Method, device and equipment for removing false alarm of network security alarm event and medium

Abstract

The invention relates to the field of network security intelligence analysis, and discloses a network security alarm event false alarm removal method and device, equipment and a medium, and the method specifically comprises the steps: obtaining a false alarm event, and presetting an autocorrelation coefficient threshold, a trend false alarm processing interval and a periodic false alarm processing interval; performing clustering statistics on the false alarm events based on the trend false alarm processing interval to obtain a plurality of trend event sequences; performing sequence recombination on the plurality of trend event sequences based on the periodic false alarm processing interval to obtain a plurality of periodic event sequences; calculating an autocorrelation coefficient of the plurality of periodic event sequences, and comparing the autocorrelation coefficient with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences; and performing time-frequency domain conversion on the plurality of target period event sequences to obtain a target period value, and removing the target period event sequences of which the target period values are not zero, thereby improving the simplicity, accuracy and wide applicability of false alarm removal.

Description

Technical Field

[0001] The present invention relates to the field of network security intelligence analysis, and in particular to a method, device, equipment and medium for removing false positives of network security alarm events. Background Art

[0002] The alarms generated by various security products often contain a large number of false alarms, and false alarms have become an inevitable problem in network security devices. These false alarms have caused serious interference to network security analysts. For example, some normal devices generate a large number of security events due to configuration or operation errors, resulting in false alarms. By counting the alarm data of real scenarios, it is found that false alarms often have a huge amount of data, and the same IP accounts for a high proportion. The corresponding source or destination IP is evenly distributed and lasts for a long time, making it difficult to accurately remove false alarms.

[0003] The existing technology is based on statistical analysis methods. Based on the analysis of large-scale and large numbers of alarms, it can be found that many false alarm behaviors have some characteristics compared with real alarms. Statistical analysis is mainly to find the alarm set that meets the false alarm characteristics, and then extract filtering rules. The rules are based on the specific characteristics of the alarm set to reduce the false alarm rate. This method requires comparative analysis of real alarms and false alarms to extract features, which requires a lot of expert knowledge support. In addition, the alarm rules of various security devices are the same, which makes it difficult to truly solve practical problems. Therefore, a new false alarm removal method is needed to improve the simplicity, accuracy and wide applicability of false alarm removal. Summary of the invention

[0004] In view of this, the present invention provides a method, device, equipment and medium for removing false alarms of network security alarm events to solve the problems of cumbersomeness, low accuracy and poor applicability of false alarm removal.

[0005] In a first aspect, the present invention provides a method for removing false positives of network security alarm events, the method comprising:

[0006] Obtain false alarm events, preset autocorrelation coefficient threshold, trend false alarm processing interval and period false alarm processing interval;

[0007] Based on the trend false alarm processing interval, clustering statistics are performed on the false alarm events to obtain multiple trend event sequences;

[0008] Based on the periodic false alarm processing interval, the plurality of trend event sequences are reorganized to obtain a plurality of periodic event sequences;

[0009] Calculating the autocorrelation coefficients of the plurality of periodic event sequences, and comparing the autocorrelation coefficients with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences;

[0010] The multiple target periodic event sequences are converted into time-frequency domain to obtain target periodic values, and the target periodic event sequences whose target periodic values ​​are not 0 are removed.

[0011] The false alarm removal method provided by the embodiment of the present invention obtains false alarm events, preset autocorrelation coefficient thresholds, trend false alarm processing intervals and periodic false alarm processing intervals, and based on the trend false alarm processing intervals, performs cluster statistics on the false alarm events to obtain multiple trend event sequences; based on the periodic false alarm processing intervals, multiple trend event sequences are sequenced to obtain multiple periodic event sequences; the accuracy of determining multiple periodic event sequences is improved; then the autocorrelation coefficients of the multiple periodic event sequences are calculated, and the autocorrelation coefficients are compared with the preset autocorrelation coefficient threshold to determine the target periodic event sequence, thereby improving the rigor and accuracy of determining the target periodic event sequence; further, multiple target periodic event sequences are converted into time-frequency domains to obtain target period values, and target periodic event sequences with non-zero target period values ​​are removed. Through the time-frequency domain conversion, the accuracy of determining the target period value is improved, thereby improving the accuracy of false alarm removal. In the present application, multiple sequence cluster statistics are performed in combination with the time-frequency domain conversion to improve the simplicity and wide applicability of false alarm removal.

[0012] In an optional implementation, clustering statistics are performed on the false alarm events based on the trend false alarm processing interval to obtain multiple trend event sequences, including:

[0013] Obtaining address information and type information corresponding to the false alarm event;

[0014] Based on the trend false alarm processing interval, the address information and the type information, clustering statistics are performed on the false alarm events to obtain multiple interval event sequences;

[0015] When the number of events corresponding to the multiple interval event sequences is the same, a first-order difference is performed on each interval event sequence to obtain the multiple trend event sequences.

[0016] The false alarm removal method provided by the embodiment of the present invention performs cluster statistics on false alarm events by acquiring the address information, type information and trend false alarm processing interval of the false alarm events, and judges the number of events for the multiple interval events obtained, and then performs first-order difference on multiple interval event sequences with the same number of events to obtain multiple trend event sequences, thereby improving the accuracy of determining multiple trend event sequences, and thus improving the accuracy of false alarm removal.

[0017] In an optional implementation, the multiple trend event sequences are reorganized based on the periodic false alarm processing interval to obtain multiple periodic event sequences, including:

[0018] Get the order of period arrangement;

[0019] Based on the periodic false alarm processing interval, the period arrangement order and the address information, the multiple trend event sequences are reorganized to obtain the multiple periodic event sequences.

[0020] The false alarm removal method provided by the embodiment of the present invention combines the periodic false alarm processing interval, the periodic arrangement order and the address information to reorganize multiple trend event sequences, thereby obtaining multiple periodic event sequences, thereby improving the rigor of the reorganization process, and further improving the rigor and accuracy of the obtained multiple periodic event sequences.

[0021] In an optional implementation, calculating the autocorrelation coefficients of the plurality of periodic event sequences includes:

[0022] Get the number of lagged series;

[0023] Based on the number of lagged sequences, determining a plurality of lagged periodic event sequences among the plurality of periodic event sequences;

[0024] Based on the coefficient calculation formula, the autocorrelation coefficients of the multiple lag period event sequences are calculated, and the autocorrelation coefficient corresponding to each lag period event sequence is determined.

[0025] The false alarm removal method provided by the embodiment of the present invention determines multiple lag period event sequences through the lag sequence number, and calculates the autocorrelation coefficients of the multiple lag period event sequences based on the coefficient calculation formula, and then determines the autocorrelation coefficient corresponding to each lag period event sequence, thereby improving the accuracy of calculating the autocorrelation coefficient, and providing more comprehensive and accurate information for the subsequent determination of the false alarm removal period event sequence through autocorrelation coefficient calculation, thereby improving the accuracy of false alarm removal.

[0026] In an optional implementation, comparing the autocorrelation coefficient with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences includes:

[0027] Comparing the autocorrelation coefficient with the preset autocorrelation coefficient threshold to obtain a coefficient comparison result;

[0028] The coefficient comparison result indicates that the periodic event sequences among the multiple periodic event sequences whose autocorrelation coefficients are greater than the preset autocorrelation coefficient threshold are determined as the multiple target periodic event sequences.

[0029] The false alarm removal method provided by an embodiment of the present invention compares the calculated autocorrelation coefficient with a preset autocorrelation coefficient threshold, and determines the periodic event sequences in the coefficient comparison results indicating that the autocorrelation coefficients of multiple periodic event sequences are greater than the preset autocorrelation coefficient threshold as multiple target periodic event sequences, thereby improving the accuracy and authenticity of determining the target periodic event sequences, and further providing effective data support for achieving false alarm removal in massive events.

[0030] In some optional implementations, converting the multiple target period event sequences into time-frequency domains to determine the target period value includes:

[0031] Performing Fourier processing on the plurality of target periodic event sequences to obtain a plurality of frequency values;

[0032] Sorting the multiple frequency values ​​to determine a target frequency value;

[0033] The target period value is determined based on the target frequency value and a period calculation formula.

[0034] The false alarm removal method provided by the embodiment of the present invention performs Fourier processing on multiple periodic event sequences, determines multiple frequency values, and sorts the multiple frequency values, and then determines the maximum frequency value as the target frequency value. Further, the target frequency value is applied to the period calculation formula to determine the target period value, thereby improving the rationality, rigor and calculation simplicity of determining the target period value.

[0035] In some optional implementations, before clustering and counting the false alarm events based on the trend false alarm processing interval to obtain a plurality of interval event sequences, the method further includes:

[0036] Get the preset event format;

[0037] Based on the preset event format and the false alarm event, formatting processing is performed to obtain a formatted false alarm event;

[0038] Based on the trend false alarm processing interval, cluster statistics are performed on the format false alarm events to obtain multiple interval event sequences.

[0039] The false alarm removal method provided in the embodiment of the present invention formats the false alarm events by presetting the event format, and then clusters and counts the obtained formatted false alarm events based on the trend false alarm processing intervals to obtain multiple interval event sequences, thereby improving the simplicity of false alarm event analysis and the simplicity of interval event sequence determination.

[0040] In a second aspect, the present invention provides a false alarm removal device, the device comprising:

[0041] An acquisition module, used for acquiring false alarm events, preset autocorrelation coefficient threshold, trend false alarm processing interval and period false alarm processing interval;

[0042] A statistical module, used for performing cluster statistics on the false alarm events based on the trend false alarm processing interval to obtain multiple trend event sequences;

[0043] A reorganization module, used for reorganizing the plurality of trend event sequences based on the periodic false alarm processing interval to obtain a plurality of periodic event sequences;

[0044] A calculation module, used for calculating the autocorrelation coefficients of the plurality of periodic event sequences, and comparing the autocorrelation coefficients with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences;

[0045] The removal module is used to perform time-frequency domain conversion on the multiple target periodic event sequences to obtain target periodic values, and remove the target periodic event sequences whose target periodic values ​​are not 0.

[0046] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the false alarm removal method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0047] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the false alarm removal method of the first aspect or any corresponding embodiment thereof.

[0048] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the false alarm removal method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 is a flow chart of a false alarm removal method according to an embodiment of the present invention;

[0051] Figure 2 is a schematic diagram of a false alarm removal device according to an embodiment of the present invention;

[0052] Figure 3 It is a structural schematic diagram of a computer device provided by an optional embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0054] There are often many alarm errors in network security devices. The existence of numerous alarm errors makes it difficult for security analysts to conduct security analysis well, causing a great deal of trouble, especially a large number of false alarms caused by configuration errors or operational errors, which increases the difficulty of false alarm analysis. In addition, through statistics of real-scene alarm data, false alarms often have a huge amount of data, and the same IP accounts for a high proportion. The corresponding source or destination IP is distributed relatively evenly and lasts for a long time, making it difficult to accurately remove false alarms.

[0055] The existing technology of false alarm removal is usually based on statistical analysis methods to remove false alarms based on the analysis of large-scale and large numbers of alarms. This method requires comparative analysis of real alarms and false alarms to extract features, which requires a lot of expert knowledge support. In addition, in real scenarios, the alarm rules of various security devices are different, making it difficult to truly solve practical problems.

[0056] The amount of cybersecurity incident data in the big data environment is huge, and various incidents are complicated. Through the analysis of a large number of real alarm incidents from multiple regulatory companies, the following rules are found:

[0057] 1. Individual security incidents account for the vast majority of all alarm events.

[0058] 2. Individual IPs account for the vast majority of all alarm IPs, and the number is increasing all the time.

[0059] 3. The number of some alarms per unit time remains almost unchanged.

[0060] 4. For some alarms, the number of alarms per unit time is different, but the number of alarms within a period of time is almost the same.

[0061] The first two points indicate that false alarm events have a certain trend, and the last two points indicate that the number of false alarm events conforms to a certain periodic law. Therefore, it is reasonable to assume that false alarm events have certain regular behaviors, such as satisfying a certain trend or periodic law. Therefore, this application proposes a new false alarm removal method.

[0062] According to an embodiment of the present invention, an embodiment of a method for removing false alarms of network security alarm events is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0063] In this embodiment, a method for removing false positives of network security alarm events is provided, which can be used in a system or program for removing false positives. Figure 1 is a flow chart of a false alarm removal method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0064] Step S101, obtaining false alarm events, a preset autocorrelation coefficient threshold, a trend false alarm processing interval, and a period false alarm processing interval.

[0065] In a specific embodiment, the false alarm event may be a security event that is a false alarm collected by the system; the preset autocorrelation coefficient threshold may be a standard value for determining whether a periodic event sequence is an attack sequence; the trend false alarm processing interval may be a time interval for setting a false alarm event as a trend event sequence; the periodic false alarm processing interval may be a time interval for setting a false alarm event as a periodic event sequence;

[0066] Specifically, when false alarm removal is required, false alarm security events existing in security events, i.e., false alarm events, are statistically obtained. Specifically, each false alarm event is stored when it is uploaded to the system. Furthermore, the target user sets a preset autocorrelation coefficient threshold, a trend false alarm processing interval, and a periodic false alarm processing interval based on actual user needs. Optionally, the preset autocorrelation coefficient can be set based on the actual experience of the target user, and the trend false alarm processing interval and the periodic false alarm processing interval can be set by the target user based on the observation results of false alarm events.

[0067] Step S102, based on the trend false alarm processing interval, clustering statistics are performed on the false alarm events to obtain multiple trend event sequences.

[0068] In a specific embodiment, the multiple trend event sequences may be event sequences with trends; specifically, based on the trend false alarm processing interval, the false alarm events are segmented and clustered, that is, the false alarm events within each trend false alarm processing interval are counted as multiple trend event sequences.

[0069] Step S103, based on the periodic false alarm processing interval, multiple trend event sequences are reorganized to obtain multiple periodic event sequences.

[0070] In a specific embodiment, the multiple periodic event sequences may be event sequences with periodicity; specifically, the multiple trend event sequences obtained above are re-dispersed, and the sequences are reorganized based on the periodic false alarm processing interval, that is, the false alarm events within each periodic false alarm processing interval are counted as multiple periodic sequence events.

[0071] Step S104, calculating the autocorrelation coefficients of the multiple periodic event sequences, and comparing the autocorrelation coefficients with a preset autocorrelation coefficient threshold to determine multiple target periodic event sequences.

[0072] In a specific embodiment, the autocorrelation coefficient may be the autocorrelation coefficient between sequences corresponding to multiple periodic event sequences; specifically, when multiple periodic event sequences are obtained, the autocorrelation coefficients corresponding to the multiple periodic event sequences are calculated, and then the calculated autocorrelation coefficient is compared with a stored preset autocorrelation coefficient threshold to determine the target periodic event sequence.

[0073] Step S105 , converting the multiple target periodic event sequences into time-frequency domains to obtain target periodic values, and removing target periodic event sequences whose target periodic values ​​are not 0.

[0074] In a specific embodiment, the target periodic value can be a value that indicates periodicity of a periodic event sequence among multiple periodic event sequences; specifically, multiple target periodic event sequences are converted from time domain to frequency domain, and then after the conversion is completed, the target periodic value is calculated, and further, it is identified and determined whether the target periodic value is 0, and the periodic event sequences whose target periodic values ​​are not 0 are regarded as target periodic event sequences that need to be removed, and the target periodic events that need to be removed are removed.

[0075] In an optional embodiment, before step S101, the method further includes:

[0076] Step a1, obtaining a preset event format;

[0077] Step a2, performing formatting processing based on the preset event format and the false alarm event to obtain a format false alarm event;

[0078] Step a3: Based on the trend false alarm processing interval, cluster statistics are performed on the format false alarm events to obtain multiple interval event sequences.

[0079] In a specific embodiment, the preset event format can be an event format that can be recognized by the system or program; the trend false alarm processing interval can be the time interval at which the false alarm event is divided into a trend event sequence; specifically, the formats of security event data such as alarms, logs, and audits generated by different security products are not unified, and they need to be formatted and processed uniformly. In order to reduce the storage volume, the alarm false alarm events generated by various security events are formatted, that is, based on the preset event format, the false alarm events are formatted, and accordingly, the false alarm events are formatted to obtain formatted false alarm events; specifically, the formatted false alarm events correspond to the preset event format and mainly include the following attributes: source address information (source_ip), destination address (dest_ip), source port number (source_port), destination port (dest_port), protocol (app_protocol), event time (event_time), event name (event_name), event number (event_id), device type (device_type). These false alarm events can be mapped to the original event by the event number. The format of the formatted false alarm event is shown in Table 1 below:

[0080] Table 1

[0081] Field Chinese name Field English name Field Type Source IP source_ip ip Destination IP dest_ip ip Source port number source_port Numeric Types Destination Port dest_port Numeric Types protocol app_protocol Text Type Event time event_time Time Type Event Name event_name Text Type Event Number event_id Text Type Device Type device_type Text Type

[0082] Further, after the false alarm events are formatted accordingly based on the preset event format, the formatted false alarm events are clustered and counted based on the trend false alarm event interval. Optionally, the trend false alarm event interval can be set according to actual conditions.

[0083] In an optional embodiment, the above step S102 includes:

[0084] Step S1021, obtaining address information and type information corresponding to the false alarm event;

[0085] Step S1022, based on the trend false alarm processing interval, the address information and the type information, clustering statistics are performed on the false alarm events to obtain multiple interval event sequences;

[0086] Step S1023, when the number of events corresponding to the multiple interval event sequences is the same, performing a first-order difference on each interval event sequence to obtain the multiple trend event sequences.

[0087] In a specific embodiment, the address information may be the address of each false alarm event obtained, and optionally, the address information includes address information such as an IP address; the type information may be event type information of each false alarm event obtained, and optionally, the type information may include type information such as an operation false alarm;

[0088] Specifically, when obtaining the false alarm event, the address information and type information corresponding to the false alarm event are also obtained. Further, the false alarm event is clustered and counted based on the trend false alarm processing interval, the address information and the type information. Specifically, the false alarm events in each trend false alarm processing interval are clustered and counted according to the address information and the type information to obtain multiple interval event sequences. Optionally, after statistical grouping, the original false alarm event sequence corresponding to each address information and type information is Ai (i=1, 2, 3, 4, 5...), and the interval event sequence obtained after aggregation in each trend false alarm processing interval is Xi (i=1, 2, 3, 4, 5...); further, it is determined whether the number of events corresponding to the multiple interval event sequences is the same. Accordingly, when the number of events corresponding to the multiple interval event sequences is the same, a first-order difference calculation is performed on each interval event sequence. Specifically, the interval event sequence value at time T corresponding to the trend false alarm processing interval is X T， Then the sequence after the first-order difference can be expressed as: X' T =X T -X T-1 (1) After calculating the first-order difference of each interval event sequence, multiple trend event sequences are obtained.

[0089] In an optional embodiment, the above step S103 includes:

[0090] Step S1031, obtaining the period arrangement order;

[0091] Step S1032: based on the periodic false alarm processing interval, the period arrangement order and the address information, the plurality of trend event sequences are reorganized to obtain the plurality of periodic event sequences.

[0092] In a specific embodiment, the period arrangement order may be an arrangement order of a period event sequence for a preset false alarm event. Optionally, the period arrangement order may be an arrangement order according to an ATT&CK attack chain. Specifically, based on each period false alarm processing interval, multiple trend event sequences are separated. Further, based on the period arrangement order and address information, the separated multiple trend event sequences are reorganized, and accordingly, multiple period event sequences are obtained.

[0093] In an optional embodiment, the above step S104 includes:

[0094] Step b1, obtaining the number of lagged sequences;

[0095] Step b2, determining a plurality of lagged periodic event sequences among the plurality of periodic event sequences based on the lagged sequence number;

[0096] Step b3, based on the coefficient calculation formula, calculate the autocorrelation coefficients of the multiple lag period event sequences, and determine the autocorrelation coefficient corresponding to each lag period event sequence.

[0097] In a specific embodiment, the lag sequence number may be a preset lag number for screening periodic event sequences. Optionally, the lag sequence number includes 1, 2, 3...12. Specifically, based on the lag sequence number, multiple lag periodic event sequences are screened out from multiple periodic event sequences. Further, a coefficient calculation formula for the autocorrelation coefficient is obtained. Specifically, the coefficient calculation formula may be: Bring multiple lag period sequences into the formula, and then calculate the autocorrelation coefficient corresponding to each lag period event sequence. Optionally, the coefficient calculation formula E(Y t ) represents the expected value of the event sequence of the current period, E(Y t+h ) represents the expected value of a periodic event sequence with a lag sequence number of h, ρ h Represents the autocorrelation coefficient.

[0098] In an optional embodiment, the above step S104 further includes:

[0099] Step c1, comparing the autocorrelation coefficient with the preset autocorrelation coefficient threshold to obtain a coefficient comparison result;

[0100] Step c2: determining the periodic event sequences among the multiple periodic event sequences whose autocorrelation coefficients are greater than the preset autocorrelation coefficient threshold value as the multiple target periodic event sequences according to the coefficient comparison result.

[0101] In a specific embodiment, the preset autocorrelation coefficient threshold can be a standard comparison value of the autocorrelation coefficient; specifically, the autocorrelation coefficient calculated above is compared with the preset autocorrelation coefficient threshold, and optionally, each calculated autocorrelation coefficient is compared with the preset autocorrelation coefficient threshold respectively, and a coefficient comparison result is obtained accordingly. Furthermore, when the coefficient comparison result indicates that the periodic event sequences in the multiple periodic event sequences have autocorrelation coefficients greater than the preset autocorrelation coefficient threshold, they are determined as multiple target periodic event sequences.

[0102] In an optional embodiment, the above step S105 includes:

[0103] Step S1051, performing Fourier processing on the multiple target periodic event sequences to obtain multiple frequency values;

[0104] Step S1052, sorting the multiple frequency values ​​to determine a target frequency value;

[0105] Step S1053, determining the target period value based on the target frequency value and the period calculation formula.

[0106] In a specific embodiment, multiple periodic event sequences are subjected to fast Fourier transform to convert the timing diagram into a frequency diagram. Specifically, the fast Fourier formula is: Wherein xi represents the number of false alarm events corresponding to each periodic event processing interval. Accordingly, multiple target periodic event sequences are converted from time domain to frequency domain based on the fast Fourier formula, as shown in the figure. Furthermore, the multiple frequency values ​​obtained by calculation are sorted in size, and accordingly, the sorting result is obtained. Furthermore, the maximum frequency value in the sorting is determined as the target frequency value. Furthermore, the target frequency value is introduced into the period calculation formula to calculate and determine the target period value. Optionally, the period calculation formula is p=1 / f, wherein p is the target period value and f is the target frequency value.

[0107] Furthermore, if the target period value is not 0 and it is significant, then it can be determined that the multiple target period sequences have a certain periodicity, and then the target period sequences with the target period value not 0 are removed.

[0108] The false alarm removal method provided by the embodiment of the present invention obtains false alarm events, preset autocorrelation coefficient thresholds, trend false alarm processing intervals and periodic false alarm processing intervals, and based on the trend false alarm processing intervals, performs cluster statistics on the false alarm events to obtain multiple trend event sequences; based on the periodic false alarm processing intervals, multiple trend event sequences are sequenced to obtain multiple periodic event sequences; the accuracy of determining multiple periodic event sequences is improved; then the autocorrelation coefficients of the multiple periodic event sequences are calculated, and the autocorrelation coefficients are compared with the preset autocorrelation coefficient threshold to determine the target periodic event sequence, thereby improving the rigor and accuracy of determining the target periodic event sequence; further, multiple target periodic event sequences are converted into time-frequency domains to obtain target period values, and target periodic event sequences with non-zero target period values ​​are removed. Through the time-frequency domain conversion, the accuracy of determining the target period value is improved, thereby improving the accuracy of false alarm removal. In the present application, multiple sequence cluster statistics are performed in combination with the time-frequency domain conversion to improve the simplicity and wide applicability of false alarm removal.

[0109] In this embodiment, a false alarm removal device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0110] This embodiment provides a false alarm removal device, such as Figure 2 As shown, including:

[0111] An acquisition module 201 is used to acquire false alarm events, a preset autocorrelation coefficient threshold, a trend false alarm processing interval, and a periodic false alarm processing interval;

[0112] A statistics module 202, configured to perform cluster statistics on the false alarm events based on the trend false alarm processing interval to obtain a plurality of trend event sequences;

[0113] A reorganization module 203 is used to reorganize the plurality of trend event sequences based on the periodic false alarm processing interval to obtain a plurality of periodic event sequences;

[0114] A calculation module 204, configured to calculate the autocorrelation coefficients of the plurality of periodic event sequences, and compare the autocorrelation coefficients with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences;

[0115] The removal module 205 is used to perform time-frequency domain conversion on the multiple target periodic event sequences to obtain target periodic values, and remove the target periodic event sequences whose target periodic values ​​are not 0.

[0116] In an optional embodiment, the statistical module 202 includes:

[0117] An information acquisition unit, used to acquire address information and type information corresponding to the false alarm event;

[0118] An interval statistics unit, configured to perform cluster statistics on the false alarm events based on the trend false alarm processing interval, the address information and the type information, to obtain a plurality of interval event sequences;

[0119] The trend determination unit is used to perform first-order difference on each interval event sequence when the number of events corresponding to the multiple interval event sequences is the same, so as to obtain the multiple trend event sequences.

[0120] In an optional embodiment, the above-mentioned reorganization module 203 includes:

[0121] A periodic order acquisition unit, used to acquire the periodic arrangement order;

[0122] A periodic reorganization unit is used to reorganize the multiple trend event sequences based on the periodic false alarm processing interval, the period arrangement order and the address information to obtain the multiple periodic event sequences.

[0123] In some optional implementations, the calculation module 204 includes:

[0124] A lag acquisition unit, used to acquire the lag sequence number;

[0125] a hysteresis determination unit, configured to determine a plurality of hysteresis periodic event sequences among the plurality of periodic event sequences based on the hysteresis sequence number;

[0126] The coefficient calculation unit is used to calculate the autocorrelation coefficients of the multiple lag period event sequences based on the coefficient calculation formula, and determine the autocorrelation coefficient corresponding to each lag period event sequence.

[0127] In some optional implementations, the calculation module 204 further includes:

[0128] A coefficient comparison unit, used for comparing the autocorrelation coefficient with the preset autocorrelation coefficient threshold to obtain a coefficient comparison result;

[0129] The coefficient greater than unit is used to determine the periodic event sequences whose autocorrelation coefficients among the multiple periodic event sequences indicated by the coefficient comparison result are greater than the preset autocorrelation coefficient threshold as the multiple target periodic event sequences.

[0130] In some optional implementations, the removal module 205 includes:

[0131] A Fourier processing unit, configured to perform Fourier processing on the plurality of target periodic event sequences to obtain a plurality of frequency values;

[0132] A sorting unit, used for sorting the multiple frequency values ​​to determine a target frequency value;

[0133] The period calculation unit is used to determine the target period value based on the target frequency value and the period calculation formula.

[0134] In some optional embodiments, the device further comprises:

[0135] A format acquisition unit, used to acquire a preset event format;

[0136] A format processing unit, used for performing formatting processing based on the preset event format and the false alarm event to obtain a format false alarm event;

[0137] A trend statistics unit is used to perform cluster statistics on the format false alarm events based on the trend false alarm processing interval to obtain multiple interval event sequences.

[0138] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0139] The false alarm removal device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0140] The embodiment of the present invention also provides a computer device having the above Figure 2 The false alarm removal device shown.

[0141] See also Figure 3 , Figure 3 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 3 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 3 A processor 10 is taken as an example.

[0142] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0143] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0144] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0145] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0146] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0147] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0148] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0149] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0150] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for removing false positives of network security alarm events, characterized in that: The method comprises: Obtain false alarm events, preset autocorrelation coefficient threshold, trend false alarm processing interval and period false alarm processing interval; Based on the trend false alarm processing interval, clustering statistics are performed on the false alarm events to obtain multiple trend event sequences; Based on the periodic false alarm processing interval, the plurality of trend event sequences are reorganized to obtain a plurality of periodic event sequences; Calculating the autocorrelation coefficients of the plurality of periodic event sequences, and comparing the autocorrelation coefficients with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences; The multiple target periodic event sequences are converted into time-frequency domain to obtain target periodic values, and the target periodic event sequences whose target periodic values ​​are not 0 are removed.

2. The method according to claim 1, characterized in that The false alarm events are clustered and counted based on the trend false alarm processing interval to obtain multiple trend event sequences, including: Obtaining address information and type information corresponding to the false alarm event; Based on the trend false alarm processing interval, the address information and the type information, clustering statistics are performed on the false alarm events to obtain multiple interval event sequences; When the number of events corresponding to the multiple interval event sequences is the same, a first-order difference is performed on each interval event sequence to obtain the multiple trend event sequences.

3. The method according to claim 2, characterized in that The step of reorganizing the plurality of trend event sequences based on the periodic false alarm processing interval to obtain a plurality of periodic event sequences includes: Get the order of period arrangement; Based on the periodic false alarm processing interval, the period arrangement order and the address information, the multiple trend event sequences are reorganized to obtain the multiple periodic event sequences.

4. The method according to claim 1, characterized in that: The step of calculating the autocorrelation coefficients of the plurality of periodic event sequences comprises: Get the number of lagged series; Based on the number of lagged sequences, determining a plurality of lagged periodic event sequences among the plurality of periodic event sequences; Based on the coefficient calculation formula, the autocorrelation coefficients of the multiple lag period event sequences are calculated, and the autocorrelation coefficient corresponding to each lag period event sequence is determined.

5. The method according to claim 1, characterized in that The step of comparing the autocorrelation coefficient with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences includes: Comparing the autocorrelation coefficient with the preset autocorrelation coefficient threshold to obtain a coefficient comparison result; The coefficient comparison result indicates that the periodic event sequences among the multiple periodic event sequences whose autocorrelation coefficients are greater than the preset autocorrelation coefficient threshold are determined as the multiple target periodic event sequences.

6. The method according to claim 1, characterized in that The step of converting the multiple target period event sequences into time-frequency domains to determine the target period value includes: Performing Fourier processing on the plurality of target periodic event sequences to obtain a plurality of frequency values; Sorting the multiple frequency values ​​to determine a target frequency value; The target period value is determined based on the target frequency value and a period calculation formula.

7. The method according to claim 1, characterized in that Before clustering and counting the false alarm events based on the trend false alarm processing interval to obtain a plurality of interval event sequences, the method further includes: Get the preset event format; Based on the preset event format and the false alarm event, formatting processing is performed to obtain a formatted false alarm event; Based on the trend false alarm processing interval, cluster statistics are performed on the format false alarm events to obtain multiple interval event sequences.

8. A network security alarm event false alarm removal device, characterized in that: The device comprises: An acquisition module, used for acquiring false alarm events, preset autocorrelation coefficient threshold, trend false alarm processing interval and period false alarm processing interval; A statistical module, used for performing cluster statistics on the false alarm events based on the trend false alarm processing interval to obtain multiple trend event sequences; A reorganization module, used for reorganizing the plurality of trend event sequences based on the periodic false alarm processing interval to obtain a plurality of periodic event sequences; A calculation module, used for calculating the autocorrelation coefficients of the plurality of periodic event sequences, and comparing the autocorrelation coefficients with a preset autocorrelation coefficient threshold to determine a plurality of target periodic event sequences; The removal module is used to perform time-frequency domain conversion on the multiple target periodic event sequences to obtain target periodic values, and remove the target periodic event sequences whose target periodic values ​​are not 0.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for removing false alarms of network security alarm events according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for removing false positives of network security alarm events according to any one of claims 1 to 7.

Images