Processing method and apparatus of network security device, device, and storage medium

Abstract

The application provides a processing method, device and equipment of a network security device and a storage medium. The method comprises the following steps: obtaining network security event type information; determining a first network security event list of each network security device according to the network security event type information and log information of each network security device in a network security device set; determining a second network security event list of a network security device sub-set according to the network security event type information and log information of the network security device sub-set; comparing the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event report threshold requirement; and determining a target network security device according to the target network security event list. The method of the application reduces false positives and false negatives of the network security device and improves the event report efficiency of the network security device.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a processing method and device of network security equipment, an equipment and a storage medium. BACKGROUND

[0002] In recent years, network security has been paid more and more attention by enterprises, and the enterprises have selected a large number of network security equipment. In order to help security operation personnel to process a large number of network security equipment logs, the enterprise will process the security equipment logs to reduce the false alarm and repetition of the alarm.

[0003] In the prior art, when processing the logs, the enterprise will perform the following work, one is to uniformly format the standardization analysis of the multi-source heterogeneous log data, and the other is to perform correlation analysis on the standardized log data after the uniform format to realize effective deduplication of the log alarm event.

[0004] However, the enterprise lacks understanding of the repeated false alarm and missed alarm of a single device and the repeated false alarm and missed alarm of the combination of some devices, and lacks basis when the enterprise needs to replace the security equipment. SUMMARY

[0005] The present application provides a processing method, device, equipment and storage medium of network security equipment to solve the problem of repeated false alarm and missed alarm of a certain network security equipment or a combination of some network security equipment in an enterprise.

[0006] In a first aspect, the present application provides a processing method of network security equipment, comprising:

[0007] obtaining network security event type information, the network security event type information representing information of various network security events reported by a network security device set;

[0008] determining a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set;

[0009] determining a second network security event list of a network security device sub-set according to the network security event type information and log information of the network security device sub-set, the network security device sub-set being a sub-set in the network security device set;

[0010] comparing the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, the preset event reporting threshold requirement representing a requirement for an event false alarm rate and missed alarm rate of the network security device in the network security device sub-set;

[0011] According to the target network security event list, determine the target network security device.

[0012] In the embodiment of the application, the network security event type information is obtained, including:

[0013] Obtain a log set of a network security device set;

[0014] Standardize and parse the log set of the network security device set to obtain a standardized log set displayed in a unified format;

[0015] Remove duplicate logs in the standardized log set that are reported for the same security event to obtain the network security event type information.

[0016] In the embodiment of the application, according to the network security event type information and log information of each network security device in the network security device set, determine a first network security event list of each network security device, including:

[0017] According to the network security device set, determine the log information of each network security device in the network security device set;

[0018] Compare the network security event type information with the log information of each network security device to determine the first network security event list of each network security device.

[0019] In the embodiment of the application, according to the network security event type information and log information of the network security device sub-set, determine a second network security event list of the network security device sub-set, including:

[0020] According to the network security device set, determine the log information of the network security device sub-set, the network security device sub-set being a subset of the network security device set;

[0021] Compare the log information of the network security device sub-set with the network security event type information to determine the second network security event list of the network security device sub-set.

[0022] In the embodiment of the application, compare the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, including:

[0023] Compare the first network security event list with the second network security event list to determine an initial network security event list in the second network security event list that has the same event false positive and false negative rate as the first network security event list;

[0024] According to the initial network security event list, a target network security event list in which event false positive and false negative rates meet preset event reporting threshold requirements is determined from the initial network security event list, and the preset event reporting threshold requirements represent requirements for event false positive and false negative rates of network security devices in the network security device subset.

[0025] In the embodiments of the present application, determining the target network security device according to the target network security event list includes:

[0026] According to the target network security event list, target log information that matches the target network security event list is determined from log information of the network security device set.

[0027] According to the target log information, a target network security device corresponding to the target log information in the network security device set is determined.

[0028] In the embodiments of the present application, after the target network security device is determined according to the target network security event list, the following includes:

[0029] The network security device set is replaced with the target network security device, so that the target network security device completes reporting of the network security event type information.

[0030] In a second aspect, the present application provides a processing device of a network security device, which includes:

[0031] The acquisition module is configured to acquire network security event type information, which represents information of various types of network security events reported by the network security device set.

[0032] The first determination module is configured to determine a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set.

[0033] The second determination module is configured to determine a second network security event list of the network security device subset according to the network security event type information and log information of the network security device subset, and the network security device subset is a subset of the network security device set.

[0034] The comparison module is configured to compare the first network security event list with the second network security event list, and determine a target network security event list in which event false positive and false negative rates meet preset event reporting threshold requirements from the second network security event list, and the preset event reporting threshold requirements represent requirements for event false positive and false negative rates of network security devices in the network security device subset.

[0035] The third determination module is configured to determine the target network security device according to the target network security event list.

[0036] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory connected with the processor in communication;

[0037] The memory stores computer-executable instructions.

[0038] The processor executes the computer-executable instructions stored in the memory to implement the method of the embodiments of the present application.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method of the embodiments of the present application.

[0040] The processing method, device and equipment of the network security device and the storage medium provided by the present application, by acquiring network security event type information, the network security event type information represents the information of various network security events reported by the network security device set; according to the network security event type information and the log information of each network security device in the network security device set, determining the first network security event list of each network security device; according to the network security event type information and the log information of the network security device sub-set, determining the second network security event list of the network security device sub-set, the network security device sub-set is a subset in the network security device set; comparing the first network security event list with the second network security event list to determine the target network security event list in the second network security event list that meets the preset event reporting threshold requirement, the preset event reporting threshold requirement represents the requirement for the false positive rate and the false negative rate of the network security device in the network security device sub-set; according to the target network security event list, determining the target network security device, thereby realizing determining the device log of a single security device and the device log of any device combination according to the existing network security device security event set, by comparing the device log of a single security device and the device log of any device combination with the network security device security event set respectively, determining the device combination in any device combination that can report any event in the network security device security event set, and according to the device combination and the single security device, determining the device in the device combination that has no any influence on the event reporting rate of the device combination, and removing the device from the device combination to obtain the target network security device, reducing the false alarm and repetition of the network security device alarm, and improving the efficiency of the network security device processing security events. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0042] Figure 1 A flowchart of a processing method of a network security device provided by an embodiment of the present application is shown in the following figure:

[0043] Figure 2 A flowchart of another processing method of a network security device provided by an embodiment of the present application is shown in the following figure:

[0044] Figure 3 A structural diagram of a processing device of a network security device provided by an embodiment of the present application is shown in the following figure:

[0045] Figure 4 A structural diagram of an electronic device provided by an embodiment of the present application is shown in the following figure.

[0046] The above figures have shown the explicit embodiments of the present application, which will be described in more detail hereinafter. These figures and the written description are not intended to limit the scope of the present application concept in any way, but to illustrate the present application concept to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0047] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is only one of the exemplary embodiments of the present application. Therefore, it is not intended to limit the scope of the present application to the following description and accompanying drawings. Rather, it is intended to cover all alternatives falling within the scope of the present application, as claimed in the appended claims.

[0048] In the prior art, after the log standardization analysis and the alarm deduplication and false alarm elimination processing, the enterprise obtains a relatively accurate overall enterprise network security situation report, but lacks understanding of the repeated false alarm and missed alarm situation of a specific device and the repeated false alarm and missed alarm situation of a combination of some devices, and lacks basis when the enterprise needs to replace the security device.

[0049] To solve the above problems, the present application provides a network security event processing method, which generates a security event list of a network security device, compares it with the event list of a single security device and a combination of security devices, and according to the comparison results of the single security device and the combination of security devices with the full-amount security event list, gives a better security device combination situation, which can effectively reduce the false alarm and missed alarm situation of the network security device and improve the efficiency of the network security device in reporting security events.

[0050] The technical solutions of the present application and how the technical solutions solve the above technical problems will be described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes can not be described again in some examples. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0051] The execution subject of the processing method of the network security device provided in the embodiments of the present application can be a server. The server can be a computer or the like. The embodiments of the present application do not particularly limit the implementation of the execution subject, as long as the execution subject can obtain network security event type information representing information of various network security events reported by a network security device set; determine a first network security event list of each network security device in the network security device set according to the network security event type information and log information of each network security device in the network security device set; determine a second network security event list of a network security device sub-set according to the network security event type information and log information of the network security device sub-set, the network security device sub-set being a sub-set in the network security device set; compare the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement representing a requirement for a false positive rate or a false negative rate of a network security device in the network security device sub-set; and determine a target network security device according to the target network security event list.

[0052] The network security event type information is information of various network security events, such as a harmful program event, a network attack event, an information destruction event, an information content security event, and a device facility failure event.

[0053] The log information can include an event type of a network security event, an event source IP address, an event level, an event result, and event related information.

[0054] The preset event reporting threshold requirement can refer to a requirement for a false positive rate or a false negative rate of a network security device.

[0055] Figure 1 A flowchart of a processing method of a network security device provided in the embodiments of the present application is shown in FIG. 1. Figure 1 As shown in FIG. 1, the method includes the following steps.

[0056] In S101, network security event type information representing information of various network security events reported by a network security device set is obtained.

[0057] The network security event type information is information of various network security events, such as a harmful program event, a network attack event, an information destruction event, an information content security event, and a device facility failure event.

[0058] In the embodiment of the present application, the network security event type information is obtained, including:

[0059] A log set of the network security device set is obtained.

[0060] The log set of the network security device set is standardized and parsed to obtain a standardized log set in a unified format.

[0061] The logs in the standardized log set that are reported for the same security event are processed to remove duplicates to obtain the network security event type information.

[0062] The standardized parsing can refer to parsing the direct information and indirect information in the log and outputting in a unified format, thereby improving the consistency and integrity of the log. For example, the event type of the network security event reported in the log is taken as a log tag. When the network security event is a harmful program event, the harmful program event is taken as a first log tag. When the network security event is a network attack event, the network attack event is taken as a second log tag.

[0063] The duplicate removal processing can refer to that when multiple network security devices report a network security event, multiple same logs for the network security event are generated. Therefore, the duplicate removal processing is to retain any one of the multiple same logs and remove the other same logs. For example, when the network security event is a harmful program event, the log tags reported for the harmful program event include a first log tag and a first updated log tag. The duplicate removal processing is to remove the first updated log tag and retain only the first log tag.

[0064] The log set of all network security devices is standardized and parsed to output the log information reported by each network security device in the same format, thereby obtaining an updated log set in the same format. According to the updated log set, the log set reported for the same network security event is obtained. The log set is simplified and removed to retain only one log information for the same network security event, thereby obtaining the most simplified network security event type information.

[0065] S102, according to the network security event type information and the log information of each network security device in the network security device set, determining a first network security event list of each network security device.

[0066] The log information can include an event of a network security event occurrence, an event type, an event source IP address, an event level, an event result, and event related information.

[0067] In the embodiment of the present application, the first network security event list of each network security device is determined according to the network security event type information and the log information of each network security device in the network security device set, including:

[0068] The log information of each network security device in the network security device set is determined according to the network security device set.

[0069] The first network security event list of each network security device is determined by comparing the network security event type information with the log information of each network security device.

[0070] According to the log information set of all network security devices, the log information reported by each network security device in all network security devices can be obtained. According to the log information reported by each network security device, a standardized log set that can be reported by each network security device is obtained. By comparing the standardized log set that can be reported by each network security device with the network security event type information, a network security event set that matches the standardized log set that can be reported by each network security device in the network security event type information can be determined. The network security event set is the first network security event list of each network security device.

[0071] S103, determining a second network security event list of a network security device sub-set according to the network security event type information and the log information of the network security device sub-set, the network security device sub-set being a sub-set in the network security device set.

[0072] The network security device sub-set is all sub-sets of the network security device set. For example, the network security device set includes a first network security device, a second network security device, and a third network security device. The network security device sub-set includes a set composed of the first network security device and the second network security device, a set composed of the first network security device and the third network security device, and a set composed of the second network security device and the third network security device.

[0073] In the embodiment of the present application, the second network security event list of the network security device sub-set is determined according to the network security event type information and the log information of the network security device sub-set, including:

[0074] The log information of the network security device sub-set is determined according to the network security device set, the network security device sub-set being a sub-set in the network security device set.

[0075] The log information of the subset of network security devices is compared with the network security event type information to determine a second network security event list of the subset of network security devices.

[0076] According to the set of network security devices, each subset in the set of network security devices can be obtained, and according to the network security event type information, a standardized log set reported by each subset in the set of network security devices can be determined. The standardized log set of each subset in the set of network security devices is compared with the set of network security event types, and a set of network security events in the set of network security event types that matches the standardized log set of each subset in the set of network security devices can be determined. The set of network security events is the second network security event list of the subset of network security devices.

[0077] S104, comparing the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement. The preset event reporting threshold requirement represents a requirement for the false positive rate and the false negative rate of the network security event of the subset of network security devices.

[0078] The difference between the first network security event list and the second network security event list is that the first network security event list mainly refers to a set of network security events that can be reported by a single network security device in the set of network security devices, and the second network security event list mainly refers to a set of network security events that can be reported by each device subset in the set of network security devices.

[0079] The preset event reporting threshold requirement can refer to the requirement for the false positive rate and the false negative rate of the network security event. For example, the monitoring requirement of the enterprise for the network security event is that the reporting accuracy rate of the network security event cannot be lower than 95%, and the false positive rate and the false negative rate of the network security event cannot be higher than 5%. Therefore, the preset event reporting threshold requirement is that the false positive rate and the false negative rate are lower than 5%.

[0080] In the embodiment of the present application, the first network security event list is compared with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, including:

[0081] The first network security event list is compared with the second network security event list to determine an initial network security event list in the second network security event list that has the same false positive rate and false negative rate as the first network security event list;

[0082] Based on the initial network security event list, a target network security event list is determined that meets the preset event reporting threshold requirement in the initial network security event list. The preset event reporting threshold requirement represents the requirement for the false alarm rate and false alarm rate of network security devices in the network security device subset.

[0083] Specifically, the first network security event list that each device in the network security device set can report is compared with the network security event type set to determine the false positive / false negative rate of the first network security event list for network security events; the second network security event list that all subsets in the network security device set can report is compared with the network security event type set to determine the false positive / false negative rate of the second network security event list for network security events; the false positive / false negative rate of the second event is compared with the false positive / false negative rate of the first event to determine the initial network security event list in the second network security event list that has the same false positive / false negative rate as the first network security event list; the initial network security event list is compared with the network security event type set to determine the target network security event list in the network security event list that meets the preset false positive / false negative rate requirement.

[0084] S105. Identify the target network security devices based on the target network security incident list.

[0085] In this embodiment of the application, the target network security device is determined based on the target network security event list, including:

[0086] Based on the target network security event list, identify the target log information in the network security device set that matches the target network security event list;

[0087] Based on the target log information, identify the target network security device in the network security device set that corresponds to the target log information.

[0088] Specifically, the target network security event list is compared with network security device type information to identify device log information that matches the target network security event list; the device log information is then matched with a set of network security devices to identify the target network security device in the set that can report the device log information.

[0089] In this embodiment of the application, after determining the target network security device based on the target network security event list, the process includes:

[0090] Replace the network security device set with the target network security device so that the target network security device can complete the reporting of network security event type information.

[0091] Wherein, after determining the target network security device, the network security device set can be replaced by the target network security device, and the target network security device can report the network security event type information reported by the network security device set, so as to realize the function of not affecting the network security event reporting effect while replacing the original large number of network security device combinations with a small number of network security device combinations, thereby providing a basis for enterprises to replace network security devices and save network security maintenance resources.

[0092] The network security device processing method provided by the application can provide network security event type information, which represents information of various network security events reported by a network security device set; determine a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set; determine a second network security event list of a network security device sub-set according to the network security event type information and log information of the network security device sub-set, which is a sub-set of the network security device set; compare the first network security event list with the second network security event list to determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, which represents a requirement for the false positive rate and the false negative rate of the network security devices in the network security device sub-set; and determine a target network security device according to the target network security event list, so that the log information of each network security device in the network security device set and the log information of the network security device sub-set can be determined through the obtained network security event type information, and the network security device that meets the false positive rate and the false negative rate requirement of the network security device can be determined according to the log information of each network security device in the network security device set and the log information of the network security device sub-set, thereby solving the problem of high false positive rate and false negative rate of the device log of the network security device and improving the event reporting efficiency of the network security device for network security events.

[0093] Figure 2 Another flowchart of a network security device processing method provided by an embodiment of the application is shown in FIG. 4. Figure 2 As shown in FIG. 4, the method includes:

[0094] S201, collect all network security device logs and perform standardized analysis and processing on the logs based on the frequent pattern tree algorithm.

[0095] The frequent pattern tree algorithm (Frequent Pattern Tree, FP-growth for short) is an association analysis algorithm that compresses a database providing frequent item sets into a frequent pattern tree and retains item set association information. For example, when the network security event type is a harmful program event, the information obtained after processing by the FP-growth algorithm can include the first device that reports the harmful program event and the first log output by the first device.

[0096] The standardized analysis process can refer to processing all device logs of the network security device in a unified format, such as uniformly setting log information reporting a harmful program event as a first log tag.

[0097] S202, merging and deduplicating the logs after standardized analysis, manually determining security events that are difficult for the system to automatically determine as false positives or false negatives, and generating a full-quantity security event list.

[0098] The full-quantity security event list can refer to a list of all network security events reported by all network security devices.

[0099] Merging and deduplicating can refer to simplifying the reporting log tags of the same network security event, and finally retaining only one log tag. For example, merging and centralizing each reporting log tag of a harmful program event in the network security event type information, thereby obtaining a log tag set reporting the harmful program event, simplifying the log tag set, retaining only an arbitrary log tag in the set, and removing other tags, thereby obtaining a target log tag reporting the harmful program event.

[0100] S203, comparing the standardized logs of a single security device with the full-quantity security event list, and generating and storing the repetition, false positive, and false negative rate of the single security device, as well as the repetition, false positive, and false negative list.

[0101] The repetition, false positive, and false negative rate represents the reporting situation of a single security device for security events in the full-quantity security event list.

[0102] Comparing the standardized logs reported by a single network security device with the event set in the full-quantity security event list can determine the event reporting rate of the single network security device for the events in the full-quantity security event list, and can also determine the event false positive and event false negative situations when the single network security device reports network security events, thereby generating the repetition, false positive, and false negative rate of the single security device for all security events.

[0103] S204, merge and deduplicate the standardized logs of any number of security devices, and compare them with the full security event list to generate and store the false positive and false negative rates and lists of the security device combination.

[0104] Any number of security devices can refer to any subset of network security devices in a network security device set. For example, if the network security device set includes a first network security device, a second network security device, and a third network security device, any number of security devices can refer to a device set consisting of the first network security device and the second network security device, or a device set consisting of the first network security device and the third network security device, or a device set consisting of the second network security device and the third network security device.

[0105] The merge and deduplication process can refer to merging the standardized logs of any number of security devices to obtain a standardized log set, and processing the repeated reports of the same security event in the standardized log set, so that only one report of the security event is saved.

[0106] Comparing the standardized logs reported by the security device set consisting of any number of network security devices with the event set in the full security event list can determine the event reporting rate of the security device set for the events in the full security event list, and can also determine the event false positive and false negative conditions when the security device set reports network security events, and further generate the repetition, false positive, and false negative rates of the security device set for all security events.

[0107] S205, compare the repetition, false positive, and false negative rates and lists of a single security device with the false positive and false negative rates and lists of a security device combination to form a security device combination with lower false positive and false negative rates.

[0108] Comparing the event false positive and false negative lists of a single security device with the event false positive and false negative lists of a security device combination can determine an initial security device combination in the security device combination that matches the event false positive and false negative lists of the single security device, and based on the initial security device combination, the target security device combination with the lowest event false positive and false negative rates in the initial security device combination can be obtained.

[0109] S206, determine the impact of a single device in a security device combination with lower false positive and false negative rates on the full security device list after the single device is replaced by other security devices or other security device combinations.

[0110] Specifically, by selecting any single device from a security device combination with a low false alarm and false alarm rate, removing that single device from the combination, and obtaining an updated security device combination, the network security event list reported by this security device combination can be compared with the full security event list to determine the impact of replacing the single device with other security devices or other security device combinations on the full security device list.

[0111] Another method for processing network security devices provided in this application embodiment can collect all network security device logs and perform standardized parsing processing on the logs based on the FP-growth algorithm; merge and deduplicate the standardized parsed logs to generate a full security event list; compare the standardized logs of a single security device with the full security event list to generate and store the duplication, false positive, and false negative rates and lists of duplication, false positive, and false negative rates for a single security device; merge and deduplicate the standardized logs of any multiple security devices and compare them with the full security event list to generate and store the false positive and false negative rates and lists of false positive and false negative rates for the security device combination; form a recommended security device combination with low false positive and false negative rates; and for a specific device in the combination, provide the impact on the full security device list if it is replaced by another security device or a combination of security devices. Therefore, based on the comparison results of individual security devices and security device combinations with the full security event list, the system provides optimal security device combinations and the substitutability of individual security devices.

[0112] Figure 3 This is a schematic diagram of the structure of the processing device of the network security device provided in an embodiment of this application. Figure 3 As shown, the processing unit 30 of the network security device includes an acquisition module 301, a first determination module 302, a second determination module 304, a comparison module 303, and a third determination module 305. Wherein:

[0113] The acquisition module 301 is used to acquire network security event type information, which represents information on various network security events reported by the network security device set;

[0114] The first determining module 302 is used to determine the first network security event list for each network security device based on the network security event type information and the log information of each network security device in the network security device set;

[0115] The second determining module 304 is used to determine the second network security event list of the network security device subset based on the network security event type information and the log information of the network security device subset, wherein the network security device subset is a subset within the network security device set;

[0116] The comparison module 303 is configured to compare the first network security event list with the second network security event list, and determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, where the preset event reporting threshold requirement represents a requirement on an event false positive rate and an event false negative rate of the network security device subset.

[0117] The third determination module 305 is configured to determine the target network security device according to the target network security event list.

[0118] In the embodiments of the present application, the acquisition module 301 can be specifically configured to:

[0119] acquire a log set of the network security device set;

[0120] perform standardized analysis on the log set of the network security device set to obtain a standardized log set;

[0121] perform deduplication processing on logs obtained by reporting the same security event in the standardized log set to obtain network security event type information.

[0122] In the embodiments of the present application, the first determination module 302 can be specifically configured to:

[0123] determine log information of each network security device in the network security device set according to the network security device set;

[0124] compare the network security event type information with the log information of each network security device to determine a first network security event list of each network security device.

[0125] In the embodiments of the present application, the comparison module 303 can be specifically configured to:

[0126] determine log information of the network security device subset according to the network security device set, where the network security device subset is a subset of the network security device set;

[0127] compare the log information of the network security device subset with the network security event type information to determine a second network security event list of the network security device subset.

[0128] In the embodiments of the present application, the second determination module 304 can be specifically configured to:

[0129] compare the first network security event list with the second network security event list to determine an initial network security event list in the second network security event list that has the same event false positive rate and event false negative rate as the first network security event list;

[0130] According to the initial network security event list, a target network security event list in which event false positive and false negative rates of events meet preset event reporting threshold requirements is determined from the initial network security event list, and the preset event reporting threshold requirements represent requirements on event false positive and false negative rates of network security devices in the network security device subset.

[0131] In the embodiments of the present application, the third determination module 305 can be specifically configured to:

[0132] According to the target network security event list, target log information that matches the target network security event list is determined from log information of the network security device set.

[0133] According to the target log information, a target network security device corresponding to the target log information is determined from the network security device set.

[0134] In the embodiments of the present application, the third determination module 305 can be specifically configured to:

[0135] The network security device set is replaced with the target network security device, so that the target network security device completes reporting of the network security event type information.

[0136] As can be seen from the above, the processing device 30 of the network security device in the embodiments of the present application includes an acquisition module 301 configured to acquire network security event type information, the network security event type information representing information of various network security events reported by a network security device set; a first determination module 302 configured to determine a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set; a second determination module 304 configured to determine a second network security event list of a network security device subset according to the network security event type information and log information of the network security device subset, the network security device subset being a subset of the network security device set; a comparison module 303 configured to compare the first network security event list with the second network security event list, and determine a target network security event list in which events meet preset event reporting threshold requirements from the second network security event list, the preset event reporting threshold requirements representing requirements on event false positive and false negative rates of network security devices in the network security device subset; and a third determination module 305 configured to determine a target network security device according to the target network security event list. Thus, the target network security device that meets the event false positive and false negative rate requirements is determined from the network security event type information, the log information of each network security device, and the log information of the subset of the network security device, the event false positive and false negative rate of the network security device is reduced, and the network security event reporting rate of the network security device is improved.

[0137] Figure 4A structural schematic diagram of an electronic device is provided in the embodiments of the present application. As shown in the figure, Figure 4 The electronic device 40 comprises:

[0138] The electronic device 40 can comprise a processor 401 with one or more processing cores, a memory 402 with one or more computer readable storage media, a communication component 403, and the like. The processor 401, the memory 402, and the communication component 403 are connected through a bus 404.

[0139] In the specific implementation process, the at least one processor 401 executes the computer execution instructions stored in the memory 402, so that the at least one processor 401 executes the processing method of the network security device as described above.

[0140] The specific implementation process of the processor 401 can refer to the method embodiments described above, which have similar implementation principles and technical effects. Therefore, the specific implementation process of the processor 401 will not be described here.

[0141] In the above Figure 4 In the embodiments shown in the figure, it should be understood that the processor can be a central processing unit (English: Central Processing Unit, for short: CPU), and can also be other general-purpose processors, digital signal processors (English: Digital Signal Processor, for short: DSP), application specific integrated circuits (English: Application Specific Integrated Circuit, for short: ASIC), etc. The general-purpose processor can be a microprocessor, or the processor can be any conventional processor, etc. The steps of the method disclosed in combination with the application can be directly embodied as execution completed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

[0142] The memory can contain a random access memory (Random Access Memory, RAM), and can also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0143] The bus can be an industry standard architecture (Industry Standard Architecture, ISA) bus, a peripheral component (Peripheral Component, PCI) bus, or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, the bus in the drawings of the present application does not limit only one bus or one type of bus.

[0144] In some embodiments, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the steps in the processing method of any of the network security devices described above.

[0145] The specific implementation of each operation above can refer to the previous embodiments, which will not be repeated here.

[0146] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by relevant hardware controlled by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0147] To this end, an embodiment of the present application provides a computer readable storage medium, which stores a plurality of instructions, which can be loaded by a processor to execute the steps in the processing method of any of the network security devices provided by the embodiments of the present application.

[0148] The storage medium can include a read-only memory (English: Read Only Memory, abbreviated: ROM), a random access memory (English: Random Access Memory, abbreviated: RAM), a magnetic disk or an optical disk, etc.

[0149] According to an aspect of the present application, a computer program product or computer program is provided, which includes computer instructions stored in a computer readable storage medium.

[0150] Since the instructions stored in the storage medium can execute the steps in the processing method of any of the network security devices provided by the embodiments of the present application, the processing method of any of the network security devices provided by the embodiments of the present application can be implemented. The beneficial effects that the method can achieve are described in detail in the previous embodiments, which will not be repeated here.

[0151] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains. The specification and examples are to be regarded as exemplary only, and the true scope and spirit of the application are indicated by the following claims.

[0152] It should be understood that the present application is not limited to the precise structures described herein and illustrated in the drawings and that various modifications and changes can be made without departing from the scope thereof, which is indicated by the appended claims. The scope of the application is limited only by the claims that follow.

Claims

1. A processing method of a network security device, characterized by, The method comprises: obtaining network security event type information, the network security event type information representing information of various network security events reported by a network security device set; determining a first network security event list of each network security device in the network security device set according to the network security event type information and log information of each network security device in the network security device set; determining a second network security event list of a network security device sub-set according to the network security event type information and log information of the network security device sub-set, the network security device sub-set being all sub-sets in the network security device set; comparing the first network security event list with the second network security event list to determine a target network security event list meeting a preset event reporting threshold requirement in the second network security event list, the preset event reporting threshold requirement representing a requirement for false positive rate and false negative rate of network security devices in the network security device sub-set; determining a target network security device according to the target network security event list. The comparing the first network security event list with the second network security event list to determine a target network security event list meeting a preset event reporting threshold requirement in the second network security event list comprises: comparing the first network security event list with the second network security event list to determine an initial network security event list in the second network security event list having the same false positive rate and false negative rate as the first network security event list; determining a target network security event list meeting a preset event reporting threshold requirement in the initial network security event list according to the initial network security event list, the preset event reporting threshold requirement representing a requirement for false positive rate and false negative rate of network security devices in the network security device sub-set.

2. The method of claim 1, wherein, The obtaining network security event type information comprises: obtaining a log set of the network security device set; standardizing and analyzing the log set of the network security device set to obtain a standardized log set; performing deduplication processing on logs representing the same security event in the standardized log set to obtain network security event type information.

3. The method of claim 1, wherein, The determining a first network security event list of each network security device in the network security device set according to the network security event type information and log information of each network security device in the network security device set comprises: determining log information of each network security device in the network security device set according to the network security device set; comparing the network security event type information with the log information of each network security device to determine a first network security event list of each network security device.

4. The method of claim 1, wherein, The determining a second network security event list of a network security device sub-set according to the network security event type information and log information of the network security device sub-set comprises: According to the network security device set, log information of a network security device subset is determined, the network security device subset being a subset of the network security device set; The log information of the network security device subset is compared with the network security event type information, and a second network security event list of the network security device subset is determined.

5. The method of claim 1, wherein, The target network security device is determined according to the target network security event list, which comprises: According to the target network security event list, target log information matching the target network security event list in the log information of the network security device set is determined; According to the target log information, a target network security device corresponding to the target log information in the network security device set is determined.

6. The method of claim 1, wherein, After the target network security device is determined according to the target network security event list, the network security device set is replaced by the target network security device, so that the target network security device completes the reporting of the network security event type information. It comprises:

7. A processing device of a network security device, characterized by, An acquisition module is configured to acquire network security event type information, which represents information of various network security events reported by a network security device set; A first determination module is configured to determine a first network security event list of each network security device according to the network security event type information and log information of each network security device in the network security device set; A second determination module is configured to determine a second network security event list of a network security device subset according to the network security event type information and log information of the network security device subset, the network security device subset being a subset of the network security device set; A comparison module is configured to compare the first network security event list with the second network security event list, and determine a target network security event list in the second network security event list that meets a preset event reporting threshold requirement, the preset event reporting threshold requirement representing a requirement for an event false alarm rate and a missing rate of a network security device in the network security device subset; A third determination module is configured to determine a target network security device according to the target network security event list; The comparison module is specifically configured to compare the first network security event list with the second network security event list, and determine an initial network security event list in the second network security event list that has the same event false alarm rate and missing rate as the first network security event list; According to the initial network security event list, a target network security event list in the initial network security event list that meets a preset event reporting threshold requirement is determined, the preset event reporting threshold requirement representing a requirement for an event false alarm rate and a missing rate of a network security device in the network security device subset. It comprises:

8. An electronic device, comprising: A processor and a memory connected with the processor in communication; The memory stores computer execution instructions; ​ The processor executes computer-executable instructions stored in the memory to implement the method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions that, when executed by a processor, implement the method of any one of claims 1-6.

Images