previous embodiments and will not be repeated here.

[0151] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0152] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A processing method for a network security device, characterized in that: The method comprises: Acquire network security event type information, where the network security event type information represents information of various types of network security events reported by the network security device set; Determine a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set; Determine, according to the network security event type information and the log information of the network security device subset, a second network security event list of the network security device subset, wherein the network security device subset is a subset of the network security device set; Comparing the first network security event list with the second network security event list, determining a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, wherein the preset event reporting threshold requirement represents a requirement for a false alarm rate or missed alarm rate of events for network security devices in the subset of network security devices; According to the target network security event list, a target network security device is determined.

2. The method according to claim 1, characterized in that The obtaining of network security event type information includes: Get a collection of logs from a collection of network security devices; Performing standardized parsing on the log set of the network security device set to obtain a standardized log set; The logs obtained by reporting the same security event in the standardized log set are deduplicated to obtain network security event type information.

3. The method according to claim 1, characterized in that The determining, according to the network security event type information and the log information of each network security device in the network security device set, a first network security event list of each network security device comprises: Determine, according to the network security device set, log information of each network security device in the network security device set; The network security event type information is compared with the log information of each of the network security devices to determine a first network security event list for each of the network security devices.

4. The method according to claim 1, characterized in that: The determining, according to the network security event type information and the log information of the network security device subset, a second network security event list of the network security device subset includes: Determining log information of a subset of network security devices according to the network security device set, the subset of network security devices being a subset of the network security device set; The log information of the network security device subset is compared with the network security event type information to determine a second network security event list of the network security device subset.

5. The method according to claim 1, characterized in that The comparing the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets the preset event reporting threshold requirement includes: Comparing the first network security event list with the second network security event list, and determining an initial network security event list in which the false positive and false negative rates of events in the second network security event list are the same as the false positive and false negative rates of events in the first network security event list; Based on the initial network security event list, a target network security event list is determined in which the false alarm and missed alarm rates of events in the initial network security event list meet the preset event reporting threshold requirements, and the preset event reporting threshold requirements represent the requirements for the false alarm and missed alarm rates of events of the network security devices in the network security device subset.

6. The method according to claim 1, characterized in that Determining a target network security device according to the target network security event list includes: According to the target network security event list, determining target log information in the log information of the network security device set that matches the target network security event list; According to the target log information, a target network security device in the network security device set corresponding to the target log information is determined.

7. The method according to claim 1, characterized in that After determining the target network security device according to the target network security event list, the method further comprises: The network security device set is replaced with the target network security device, so that the target network security device completes the reporting of the network security event type information.

8. A processing device for a network security device, characterized in that: include: An acquisition module, used to acquire network security event type information, wherein the network security event type information represents information of various types of network security events reported by a network security device set; A first determining module, configured to determine a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set; A second determining module, configured to determine a second network security event list of the network security device subset according to the network security event type information and log information of the network security device subset, wherein the network security device subset is a subset of the network security device set; a comparison module, configured to compare the first network security event list with the second network security event list, and determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, wherein the preset event reporting threshold requirement represents a requirement for a false alarm rate or missed alarm rate of an event of a network security device in the subset of network security devices; The third determination module is used to determine the target network security device according to the target network security event list.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images