A method for generating a security alert whitelist and related apparatus

Abstract

The application provides a method for generating a security alarm whitelist and related devices, which comprises: obtaining first alarm information marked as a false alarm; searching for a target alarm whitelist matching the first alarm information from an alarm whitelist set; in response to not finding a target alarm whitelist matching the first alarm information, obtaining a first alarm whitelist based on the first alarm information described in natural language; optimizing the first alarm whitelist by using a first language model to obtain an optimized alarm whitelist; and adding the optimized alarm whitelist to the alarm whitelist set. This method supports directly describing an alarm whitelist in natural language, reduces the technical threshold for generating an alarm whitelist in a security protection product (such as a CWPP, HIDS, or CSPM), can cover multiple fields and scenarios, and improves the applicability of the alarm whitelist.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device, computer-readable storage medium, and computer program product for generating a security alert whitelist. Background Art

[0002] With the continuous development of computer technology, security protection products for security testing have emerged. Security protection products can test computing devices such as computers and hosts, or virtual operating environments such as containers, thereby ensuring operational security.

[0003] Typically, security products support configuring an alarm whitelist, which can be used to identify and exclude unimportant alarms. This means that if an alarm matches a whitelisted item, it will not trigger an alarm event.

[0004] In related technologies, users (such as security operators) typically configure regular expression-based alarm whitelists based on specific scenarios. However, generating such alarm whitelists requires certain technical expertise and is only applicable to specific scenarios, resulting in limited applicability. Summary of the Invention

[0005] This application provides a method for generating a security alert whitelist. This method can lower the technical threshold for generating an alert whitelist and improve the applicability of the alert whitelist. This application also provides a device, electronic device, computer-readable storage medium, and computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides a method for generating a security alert whitelist, the method comprising:

[0007] Obtaining the first alarm information marked as a false alarm;

[0008] Searching the target alarm whitelist that matches the first alarm information from the alarm whitelist set;

[0009] In response to not finding a target alarm whitelist matching the first alarm information, obtaining a first alarm whitelist described in a natural language and based on the first alarm information;

[0010] Optimizing the first alarm whitelist using the first language model to obtain an optimized alarm whitelist;

[0011] Add the optimized alarm whitelist to the alarm whitelist set.

[0012] In a second aspect, the present application provides a device for generating a security alert whitelist, the device comprising:

[0013] An acquisition module, configured to acquire first alarm information marked as a false alarm;

[0014] A search module, configured to search a target alarm whitelist that matches the first alarm information from the alarm whitelist set;

[0015] a generating module configured to, in response to failing to find a target alarm whitelist matching the first alarm information, obtain a first alarm whitelist described in a natural language and based on the first alarm information;

[0016] an optimization module, configured to optimize the first alarm whitelist using a first language model to obtain an optimized alarm whitelist;

[0017] An adding module is used to add the optimized alarm whitelist to the alarm whitelist set.

[0018] In a third aspect, the present application provides an electronic device, comprising a processor and a memory. The processor and the memory communicate with each other. The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method for generating a security alert whitelist as described in the first aspect or any implementation of the first aspect.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and the instructions instruct the electronic device to execute the method for generating a security alert whitelist described in the above-mentioned first aspect or any implementation of the first aspect.

[0020] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the method for generating a security alert whitelist as described in the first aspect or any one of the implementations of the first aspect.

[0021] Based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods.

[0022] It can be seen from the above technical solutions that this application has the following advantages:

[0023] The present application provides a method for generating a security alarm whitelist. The method first obtains first alarm information marked as a false alarm, then searches for a target alarm whitelist that matches the first alarm information from an alarm whitelist set, and in response to not finding a target alarm whitelist that matches the first alarm information, obtains a first alarm whitelist based on the first alarm information and described in a natural language, optimizes the first alarm whitelist using a first language model, obtains an optimized alarm whitelist, and adds the optimized alarm whitelist to the alarm whitelist set.

[0024] In this method, when a false alarm first alarm fails to match any existing alarm whitelist, the whitelist matching the first alarm can be directly described in natural language. This eliminates the need for regular expression techniques, lowering the technical barrier to generating a whitelist, improving operational efficiency and making it easier to understand and maintain. Furthermore, a whitelist described in natural language can cover multiple fields and scenarios, enhancing its applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical methods of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments.

[0026] Figure 1 A flowchart of a method for generating a security alert whitelist provided in an embodiment of the present application;

[0027] Figure 2 A flowchart of a method for generating a security alert whitelist provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of the structure of a device for generating a security alarm whitelist provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The terms "first" and "second" in the embodiments of this application are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, features specified as "first" or "second" may explicitly or implicitly include one or more of the features.

[0031] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0032] With the continuous advancement of computer technology, security protection products have emerged to conduct security checks and ensure the operational security of computing devices such as computers and hosts, or virtual operating environments such as containers. Security protection products can perform multifaceted security checks across a variety of operational scenarios. For example, a cloud workload protection platform (CWPP) can perform checks on both host and network security. Another example is a host-based intrusion detection system (HIDS), which can perform security checks on the behavior and state of computer systems. Another example is cloud security posture management (CSPM), which can assess and manage cloud security risks and identify configuration errors and security vulnerabilities in cloud environments.

[0033] In security protection products, false alarms are unavoidable. Efficient and accurate filtering of false alarms can improve the stability and security of the system. Generally, security protection products support the configuration of alarm whitelists. Alarm whitelists, also known as security alarm whitelists, can be used to identify and exclude unimportant alarms. Specifically, the alarm whitelist includes alarms that are configured as not requiring any action. When the generated alarm information matches the alarm whitelist, the alarm information will be ignored and will not trigger an alarm event. The above process can also be called "whitelisting the alarm information," and the alarm information can also be called "whitelisted alarm information." In this way, by configuring the alarm whitelist, it is ensured that the focus of security protection is placed on important alarm information, thereby improving the efficiency of security operations and maintenance.

[0034] In the related art, the alarm whitelist is usually manually compiled by users (such as security operators). Specifically, the user uses regular expressions to compile static rules for adding white alarm information according to specific scenarios to form an alarm whitelist.

[0035] However, this approach has the following issues: First, regular expression-based alert whitelists present a certain technical barrier to entry, are difficult to read, and their complex syntax increases the cost of managing and maintaining them. Furthermore, static rules are typically designed for specific scenarios, making them difficult to adapt to the needs of multiple fields and scenarios, and unable to dynamically adapt to environmental changes, resulting in a limited scope of application.

[0036] In view of this, the present application provides a method for generating a security alarm whitelist, which first obtains a first alarm information marked as a false alarm, then searches for a target alarm whitelist that matches the first alarm information from an alarm whitelist set, and in response to not finding a target alarm whitelist that matches the first alarm information, obtains a first alarm whitelist based on the first alarm information described in natural language, optimizes the first alarm whitelist using a first language model, obtains an optimized alarm whitelist, and adds the optimized alarm whitelist to the alarm whitelist set.

[0037] In this method, when a false alarm first alarm fails to match any existing alarm whitelist, the whitelist matching the first alarm can be directly described in natural language. This eliminates the need for regular expression techniques, lowering the technical barrier to generating a whitelist, improving operational efficiency and making it easier to understand and maintain. Furthermore, a whitelist described in natural language can cover multiple fields and scenarios, enhancing its applicability.

[0038] To facilitate understanding of the technical solutions provided in the embodiments of the present application, the following description will be made with reference to the accompanying drawings. Figure 1 The flowchart of a method for generating an alarm whitelist is shown, and the method specifically includes:

[0039] S101: Acquire first alarm information marked as a false alarm.

[0040] The first alarm information can be understood as any alarm information received by the security protection product. With respect to the first alarm information, a user (e.g., a security operator) or the security protection product can determine whether it is a false alarm and generate an alarm tag associated with the first alarm information. In an embodiment of the present application, the alarm tag associated with the first alarm information indicates that the first alarm information is a false alarm, i.e., the first alarm information is not a true alarm.

[0041] In an embodiment of the present application, the first alarm information may be composed of multiple alarm fields. For example, the first alarm information may include a command line field, a parent process command line field, a process group command line field, a process tree information field, a runtime link field, an execution directory field, etc.

[0042] S102: Searching for a target alarm whitelist that matches the first alarm information from the alarm whitelist set.

[0043] The alarm whitelist set stores multiple existing alarm whitelists. In other words, the alarm whitelist set can be understood as a set for storing existing alarm whitelists in the security protection product. The target alarm whitelist can be understood as an alarm whitelist in the alarm whitelist set that can whitelist the first alarm information.

[0044] The following combination Figure 2 For a detailed description of the matching process between the first alarm information and the alarm whitelist set, see Figure 2 The flowchart of a method for generating a security alarm whitelist is shown. In some possible implementation methods, the target alarm whitelist is searched by "first recalling a set of candidate alarm whitelists, and then matching from the set of candidate alarm whitelists". In this way, the alarm whitelist set is preliminarily filtered, and then accurate matching is performed to improve matching efficiency and matching accuracy.

[0045] The candidate whitelist set stores a candidate whitelist, which can be understood as a whitelist used to match the first alarm message. That is, based on the first alarm message, the whitelist set is screened and dynamically retrieved from candidate whitelists that are similar to the first alarm message to form a candidate whitelist set. This candidate whitelist set is then used to perform a deep match against the first alarm message.

[0046] In some embodiments, the alarm whitelist set can be a vector library. In this case, the embedded vector related to the key alarm field in the first alarm information is determined, and the embedded vector of each alarm whitelist in the alarm whitelist set is determined. The similarity between the embedded vector related to the key alarm field and the embedded vector of each alarm whitelist in the alarm whitelist set is determined. Then, the alarm whitelist in the alarm whitelist set with a similarity greater than a similarity threshold is determined as the alarm whitelist in the candidate alarm whitelist set, and the target alarm whitelist matching the first alarm information is searched from the candidate alarm whitelist set.

[0047] Among them, the key alarm field can be understood as an alarm field that can be used to represent the characteristics of the first alarm information. For example, the key alarm field can be a rule field that triggers the first alarm information, a summary field of the first alarm information, etc.

[0048] The embodiments of the present application do not limit the method for determining the embedding vector associated with the key alarm field and the embedding vector of each alarm whitelist in the alarm whitelist set. For example, the field value of the key alarm field in the first alarm information and the each alarm whitelist in the alarm whitelist set can be processed using word embedding technology to obtain the embedding vector associated with the key alarm field and the embedding vector of each alarm whitelist in the alarm whitelist set. For another example, the field value of the key alarm field in the first alarm information and the each alarm whitelist in the alarm whitelist set can be processed using a vector model to obtain the embedding vector associated with the key alarm field and the embedding vector of each alarm whitelist in the alarm whitelist set.

[0049] The embodiments of the present application do not limit the method for determining the similarity between the embedding vector associated with the key alarm field and the embedding vector of each alarm whitelist in the alarm whitelist set. For example, the cosine similarity between the embedding vector associated with the key alarm field and the embedding vector of each alarm whitelist in the alarm whitelist set can be calculated.

[0050] By configuring different similarity thresholds and based on different recall rules, candidate alarm whitelists with high similarity to the first alarm information are dynamically recalled from the alarm whitelist set, thereby forming a candidate alarm whitelist set and completing the recall of the candidate alarm whitelist set.

[0051] In this way, by determining the embedding vector and calculating the similarity to recall the candidate alarm whitelist set, the generalization and matching efficiency are improved, and at the same time, different security protection products can be flexibly adapted.

[0052] S103: In response to not finding a target alarm whitelist matching the first alarm information, obtaining a first alarm whitelist based on the first alarm information and described in a natural language.

[0053] The fact that no target alarm whitelist matching the first alarm information is found indicates that there is no alarm whitelist in the alarm whitelist that can whitelist the first alarm information.

[0054] In the embodiment of the present application, failure to find a target alarm whitelist matching the first alarm information can be divided into two situations, which are described below respectively:

[0055] Case 1: Not recalled from the alarm whitelist set to the candidate alarm whitelist set.

[0056] Specifically, in response to the candidate alarm whitelist set being empty, a first alarm whitelist described in natural language and based on the first alarm information is obtained.

[0057] In other words, there is no alarm whitelist similar to the first alarm information in the alarm whitelist set, for example, there is no alarm whitelist with a similarity greater than a similarity threshold. In this case, the first alarm information cannot be matched with the alarm whitelist in the alarm whitelist set.

[0058] Case 2: The candidate alarm whitelist in the candidate alarm whitelist set cannot match the first alarm information.

[0059] Specifically, in response to the candidate whitelist set including at least one second alarm whitelist, the first alarm information is matched based on the at least one second alarm whitelist using a second language model to obtain a third matching result. In response to the third matching result indicating that the first alarm information does not match each alarm whitelist in the at least one second alarm whitelist, a first alarm whitelist based on the first alarm information described in natural language is obtained.

[0060] In other words, in the alarm whitelist set, there is an alarm whitelist (i.e., the second alarm whitelist) that is similar to the first alarm information, but after matching the first alarm information with the second alarm whitelist, the first alarm information does not meet the whitelisting conditions of the second alarm whitelist, and the first alarm information does not match the second alarm whitelist. In this case, the first alarm information cannot be matched with the alarm whitelist in the alarm whitelist set.

[0061] In an embodiment of the present application, a second language model is used to match the first alarm information with at least one second alarm whitelist. The second language model can be understood as a language model used to match the first alarm information with the second alarm whitelist. The second language model can be a language model with natural language processing capabilities, capable of understanding natural language meaning and handling different types of natural language tasks. For example, the second language model can be a deep learning model trained using text data.

[0062] In some possible implementations, the second language model matches the first alert information with the second alert whitelist based on prompt learning. Prompts can be used to guide the language model to specific outputs in generative tasks (e.g., text generation, question-answering, and conversational tasks). By configuring prompts, the language model understands the context and requirements of the task, enabling it to handle different types of natural language processing tasks without retraining the language model, thereby increasing its scalability and flexibility.

[0063] In a specific implementation, in response to the candidate whitelist set including at least one second warning whitelist, a second prompt word is generated, the second prompt word is sent to the second language model, and a third matching result returned by the second language model is received.

[0064] The second prompt word includes: a key alarm field in the first alarm information, at least one second alarm whitelist, and information for indicating whether the key alarm field in the first alarm information matches the at least one second alarm whitelist.

[0065] In some embodiments, the key alarm fields in the first alarm information may include an alarm field representing command line parameters, an alarm field representing command line parameters of the parent process, an alarm field representing a process group, an alarm field representing the operation that generates the alarm information, etc.

[0066] By configuring the above information in the second prompt word, the second language model can compare the alarm content of the first alarm information with each second alarm whitelist one by one based on the prompt capability of the second prompt word, determine whether the alarm content of the first alarm information meets the whitelisting logic of the second alarm whitelist, and determine the third matching result.

[0067] By using the second language model to match the first alarm information with the second alarm whitelist, and leveraging the natural language processing capabilities of the second language model, we can understand the complex whitelisting logic of the second alarm and the different scenarios and fields involved in the first alarm information, making the third matching result more accurate.

[0068] Furthermore, in response to the third matching result indicating that the first alarm information matches a target alarm whitelist in at least one second alarm whitelist, whitelisting is performed on the first alarm information.

[0069] That is to say, when there is a target alarm whitelist in the candidate alarm whitelist set that matches the first alarm information, it indicates that the target alarm whitelist is found in the alarm whitelist set and matches the first alarm information. The security protection product marks the first alarm information as whitelisted, thereby reducing subsequent false alarm interference and improving the operating efficiency of the security protection product.

[0070] Understandably, the alarm whitelist in a security product should whitelist false alarms to reduce false alarms. If the existing alarm whitelist in the security product is unable to whitelist the first alarm, but the first alarm is a false alarm, this indicates a need for a new alarm whitelist, and a new alarm whitelist should be added to whitelist the first alarm.

[0071] In this embodiment of the present application, support is provided for adding a first alarm whitelist for matching the first alarm information by inputting natural language. In other words, the first alarm whitelist is described in natural language, representing the natural language content, by describing the whitelist logic or matching rules associated with the first alarm information. This eliminates the need to write a regular expression-based alarm whitelist, facilitates rapid expansion of the alarm whitelist, and reduces the complexity of alarm whitelist generation.

[0072] The embodiment of the present application does not limit the method for obtaining the first alarm whitelist described in natural language. For example, the first alarm whitelist can be input by a user (for example, a security operator). In this way, the user does not need to learn complex regular expression syntax. He or she can conveniently add a new alarm whitelist by simply describing the whitelisting scenario and whitelisting logic in natural language. For another example, the first alarm whitelist can also be automatically generated by a model (such as a language model) that has the ability to analyze alarm information. That is, the first alarm information is analyzed by a model that has the ability to analyze alarm information, and the first alarm whitelist described in natural language for matching the first alarm information is automatically output, thereby improving the automation level of security protection products.

[0073] S104: Optimize the first alarm whitelist using the first language model to obtain an optimized alarm whitelist.

[0074] Considering that the accuracy of the first alarm whitelist described in natural language may be weak, the first alarm whitelist is optimized with the help of the first language model, so that the optimized alarm whitelist is improved in terms of logic and fluency.

[0075] In some possible implementations, the first language model optimizes the first warning whitelist based on prompt learning, specifically, generating a first prompt word, sending the first prompt word to the first language model, and receiving an optimized warning whitelist returned by the first language model.

[0076] The first prompt word includes the first alarm whitelist and rule logic for instructing to extract the first alarm whitelist, and information for optimizing the first alarm whitelist based on the rule logic.

[0077] By configuring the above information in the first prompt word, the first language model can extract the core rule logic (such as whitelisting logic, matching rules, etc.) in the first alarm whitelist based on the prompt capability of the first prompt word. While ensuring that the core rule logic remains unchanged, the natural language expression of the first alarm whitelist is optimized to improve the readability and logic of the first alarm whitelist, and generate an optimized alarm whitelist.

[0078] For example, the optimized alarm whitelist can be: "Determine whether the access IP is from the internal network segment and the accessed file does not belong to the sensitive directory. When the access IP is from the internal network segment and the accessed file does not belong to the sensitive directory, add it to the whitelist", "If the downloaded file is from an educational website and the size is less than 1GB, add it to the whitelist", "Ignore login alarms outside working hours, except on weekdays", "Ignore all alarms for accessing well-known websites".

[0079] In this way, with the help of the natural language processing capabilities of the first language model, the first alarm whitelist is automatically and quickly optimized to improve the accuracy of the first alarm whitelist, so that the first alarm whitelist can be adapted to alarm whitelisting in different fields, different scenarios, and different security protection products.

[0080] Furthermore, in order to ensure that the optimized first alarm whitelist has a good matching effect, in the embodiment of the present application, the optimized first alarm whitelist can also be verified. Figure 2 As shown, the optimized alarm whitelist is matched with the first alarm information to obtain a first matching result, and the second alarm information that is similar to the first alarm information and marked as a non-false alarm (i.e., a real alarm) is obtained, and the optimized alarm whitelist is matched with the second alarm information to obtain a second matching result.

[0081] The second warning information can be obtained from a historical risk warning database, which stores warning information marked as non-false positives. Specifically, the similarity between the first warning information and the warning information in the historical risk warning database is calculated, and the warning information whose similarity meets a set condition (for example, the similarity is greater than a second similarity threshold) is determined as the second warning information.

[0082] In other words, the optimized alarm whitelist is verified in two aspects: First, since the first alarm whitelist is used to match the first alarm information, the optimized alarm whitelist is verified to be able to match the first alarm information, that is, whether the optimized alarm whitelist can whitelist the first alarm information to obtain the first matching result. Second, since the first alarm whitelist should not whitelist real alarms, the optimized alarm whitelist is verified to be able to match the second alarm information that is similar to the first alarm information and marked as a real alarm, that is, whether the optimized alarm whitelist can whitelist the second alarm information to obtain the second matching result.

[0083] In this way, it is verified whether the optimized alarm whitelist can correctly match the alarm information, and whether there are any mistaken additions to the optimized alarm whitelist. The optimized alarm whitelist is verified from two aspects to ensure that the rule logic of the optimized alarm whitelist is unambiguous, and can accurately match the alarm information that should be added to the whitelist, and at the same time, real alarms will not be mistakenly added to the whitelist.

[0084] Furthermore, in response to the first matching result indicating that the optimized alarm whitelist does not match the first alarm information, or the second matching result indicating that the optimized alarm whitelist matches the second alarm information, a prompt message is sent, wherein the prompt message is used to indicate that the optimized alarm whitelist has failed verification.

[0085] That is, if the optimized alarm whitelist cannot add the first alarm information, or if the optimized alarm whitelist can add the second alarm information, it indicates that the optimized alarm whitelist has failed verification and needs to be revised. In this case, a prompt message is displayed so that the first alarm whitelist can be modified in time.

[0086] In some embodiments, the prompt message may also include optimization suggestions, such as modification suggestions generated by combining historical alarm information, the first matching result, and the second matching result, to assist in quickly improving the alarm whitelist.

[0087] For example, the optimized alarm whitelist is "When the alarm argv contains fields such as curl / wget, determine whether the command line downloads data from a well-known platform. If so, whitelist it." The prompt message is "After querying the historical risk alarm information, alarm_id:xxxx argv:wget www.ABCD.com / xxxx exists. After verification, the alarm whitelist matches the historical risk alarm information and needs to be re-entered. Modification suggestion: Attackers often remotely implant code through code repositories such as ABCD. It is recommended to remove ABCD from well-known platforms." In this way, the optimized alarm whitelist is modified according to the modification suggestions in the prompt message to obtain the final alarm whitelist "When the alarm information argv contains the curl / wget field, determine whether the command line downloads data from a well-known platform that cannot be a code / mirror repository. If so, whitelist it."

[0088] S105: Add the optimized alarm whitelist to the alarm whitelist set.

[0089] By storing the optimized alarm whitelist in the alarm whitelist collection, the number of alarm whitelists in the alarm whitelist collection is enriched, and the whitelisting capability of security protection products is improved.

[0090] In some embodiments, the optimized alarm whitelist is verified. In this case, in response to the first matching result indicating that the optimized alarm whitelist matches the first alarm information, and the second matching result indicating that the optimized alarm whitelist does not match the second alarm information, the optimized alarm whitelist is added to the alarm whitelist set.

[0091] That is to say, when the optimized alarm whitelist can whitelist the first alarm information, and the optimized alarm whitelist does not whitelist the second alarm information, it indicates that the optimized alarm whitelist has passed the verification, ensuring that the alarm whitelists in the alarm whitelist set are all verified high-quality alarm whitelists.

[0092] In some possible implementations, the alarm whitelist set exists in the form of a vector library. In this case, the embedding vector corresponding to the optimized alarm whitelist is determined, and the embedding vector corresponding to the optimized alarm whitelist is added to the alarm whitelist set.

[0093] In other words, the alarm whitelist set stores a natural language alarm whitelist represented in the form of an embedded vector. In this way, the alarm whitelist set can be flexibly adapted to different security protection products and improve its scope of application.

[0094] Furthermore, the alarm whitelist set can be updated iteratively. For example, based on one or more of the following: newly whitelisted alarms, real alarms, and user feedback, the alarm whitelist in the alarm whitelist set can be updated. This allows for continuous iterative optimization to improve the accuracy, generalizability, and adaptability of the alarm whitelist to new alarm scenarios.

[0095] In this method, when a false alarm first alarm fails to match any existing alarm whitelist, the whitelist matching the first alarm can be directly described in natural language. This eliminates the need for regular expression techniques, lowering the technical barrier to generating a whitelist, improving operational efficiency and making it easier to understand and maintain. Furthermore, a whitelist described in natural language can cover multiple fields and scenarios, enhancing its applicability.

[0096] Combined with the above Figure 1 and Figure 2 The method for generating the security alarm whitelist provided in the embodiment of the present application is introduced in detail. The apparatus and device provided in the embodiment of the present application will be introduced below in conjunction with the accompanying drawings.

[0097] See also Figure 3 The schematic diagram of the structure of the device for generating a security alarm whitelist is shown, and the device 30 includes:

[0098] An acquisition module 301 is configured to acquire first alarm information marked as a false alarm;

[0099] A search module 302 is configured to search a target alarm whitelist that matches the first alarm information from the alarm whitelist set;

[0100] A generating module 303 is configured to obtain, in response to not finding a target alarm whitelist matching the first alarm information, a first alarm whitelist described in a natural language and based on the first alarm information;

[0101] An optimization module 304 is configured to optimize the first alarm whitelist using a first language model to obtain an optimized alarm whitelist;

[0102] The adding module 305 is configured to add the optimized alarm whitelist to the alarm whitelist set.

[0103] In some possible implementations, the optimization module 304 is specifically configured to:

[0104] Generate a first prompt word; wherein the first prompt word includes the first alarm whitelist and rule logic for indicating extraction of the first alarm whitelist, and information for optimizing the first alarm whitelist based on the rule logic;

[0105] The first prompt word is sent to a first language model, and an optimized alarm whitelist returned by the first language model is received.

[0106] In some possible implementations, the apparatus 30 further includes a verification module, wherein the verification module is configured to:

[0107] Matching the optimized alarm whitelist with the first alarm information to obtain a first matching result; and

[0108] Obtaining second alarm information that is similar to the first alarm information and marked as a non-false alarm, and matching the optimized alarm whitelist with the second alarm information to obtain a second matching result;

[0109] The adding module 305 is specifically used for:

[0110] In response to the first matching result indicating that the optimized alarm whitelist matches the first alarm information, and the second matching result indicating that the optimized alarm whitelist does not match the second alarm information, the optimized alarm whitelist is added to the alarm whitelist set.

[0111] In some possible implementations, the apparatus 30 further includes a prompt module, which is configured to:

[0112] In response to the first matching result indicating that the optimized alarm whitelist does not match the first alarm information, or the second matching result indicating that the optimized alarm whitelist matches the second alarm information, a prompt message is sent; wherein, the prompt message is used to prompt that the optimized alarm whitelist has failed verification.

[0113] In some possible implementations, the adding module 305 is specifically configured to:

[0114] Determining an embedding vector corresponding to the optimized alarm whitelist;

[0115] The embedding vector corresponding to the optimized alarm whitelist is added to the alarm whitelist set.

[0116] In some possible implementations, the search module 302 is specifically configured to:

[0117] Determining an embedding vector associated with a key alarm field in the first alarm information, and determining an embedding vector for each alarm whitelist in the alarm whitelist set;

[0118] Determining similarities between the embedding vector associated with the key alarm field and the embedding vectors of each alarm whitelist in the alarm whitelist set;

[0119] Determining the alarm whitelists in the alarm whitelist set whose similarity is greater than the similarity threshold as the alarm whitelists in the candidate alarm whitelist set;

[0120] Search the candidate alarm whitelist set for a target alarm whitelist that matches the first alarm information.

[0121] In some possible implementations, the generating module 303 is specifically configured to:

[0122] In response to the candidate alarm whitelist set being empty, obtaining a first alarm whitelist described in natural language and based on the first alarm information; or

[0123] In response to the candidate whitelist set including at least one second alarm whitelist, the first alarm information is matched based on the at least one second alarm whitelist using a second language model to obtain a third matching result; in response to the third matching result indicating that the first alarm information does not match each alarm whitelist in the at least one second alarm whitelist, a first alarm whitelist based on the first alarm information and described in natural language is obtained.

[0124] In some possible implementations, the apparatus 30 further includes a whitening module, and the whitening module is configured to:

[0125] In response to the third matching result indicating that the first alarm information matches the target alarm whitelist in the at least one second alarm whitelist, whitelisting is performed on the first alarm information.

[0126] In some possible implementations, the verification module is specifically configured to:

[0127] In response to the candidate whitelist set including at least one second alarm whitelist, generating a second prompt word; wherein the second prompt word includes: a key alarm field in the first alarm information, the at least one second alarm whitelist, and information indicating whether the key alarm field in the first alarm information matches the at least one second alarm whitelist;

[0128] The second prompt word is sent to a second language model, and a third matching result returned by the second language model is received.

[0129] The device 30 for generating the security alert whitelist according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the device 30 for generating the security alert whitelist are respectively to realize Figure 1 For the sake of brevity, the corresponding processes of the various methods in the illustrated embodiments are not described again here.

[0130] The embodiment of the present application also provides an electronic device. The electronic device is specifically used to implement Figure 3 The functions of the security warning whitelist generating device 30 in the illustrated embodiment.

[0131] Figure 4 A structural diagram of an electronic device 400 is provided. Figure 4 As shown, electronic device 400 includes bus 401, processor 402, communication interface 403 and memory 404. Processor 402, memory 404 and communication interface 403 communicate with each other via bus 401.

[0132] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0133] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0134] The communication interface 403 is used for communicating with the outside, for example, the communication interface 403 can be used for communicating with a terminal.

[0135] The memory 404 may include volatile memory, such as random access memory (RAM), or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0136] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the aforementioned method for generating the security warning whitelist.

[0137] Specifically, in the implementation Figure 3 In the case of the embodiment shown, and Figure 3 In the embodiment, when each module or unit of the security warning whitelist generation device 30 is implemented by software, the execution Figure 3 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the aforementioned method for generating the security alarm whitelist.

[0138] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the security alarm whitelist generation method applied to the security alarm whitelist generation device 30.

[0139] The present application also provides a computer program product comprising one or more computer instructions that, when loaded and executed on a computing device, fully or partially generate the process or function described in the present application.

[0140] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0141] When the computer program product is executed by a computer, the computer performs any of the aforementioned methods for generating a security alert whitelist. The computer program product may be a software installation package. When any of the aforementioned methods for generating a security alert whitelist is required, the computer program product may be downloaded and executed on the computer.

[0142] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to the various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the prescribed logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the prescribed function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0143] The units involved in the embodiments described in this application may be implemented in software or hardware, wherein the name of a unit / module does not, in some cases, constitute a limitation on the unit itself.

[0144] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0145] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0146] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems or devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0147] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0148] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0149] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0150] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating a security warning whitelist, characterized in that: The method comprises: Obtaining the first alarm information marked as a false alarm; Searching the target alarm whitelist that matches the first alarm information from the alarm whitelist set; In response to not finding a target alarm whitelist matching the first alarm information, obtaining a first alarm whitelist described in a natural language and based on the first alarm information; Optimizing the first alarm whitelist using the first language model to obtain an optimized alarm whitelist; Add the optimized alarm whitelist to the alarm whitelist set, The optimizing the first alarm whitelist by using the first language model to obtain the optimized alarm whitelist includes: Generate a first prompt word; wherein the first prompt word includes the first alarm whitelist and rule logic for indicating extraction of the first alarm whitelist, and information for optimizing the first alarm whitelist based on the rule logic; The first prompt word is sent to a first language model, and an optimized alarm whitelist returned by the first language model is received.

2. The method according to claim 1, characterized in that After optimizing the first alarm whitelist by using the first language model to obtain an optimized alarm whitelist, the method further includes: Matching the optimized alarm whitelist with the first alarm information to obtain a first matching result; and Obtaining second alarm information that is similar to the first alarm information and marked as a non-false alarm, and matching the optimized alarm whitelist with the second alarm information to obtain a second matching result; Adding the optimized alarm whitelist to the alarm whitelist set includes: In response to the first matching result indicating that the optimized alarm whitelist matches the first alarm information, and the second matching result indicating that the optimized alarm whitelist does not match the second alarm information, the optimized alarm whitelist is added to the alarm whitelist set.

3. The method according to claim 2, characterized in that The method further comprises: In response to the first matching result indicating that the optimized alarm whitelist does not match the first alarm information, or the second matching result indicating that the optimized alarm whitelist matches the second alarm information, a prompt message is sent; wherein, the prompt message is used to prompt that the optimized alarm whitelist has failed verification.

4. The method according to claim 1, wherein Adding the optimized alarm whitelist to the alarm whitelist set includes: Determining an embedding vector corresponding to the optimized alarm whitelist; The embedding vector corresponding to the optimized alarm whitelist is added to the alarm whitelist set.

5. The method according to any one of claims 1 to 4, characterized in that The searching, from the alarm whitelist set, for a target alarm whitelist that matches the first alarm information includes: Determining an embedding vector associated with a key alarm field in the first alarm information, and determining an embedding vector for each alarm whitelist in the alarm whitelist set; Determining similarities between the embedding vector associated with the key alarm field and the embedding vectors of each alarm whitelist in the alarm whitelist set; Determining the alarm whitelists in the alarm whitelist set whose similarity is greater than the similarity threshold as the alarm whitelists in the candidate alarm whitelist set; Search the candidate alarm whitelist set for a target alarm whitelist that matches the first alarm information.

6. The method according to claim 5, characterized in that In response to failing to find a target alarm whitelist matching the first alarm information, obtaining a first alarm whitelist described in a natural language and based on the first alarm information includes: In response to the candidate alarm whitelist set being empty, obtaining a first alarm whitelist described in natural language and based on the first alarm information; or In response to the candidate whitelist set including at least one second alarm whitelist, the first alarm information is matched based on the at least one second alarm whitelist using a second language model to obtain a third matching result; in response to the third matching result indicating that the first alarm information does not match each alarm whitelist in the at least one second alarm whitelist, a first alarm whitelist based on the first alarm information and described in natural language is obtained.

7. The method according to claim 6, characterized in that The method further comprises: In response to the third matching result indicating that the first alarm information matches the target alarm whitelist in the at least one second alarm whitelist, whitelisting is performed on the first alarm information.

8. The method according to claim 6, characterized in that In response to the candidate whitelist set including at least one second alarm whitelist, matching the first alarm information based on the at least one second alarm whitelist using a second language model to obtain a third matching result includes: In response to the candidate whitelist set including at least one second alarm whitelist, generating a second prompt word; wherein the second prompt word includes: a key alarm field in the first alarm information, the at least one second alarm whitelist, and information indicating whether the key alarm field in the first alarm information matches the at least one second alarm whitelist; The second prompt word is sent to a second language model, and a third matching result returned by the second language model is received.

9. A device for generating a security warning whitelist, characterized in that: The device comprises: An acquisition module, configured to acquire first alarm information marked as a false alarm; A search module, configured to search a target alarm whitelist that matches the first alarm information from the alarm whitelist set; a generating module configured to, in response to failing to find a target alarm whitelist matching the first alarm information, obtain a first alarm whitelist described in a natural language and based on the first alarm information; an optimization module, configured to optimize the first alarm whitelist using a first language model to obtain an optimized alarm whitelist; An adding module, configured to add the optimized alarm whitelist to the alarm whitelist set, The optimizing the first alarm whitelist by using the first language model to obtain the optimized alarm whitelist includes: Generate a first prompt word; wherein the first prompt word includes the first alarm whitelist and rule logic for indicating extraction of the first alarm whitelist, and information for optimizing the first alarm whitelist based on the rule logic; The first prompt word is sent to a first language model, and an optimized alarm whitelist returned by the first language model is received.

10. An electronic device, characterized in that: The electronic device includes a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The method comprises instructions for instructing an electronic device to execute the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises computer-readable instructions for implementing the method according to any one of claims 1 to 8.

Images