Alarm information merging method and device, computer storage medium and electronic equipment

Abstract

The invention discloses an alarm information merging method and device, a computer storage medium and electronic equipment, and relates to the technical field of computers, and the method comprises the steps: obtaining an association analysis rule comprising a target merging strategy; obtaining security data, obtaining a plurality of pieces of alarm information based on the association analysis rule according to the security data, and obtaining a merging key value corresponding to each piece of alarm information based on the target merging strategy; and according to the merging key value corresponding to each piece of alarm information, merging at least two pieces of target alarm information in the plurality of pieces of alarm information to obtain merged alarm information. By adopting the method, when the alarm information is managed, the number of the alarm information is reduced, and the alarm information management efficiency of a user is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an alarm information merging method, device, computer storage medium and electronic device. Background Art

[0002] At present, large-scale security analysis systems access extremely large amounts of network traffic and other security data every day. These data are correlated and analyzed in real time, generating tens of thousands or even millions of alarm messages every day.

[0003] There are many problems in the existing alarm information management: responding to these alarm messages will cause serious losses to the company's financial resources, human resources and time costs; there is no shortage of false alarms in the alarm information, and these extremely destructive interferences make it difficult for enterprise security personnel to filter out some important alarm information from the massive amount of alarm information; because of fatigue from the alarm information noise, enterprise security personnel will ignore or fail to detect real threats, which is not good for enterprise security. Summary of the invention

[0004] The embodiments of the present application provide an alarm information merging method, device, computer storage medium and electronic device, which can merge alarm information with high similarity after generating alarm information, reduce the number of alarms, and improve the user's management efficiency of alarm information.

[0005] In a first aspect, an embodiment of the present application provides a method for merging alarm information, the method comprising:

[0006] Obtaining association analysis rules including a target merging strategy;

[0007] Acquire security data, obtain multiple alarm information based on the security data and the association analysis rule, and obtain a merge key value corresponding to each alarm information based on the target merging strategy;

[0008] At least two target warning information among the multiple warning information are merged according to the merge key value corresponding to each of the warning information to obtain merged warning information; wherein the number of merged warning information corresponding to the multiple warning information is at least one.

[0009] In a second aspect, an embodiment of the present application provides an alarm information merging device, the device comprising:

[0010] An acquisition module, used for acquiring association analysis rules including a target merging strategy;

[0011] A processing module, used for acquiring security data, obtaining a plurality of alarm information based on the security data and the association analysis rule, and obtaining a merge key value corresponding to each of the alarm information based on the target merge strategy;

[0012] A merging module is used to merge at least two target warning information among the multiple warning information according to the merging key value corresponding to each of the warning information to obtain merged warning information; wherein the number of merged warning information corresponding to the multiple warning information is at least one.

[0013] In a third aspect, an embodiment of the present application provides a computer storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method steps provided in the first aspect of the embodiment of the present application.

[0014] In a fourth aspect, an embodiment of the present application provides an electronic device, characterized in that it includes: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps provided in the first aspect of the embodiment of the present application.

[0015] The beneficial effects brought about by the technical solutions provided by some embodiments of the present application include at least:

[0016] In an embodiment of the present application, after receiving a huge amount of security data, multiple alarm information is obtained based on the security data based on the association analysis rule, and the merge key value corresponding to each alarm information is obtained according to the target merge strategy in the association analysis rule, and at least two alarm information that need to be merged in the multiple alarm information are determined by the merge key value, and the determined at least two alarm information are further merged to obtain the merged alarm information, so that the multiple alarm information is merged into at least one merged alarm information. For example, at least two alarm information whose merge key value is higher than the preset threshold are merged to obtain the merged alarm information. In other words, when the present application processes a large amount of security data into multiple alarm information, the multiple alarm information is further merged into at least one merged alarm information. Compared with the technical means of directly sending multiple alarm information to the relevant terminals for threat alarm, the alarm merging method proposed in the present application can effectively reduce the number of alarm information during the management of alarm information, improve the management efficiency of alarm information, and reduce the interference of a large amount of repeated alarm information to the user, thereby avoiding the user from being fatigued by a large amount of repeated alarm information and ignoring important alarm information. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 is a schematic diagram of multiple alarm information provided by an embodiment of the present application;

[0019] Figure 2 It is a flowchart of a method for merging alarm information provided by an embodiment of the present application;

[0020] Figure 3 This is a schematic diagram of a reference merging strategy provided in an embodiment of the present application;

[0021] Figure 4 is a schematic diagram corresponding to fields in an alarm message provided in an embodiment of the present application;

[0022] Figure 5 It is a flowchart of a method for merging alarm information provided by an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of merging alarm information provided by an embodiment of the present application;

[0024] Figure 7 It is a structural diagram of an alarm information merging device provided in an embodiment of the present application;

[0025] Figure 8 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0027] In the description of the present application, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood in specific circumstances. In addition, in the description of the present application, unless otherwise specified, "multiple" and "at least two" refer to two or more. "At least one" refers to one or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the front and back associated objects are an "or" relationship.

[0028] The present application is described in detail below with reference to specific embodiments.

[0029] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the security data and security analysis rules involved in this specification are all obtained with full authorization.

[0030] Figure 1 A schematic diagram of multiple alarm information in an embodiment of the present application is given as an example. Figure 1 5 warning messages are shown in FIG. 1 . The number of warning messages in the embodiment of the present application is not limited. Figure 1 As shown, Figure 1 is a schematic diagram of multiple alarm information provided by an embodiment of the present application, Figure 1 The alarm information includes multiple alarm information, including at least alarm information 110, alarm information 120, alarm information 130, alarm information 140, and alarm information 150. It can be understood that Figure 1 The number of warning information shown is for illustration only and is not limited in this specification.

[0031] Alarm information is generated by correlation analysis of security data. Alarm information reflects some problems or abnormal situations in the correlation analysis. Users can find these problems or abnormal situations in time through alarm information and immediately implement necessary responses. The above security data is data accessed through the security analysis system, including logs of various devices and systems, alarm reports, and traffic logs. Among them, the security analysis system is an intelligent computing and analysis platform that connects security devices, aggregates security data, and accumulates security knowledge. When real-time correlation analysis of security data is performed, a large amount of alarm information will be generated. Correlation analysis is the process of discovering the implicit relationships and rules between data objects from large-scale data.

[0032] like Figure 1 As shown, the alarm information includes fields such as host ip host_ip, alarm name alarm_name, alarm information content alarm_content, source address src_address, and values ​​x1, x2, x3, x4, etc. corresponding to each field. Specifically, the value x1 corresponding to the field host ip host_ip of the alarm information 110, the value x2 corresponding to the field alarm name alarm_name of the alarm information 110, the value x3 corresponding to the field alarm information content alarm_content of the alarm information 110, and the value x4 corresponding to the field source address src_address of the alarm information 110. The structures of other alarm information such as alarm information 120 and alarm information 130 are as shown in the above alarm information 110, and will not be repeated here.

[0033] It is understandable that there are some cases where the values ​​corresponding to the fields in the alarm information are the same, and the values ​​corresponding to the fields in the alarm information can be a single value or an array type.

[0034] Since the amount of security data is generally large, the alarm information generated based on the security data also has a large amount of data. Responding to these alarm information will cause serious loss of financial resources, human resources and time costs for enterprises. In addition, there are many duplicate alarm information in these alarm information, making it difficult for users to filter out the truly important alarm information, which is not good for security. Therefore, this application proposes a method for merging alarm information in order to solve some or all of the above problems.

[0035] In one embodiment, Figure 2 As shown, it is a flowchart of a method for merging alarm information proposed in this application, which can be implemented by a computer program and can be run on an alarm information merging device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0036] Specifically, the warning information merging method includes:

[0037] S101: Acquire association analysis rules including a target merging strategy.

[0038] In this embodiment, the target merge policy includes at least a merge condition and a policy name. The merge condition can be understood as a basis for judging whether the similarity between alarm information is high. For example, the merge condition is a preset field, and the preset field is the host ip host_ip, the alarm name alarm_name, the source address src_address, etc. The merge condition can also be a combination of multiple preset fields in the above preset fields, which are not listed here. The merge condition can also include a preset reference character, which is used to match the preset field in the above merge condition. The preset reference character indicates that the content corresponding to the field in the alarm information is to be extracted, and the preset reference character can be $. The policy name can be understood as the identification information of the target merge policy, and the security analysis scenario targeted by the target merge policy can be quickly known according to the policy name. For example, the policy name can be the default terminal alarm merge rule.

[0039] In this embodiment, the association analysis rule can be understood as the rule to be followed in the operation and execution of the association analysis, which is used to set the specific steps and related parameters of the association analysis. It can be freely set according to the security analysis scenario and is not listed here.

[0040] In one embodiment, the method for obtaining an association analysis rule including a target merging strategy includes receiving multiple merging strategies from a user terminal. The multiple merging strategies include the target merging strategy. The user terminal is a terminal device for receiving user input instructions, and the terminal device can also display processing results.

[0041] Specifically, multiple merge policies are received from a user terminal, and the merge policies at least include a merge condition and a policy name. In one embodiment, the method for obtaining multiple merge policies can be to receive multiple merge policies sent by a user through a user terminal. Specifically, the user can set multiple merge policies in the user terminal according to different security analysis scenarios, and further receive multiple merge policies sent by the user through the user terminal.

[0042] In another embodiment, a method for obtaining an association analysis rule including a target merge strategy may be to receive a user instruction for a target merge strategy among multiple merge strategies, select a target merge strategy from the multiple merge strategies in response to the user instruction, and further obtain an association analysis rule including the target merge strategy based on the target merge strategy.

[0043] Specifically, if Figure 3 As shown, Figure 3This is a reference merge strategy diagram provided by an embodiment of the present application. After receiving multiple merge strategies from a user terminal, the multiple merge strategies can be displayed on the user terminal. The user can quickly learn the specific scenarios of security analysis targeted by each merge strategy based on the display information of each merge strategy, and then select the target merge strategy. After the user selects the target merge strategy from the multiple merge strategies, a user instruction for the target merge strategy in the multiple merge strategies is received, and in response to the user instruction, an association analysis rule including the target merge strategy is obtained according to the target merge strategy.

[0044] In this embodiment, by defining the merge strategy according to the specific security analysis scenario, the flexibility of defining the target merge strategy is guaranteed. By referencing different merge strategies in different association analysis rules, the flexibility of referencing the target merge strategy is guaranteed, which can improve the adaptability of the target merge strategy to the current security analysis scenario.

[0045] S102: Acquire security data, obtain multiple alarm information based on association analysis rules according to the security data, and obtain a merge key value corresponding to each alarm information based on a target merge strategy.

[0046] In this embodiment, the merge key value corresponding to each alarm message includes part of the content in each alarm message, which can be understood as the characteristic identifier of the alarm message. Figure 1 The alarm information 1 shown in the figure, the merged key value can be x1 (the value corresponding to the host IP host_ip), x2 (the value corresponding to the alarm name alarm_name), x3 (the value corresponding to the alarm information content alarm_content), x4 (source address src_address), etc. It can also be a combination of multiple values ​​​​of the above values, which are not listed here.

[0047] In one embodiment, a method for obtaining security data, obtaining multiple alarm messages based on association analysis rules according to the security data, and obtaining a merge key value corresponding to each alarm message based on a target merge strategy is as follows: obtaining security data, obtaining multiple alarm messages based on association analysis rules according to the security data, and extracting target content in each alarm message based on a target merge strategy to obtain a merge key value corresponding to each alarm message.

[0048] Specifically, according to the target merge strategy, the target content in each alarm information is extracted to obtain the merge key value corresponding to each alarm information. In one embodiment, the value corresponding to the corresponding field in each alarm information is extracted according to the preset field in the merge condition in the target merge strategy, and the extracted value is the merge key value corresponding to each alarm information. For example, Figure 1For the multiple merged alarm information shown, if the preset fields included in the merge conditions in the target merge strategy are host ip host_ip and alarm name alarm_name, then the merge key value of the alarm information is the value corresponding to the field host ip host_ip and the field alarm name alarm_name, that is, the merge key value corresponding to alarm information 1 is x1x2, the merge key value corresponding to alarm information 2 is x1x2, and the merge key value corresponding to alarm information 3 is x1x7, and so on to obtain the merge key values ​​of other alarm information.

[0049] In this embodiment, the merge key value corresponding to each alarm information is obtained through the target merge strategy. The merge key value has less content and can effectively identify each alarm information, thereby improving the efficiency of confirming the similarity between each alarm information and having higher accuracy.

[0050] S103: Merge at least two target alarm information in the multiple alarm information according to the merging key value corresponding to each alarm information to obtain merged alarm information.

[0051] According to the merging key value corresponding to each warning information, at least two target warning information for merging are confirmed in multiple warning information, and the confirmed at least two target warning information are merged to obtain the merged warning information. Figure 1 As shown, Figure 1 5 alarm information are shown in FIG. 1 , and the merged key values ​​corresponding to the alarm information are: the merged key value corresponding to the alarm information 110 is x1x2, the merged key value corresponding to the alarm information 120 is x1x2, the merged key value corresponding to the alarm information 130 is x1x7, the merged key value corresponding to the alarm information 140 is x10x2, and the merged key value corresponding to the alarm information 150 is x13x14. According to the merged key values ​​corresponding to the above alarm information, at least two of the target alarm information are merged, that is, the alarm information 110 and the alarm information 120 are merged to obtain the merged alarm information.

[0052] In one embodiment, after the at least two target warning information are merged, a merged warning information is obtained. Furthermore, if there are other warning information in the multiple warning information, the merge key values ​​corresponding to the warning information are further merged in the other warning information to obtain other merged warning information. Therefore, the number of merged warning information corresponding to the multiple warning information is at least one.

[0053] Specifically, when merging at least two target warning information from the plurality of warning information, the contents of the target warning information are sequentially merged into the target merged warning information; wherein the at least one merged warning information includes the target merged warning information. Figure 4 As shown, Figure 4This is a schematic diagram of the correspondence of fields in an alarm message provided by an embodiment of the present application. The fields in the target alarm message 410 include at least the host ip host_ip, the alarm message content alarm_content, the destination address dst_address, etc., and the fields in the target merged alarm message 420 include at least the host ip, the alarm message content, the destination address, etc. There is a one-to-one correspondence between the fields in the target alarm message 410 and the fields in the target merged alarm message 420. For example, the field host ip host_ip in the target alarm message 410 corresponds to the field host ip in the target merged alarm message 420. The correspondence between other fields is similar to the above correspondence, which will not be repeated here. When the content of the target alarm message is merged into the target merged alarm message, the values ​​corresponding to the fields are merged according to the one-to-one correspondence between the fields.

[0054] In one embodiment, at least two target warning information in multiple warning information are merged according to the merge key value corresponding to each warning information, and the method for obtaining the merged warning information is: according to the merge key value corresponding to each warning information, at least two target warning information in multiple warning information are determined. Wherein, the similarity between the merge key values ​​corresponding to the at least two target warning information respectively reaches a preset threshold. At least two target warning information in multiple warning information are merged to obtain the merged warning information.

[0055] In this embodiment, the preset threshold is a specific value and does not exceed 100%, which can be understood as a basis for determining at least two target merging information. For example, the preset threshold is 100%, 99%, 98%, etc.

[0056] Specifically, at least two target alarm information for merging are determined from the multiple alarm information according to the similarity between the merge key values ​​corresponding to the alarm information. In one embodiment, according to the merge key values ​​corresponding to the alarm information, if at least two alarm information merge key values ​​are the same (the preset threshold is 100%), the at least two alarm information are determined to be target alarm information, and the target alarm information is merged to obtain merged alarm information.

[0057] In another embodiment, when the merge key value corresponding to the multiple alarm merge information is unique, that is, when the similarity between the merge key values ​​corresponding to at least two target alarm information in the multiple alarm information does not reach the preset threshold, there is no alarm information merging. For example, the target merging strategy includes a preset field number id, because the alarm information includes the field number id, and the value corresponding to the field number in the alarm information is unique, so the merge key value corresponding to each alarm information obtained according to the target merging strategy is also unique, so that each alarm information can be non-merged.

[0058] In this embodiment, at least two target alarm information with the same merge key value are merged by merging the merge key value, so that similar alarm information is effectively merged, the amount of alarm information is reduced, and the management efficiency of the alarm information by the user is improved.

[0059] In one embodiment, at least two target alarm information in multiple alarm information are merged according to the merge key value corresponding to each alarm information, and the method for obtaining the merged alarm information is: according to the merge key value and generation time corresponding to each alarm information, at least two target alarm information in multiple alarm information are merged to obtain the merged alarm information. The generation time includes year, month, day, hour, minute, and second, which can be understood as the time when the alarm information is generated. The generation time exists in the alarm information and is not listed here.

[0060] Specifically, the alarm information will continue to exist for a period of time from its generation to its termination. When real-time correlation analysis is performed on security data, a large amount of alarm information will be generated every day. If the merged alarm information is continuously merged into the alarm information, the merging process will continue. Therefore, control is added to the life cycle of the merged alarm information. In one embodiment, the merge key value and generation time of each alarm information are obtained, and at least two target alarm information in multiple alarm information are merged according to the merge key value and generation time corresponding to each alarm information to obtain the merged alarm information.

[0061] In this embodiment, a generation time restriction is added to the merging of alarm information, which further limits the life cycle of the merged alarm information and improves the management efficiency of the alarm information by the user.

[0062] In another embodiment, at least two target alarm information in multiple alarm information are merged according to the merge key value and generation time corresponding to each alarm information, and the method for obtaining the merged alarm information is: according to the merge key value and generation time corresponding to each alarm information, at least two target alarm information in multiple alarm information whose generation time is within the same preset time period are merged to obtain the merged alarm information. The preset time period can be set by the user, or it can be a time period automatically generated according to the system time.

[0063] For example, the preset time period is a natural day. Further, according to the merging key value and generation time corresponding to each alarm information, at least two target alarm information for merging are determined from the multiple alarm information, and the values ​​of year, month and day in the generation time of the at least two target alarm information are the same, and the merged alarm information is obtained.

[0064] In this embodiment, at least two target alarm information with generation time within the same natural day are merged through the merge key value and generation time corresponding to each alarm information to obtain merged alarm information, which effectively limits the generation time of the merged alarm information to the same natural day. The life cycle is thereby controlled, thereby improving the user's management efficiency of the alarm information.

[0065] In an embodiment of the present application, after receiving a huge amount of security data, multiple alarm information is obtained based on the security data based on the association analysis rule, and the merge key value corresponding to each alarm information is obtained according to the target merging strategy in the association analysis rule, and at least two alarm information with high similarity are determined in the multiple alarm information through the merge key value, and the determined at least two alarm information are merged to obtain the merged alarm information. In addition, different target merging strategies can be referenced according to different security analysis scenarios to obtain a merge key value that can effectively identify the alarm information, ensuring that at least two alarm information with high similarity are merged to obtain the merged alarm information. In other words, when the present application processes a large amount of security data into multiple alarm information, it further merges the multiple alarm information into at least one merged alarm information. Compared with the technical means of directly sending multiple alarm information to relevant terminals separately for threat alarm, the alarm merging method proposed in the present application can effectively reduce the number of alarm information during alarm information management, improve the management efficiency of alarm information, and reduce the interference of a large amount of repeated alarm information to users, thereby avoiding users from being fatigued by a large amount of repeated alarm information and ignoring important alarm information.

[0066] See also Figure 5 , Figure 5 A flowchart of a method for merging alarm information provided in an embodiment of the present application. The method can be implemented by a computer program and can be run on an alarm information merging device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0067] Specifically, the warning information merging method includes:

[0068] S201: Acquire association analysis rules including a target merging strategy.

[0069] Specifically, S201 is consistent with S101 and will not be described in detail here.

[0070] S202: Acquire security data, obtain multiple alarm information based on association analysis rules according to the security data, and obtain a merge key value corresponding to each alarm information based on a target merge strategy.

[0071] Specifically, S202 is consistent with S102 and will not be described in detail here.

[0072] S203. Determine at least two target alarm information from the multiple alarm information according to the merge key values ​​corresponding to the respective alarm information, wherein the target alarm information includes the target merge key value.

[0073] Specifically, according to the merge key value corresponding to each alarm information, at least two target alarm information are determined in the multiple alarm information, and the above target alarm information includes the target merge key value. Among them, the merge key value corresponding to each alarm information includes the target merge key value. For example, the target merge key value is x1x2, and according to the merge key value corresponding to each alarm information, the target alarm information with the merge key value x1x2 is determined in the multiple alarm information; wherein the number of target alarm information is at least two.

[0074] S204: Determine whether there is target merging alarm information corresponding to the target merging key value.

[0075] Specifically, according to the target merge key value included in at least two target alarm information among the multiple alarm information determined above, it is determined whether there is target merge alarm information corresponding to the target merge key value in the cache. Cache refers to a memory that can perform high-speed data exchange. It exchanges data with the CPU before the memory, so the rate is very fast. For example, the target merge key value included in the at least two target alarm information determined above among the multiple alarm information is x1x2.

[0076] Further, the merge key value of the merged alarm information is read in the cache to determine whether there is target merged alarm information corresponding to the target merge key value x1x2.

[0077] In this embodiment, by determining whether there is target merge alarm information corresponding to the target merge key value in the cache, the time for directly reading the memory is greatly saved, and there is basically no need to wait when reading data, thereby improving the efficiency of alarm information merging.

[0078] S205. When there is no target merged alarm information, obtain target merged alarm information according to at least two target alarm information.

[0079] Specifically, in the absence of target merged alarm information, at least two target alarm information corresponding to the target merge key value in the multiple alarm information are merged to obtain target merged alarm information; wherein, at least one merged alarm information includes target merged alarm information. For example, the target merge key value included in the above-mentioned at least two target alarm information is x1x2, and it is determined whether there is already a merged alarm information with a merge key value of x1x2. If the merge key value of the above-mentioned merged alarm information is x1x2, then there is no target merged alarm information corresponding to the target merge key value. Further, the above-mentioned at least two target alarm information are merged to obtain target merged alarm information.

[0080] In this embodiment, after determining that there is no target merge alarm information corresponding to the target merge key value, at least two target alarm information are merged, thereby preventing the occurrence of duplication of target merge alarm information.

[0081] In one embodiment, a method for merging at least two target warning information corresponding to a target merge key value in multiple warning information to obtain target merged warning information includes: obtaining first target merged warning information based on first target warning information; merging at least one second target warning information with the first target merged warning information in sequence to obtain target merged warning information; wherein, the at least two target warning information corresponding to the target merge key value include first target warning information and at least one second target warning information.

[0082] The first target warning information is the first target warning information confirmed to include the target merge key value among the at least two target warning information corresponding to the target merge key value. The target warning information confirmed to include the target merge key value after the first target warning information is confirmed is the second target warning information.

[0083] Specifically, the first target warning information and at least one second target warning information are sequentially merged to obtain target merged warning information. In one embodiment, the first target merged warning information is obtained according to the first target warning information, and the first target merged warning information is the same as the first target warning information. Further, at least one second target warning information is sequentially merged with the first target merged warning information to obtain target merged warning information. Figure 4 The field correspondence of the alarm information shown merges the values ​​corresponding to the fields in sequence.

[0084] In another embodiment, if the at least one second target warning information does not exist, that is, there is no warning information to be merged with the first target warning information. Further, the first target merged warning information is obtained according to the first target warning information, and the first target merged warning information is the above target merged warning information.

[0085] In this embodiment, by obtaining the first target merged alarm information according to the first target alarm information and then merging at least one second target alarm information into the first target merged alarm information, it is ensured that no duplicate alarm information can appear in the merged alarm information and important alarm information will not be missed.

[0086] In one embodiment, a method for obtaining first target merged alarm information based on first target alarm information includes: obtaining first content of the first target merged alarm information according to a target merging strategy; obtaining second content of the first target merged alarm information according to the first target alarm information; wherein the first content and the second content are different.

[0087] Specifically, the content of the first target combined alarm information is obtained from the first target alarm information. In one embodiment, the alarm number of the first target combined alarm information is set to 1, the first content is the name of the first target combined alarm information, and the second content is the end time, alarm level, threat credibility, source address, etc. of the first target combined alarm information. Figure 4 As shown, Figure 4 It is a corresponding schematic diagram of fields in an alarm information provided by an embodiment of the present application. The target alarm information 410 includes the first target alarm information, and the target merged alarm information 420 includes the first target merged alarm information. There is a one-to-one correspondence between the fields. For example, the field host ip host_ip in the target alarm information 410 corresponds to the field host ip in the target merged alarm information 420. The correspondence between other fields is similar to the above correspondence, which will not be repeated here. When the first target merged alarm information obtains the second content from the first target alarm information, the value corresponding to the field is obtained according to the one-to-one correspondence between the fields shown in the figure.

[0088] In one embodiment, the first content is obtained from the target merging strategy first, and if the target merging alarm information name is not set in the target merging strategy, the first content cannot be obtained. Further, the first content is the value corresponding to the alarm name alarm_name in the first target alarm information.

[0089] In this embodiment, by preferentially acquiring the first content from the target merging strategy, the user can freely set the name of the target merging alarm information, which facilitates the user to manage the merging alarm information.

[0090] S206: When target merged alarm information exists, update the target merged alarm information according to at least two target alarm information.

[0091] Specifically, in the case where the target merged alarm information exists, the target merged alarm information is updated according to at least two target alarm information corresponding to the target merged key value. For example, the target merged key value is x1x2, and there is target merged alarm information corresponding to the target merged key value x1x2, and the target merged alarm information is updated according to the at least two target alarm information. Further, the at least two target alarm information are sequentially merged into the target merged alarm information.

[0092] In this embodiment, after confirming that there is target merge alarm information corresponding to the target merge key value, the target merge alarm information is updated according to at least two target alarm information, thereby avoiding the situation where multiple target merge alarm information have the same target merge key value.

[0093] In one embodiment, a method for updating target merged alarm information according to at least two target alarm information corresponding to a target merge key value includes: updating third content of the target merged alarm information according to at least two target alarm information corresponding to the target merge key value.

[0094] Specifically, the third content is the value corresponding to some fields in the target merged alarm information. In one embodiment, the number of alarms in the target merged alarm information is increased by 1, and the value of the field corresponding to the field is updated as an array type field. This can be done by directly merging, such as Figure 6 As shown, Figure 6 is a schematic diagram of merging alarm information provided by an embodiment of the present application, Figure 6 The target merged alarm information 610, the target alarm information 620, and the target merged alarm information 630 are included. The alarm information includes field A and the value corresponding to the A field. The value corresponding to the A field is an array type. Specifically, the value corresponding to the A field of the target merged alarm information 610 is a1a2a3. The structures of the target alarm information 620 and the target merged alarm information 630 are as shown in the above-mentioned target merged alarm information 610, and are not repeated here. The value corresponding to the A field is updated, that is, the value a1a2a3 corresponding to the A field in the target merged alarm information 610 is added to the value b1b2b3 corresponding to the A field in the target alarm information 620, and the value a1a2a3b1b2b3 corresponding to the A field in the updated target merged alarm information 630 is obtained.

[0095] Furthermore, when updating the value of a field whose value is a single value type, a comparison strategy can be used for replacement and update. For example, but not limited to, when the target merged alarm information is to update the value corresponding to the field start time, the value corresponding to the field start time in the target merged alarm information and the value corresponding to the field start time in the target alarm information are obtained, and the above two values ​​are compared to take the smaller value. If the value corresponding to the field start time in the target merged alarm information is smaller, indicating that the target merged alarm information is generated earlier, then no update is required; if the value corresponding to the field start time in the target alarm information is smaller, indicating that the target alarm information is generated earlier, then the value corresponding to the field start time in the target merged alarm information is updated to the value corresponding to the field start time in the target alarm information. Similarly, the value corresponding to the field end time is updated to the value corresponding to the later end time according to the above comparison steps, and the value corresponding to the field alarm level and the value corresponding to the field threat credibility are updated to the larger value according to the above comparison steps, which will not be repeated here.

[0096] It should be noted that not all values ​​corresponding to the fields need to be updated. For fields of the target merged alarm information whose values ​​are single value types, if no comparison strategy is set for updating, the values ​​corresponding to the fields do not need to be updated, that is, the values ​​corresponding to the fields remain consistent with the values ​​corresponding to the fields of the first target alarm information corresponding to the target merged alarm information.

[0097] In this embodiment, by updating the values ​​corresponding to some fields in the target merged alarm information according to the target alarm information, the updating process of the values ​​corresponding to unnecessary fields is reduced, thereby improving the efficiency of alarm information merging.

[0098] S207: Store target merge alarm information.

[0099] Specifically, after the target merged alarm information is created or updated, the content in the target merged alarm information is correspondingly increased or modified, and the obtained target alarm information is stored. For example, the target merged alarm information is put into a cache. Further, the target merged alarm information is stored in a data storage module, and an association relationship between the target merged alarm information and at least two target alarm information is established, and the above association relationship is saved in the data storage module. Furthermore, when managing the merged alarm information, the target alarm information corresponding to the merged alarm information can be found through the above association relationship.

[0100] In this embodiment, by putting the target merged alarm information into the cache, the search efficiency of the target merged alarm information is improved, and the efficiency of merging the alarm information is also improved; the association between the target merged alarm information and at least two target alarm information is saved in the data storage module, which can improve the user's management efficiency of the merged alarm information.

[0101] In an embodiment of the present application, after receiving a huge amount of security data, multiple alarm messages are obtained based on the security data based on the association analysis rules, and at the same time, the merge key value corresponding to each alarm message is obtained according to the target merge strategy in the association analysis rule, and at least two alarm messages with high similarity are determined in the multiple alarm messages through the merge key value, and the determined at least two alarm messages are merged to obtain the merged alarm message. In other words, when the present application processes a large amount of security data into multiple alarm messages, it further merges the multiple alarm messages into at least one merged alarm message. Compared with the technical means of directly sending multiple alarm messages to relevant terminals separately for threat alarms, the alarm merging method proposed in the present application can effectively reduce the number of alarm messages during alarm information management, improve the management efficiency of alarm information, and reduce the interference of a large amount of repeated alarm messages to users, thereby avoiding users from being fatigued by a large amount of repeated alarm messages and ignoring important alarm messages. In addition, the present application establishes an association relationship between the merged alarm information and the alarm information, and saves the association relationship to the data storage module. When managing the merged alarm information, the alarm information can be found through the association relationship, further improving the user's management efficiency of the alarm information and effectively helping users screen important alarm information.

[0102] Figure 7 The schematic diagram of the structure of a warning information merging device provided by an embodiment of the present application is exemplarily shown. The warning information merging device can be implemented as all or part of the device through software, hardware or a combination of both. Figure 7 As shown, the alarm information merging device 70 may include: an acquisition module 701, a processing module 702 and a merging module 703. Among them:

[0103] The acquisition module 701 is used to acquire the association analysis rules including the target merging strategy.

[0104] The processing module 702 is used to obtain security data, obtain multiple alarm information based on the security data based on the association analysis rule, and obtain a merge key value corresponding to each alarm information based on the target merging strategy.

[0105] The merging module 703 is used to merge at least two target alarm information in the multiple alarm information according to the merging key value corresponding to each of the alarm information to obtain merged alarm information; wherein the number of merged alarm information corresponding to the multiple alarm information is at least one.

[0106] In some possible embodiments, the merging module 703 includes:

[0107] A confirmation unit is used to determine at least two target alarm information among the multiple alarm information according to the merge key value corresponding to each of the alarm information; wherein the similarity between the merge key values ​​corresponding to the at least two target alarm information respectively reaches a preset threshold.

[0108] The first merging unit is used to merge the at least two target warning information to obtain merged warning information.

[0109] In some possible embodiments, the merging module 703 includes:

[0110] The second merging unit is used to merge at least two target alarm information in the multiple alarm information according to the merging key value and the generation time corresponding to each of the alarm information to obtain the merged alarm information.

[0111] In some possible embodiments, the second merging unit includes:

[0112] The second merging subunit is used to merge at least two target alarm information whose generation times are within the same preset time period among the multiple alarm information according to the merging key value and generation time corresponding to each of the alarm information to obtain merged alarm information.

[0113] In some possible embodiments, the merging module 703 includes:

[0114] The judgment unit is used to judge whether there is already a target merge alarm information corresponding to the target merge key value; wherein the merge key value corresponding to each of the alarm information includes the target merge key value.

[0115] The third merging unit is used to merge at least two target warning information corresponding to the target merge key value in the multiple warning information to obtain the target merged warning information when the target merged warning information does not exist; wherein at least one of the merged warning information includes the target merged warning information.

[0116] In some possible embodiments, the third merging unit includes:

[0117] A subunit is created, which is used to obtain the first target merged alarm information according to the first target alarm information when the target merged alarm information does not exist.

[0118] The third merging subunit is used to merge at least one second target warning information with the first target merged warning information in sequence to obtain the target merged warning information; wherein, the at least two target warning information corresponding to the target merge key value include the first target warning information and the at least one second target warning information.

[0119] In some possible embodiments, a subunit is created, which is also used to obtain the first content of the first target merged alarm information according to the target merge strategy; and obtain the second content of the first target merged alarm information according to the first target alarm information; wherein the first content and the second content are different.

[0120] In some possible embodiments, the merging module 703 includes:

[0121] The fourth merging unit is used to update the target merged alarm information according to at least two target alarm information corresponding to the target merge key value when the target merged alarm information exists.

[0122] In some possible embodiments, the fourth merging unit includes:

[0123] The updating subunit is used to update the third content of the target merged alarm information according to at least two target alarm information corresponding to the target merge key value.

[0124] In some possible embodiments, the processing module 702 includes:

[0125] An acquisition unit, used for acquiring security data;

[0126] The extraction unit is used to obtain multiple alarm information based on the security data and the association analysis rule, and to extract the target content in each of the alarm information according to the target merging strategy to obtain a merging key value corresponding to each of the alarm information.

[0127] In some possible embodiments, the acquisition module 701 includes:

[0128] The first receiving unit is used to receive multiple merging strategies from a user terminal; wherein the multiple merging strategies include the target merging strategy.

[0129] In some possible embodiments, the acquisition module 701 includes:

[0130] The second receiving unit is configured to receive a user instruction for a target merging strategy among the multiple merging strategies.

[0131] A response unit is used to respond to the user instruction and obtain an association analysis rule including the target merging strategy according to the target merging strategy.

[0132] In an embodiment of the present application, after receiving a huge amount of security data, multiple alarm information is obtained based on the security data based on the association analysis rule, and the merge key value corresponding to each alarm information is obtained according to the target merging strategy in the association analysis rule, and at least two alarm information with high similarity are determined in the multiple alarm information through the merge key value, and the determined at least two alarm information are merged to obtain the merged alarm information. In addition, different target merging strategies can be referenced according to different security analysis scenarios to obtain a merge key value that can effectively identify the alarm information, ensuring that at least two alarm information with high similarity are merged to obtain the merged alarm information. In other words, when the present application processes a large amount of security data into multiple alarm information, it further merges the multiple alarm information into at least one merged alarm information. Compared with the technical means of directly sending multiple alarm information to relevant terminals separately for threat alarm, the alarm merging method proposed in the present application can effectively reduce the number of alarm information during alarm information management, improve the management efficiency of alarm information, and reduce the interference of a large amount of repeated alarm information to users, thereby avoiding users from being fatigued by a large amount of repeated alarm information and ignoring important alarm information.

[0133] It should be noted that the alarm information merging device provided in the above embodiment only uses the division of the above functional modules as an example when executing the alarm information merging method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the alarm information merging device provided in the above embodiment and the alarm information merging method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0134] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0135] The embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes the above-mentioned Figure 1 - Figure 6 One or more steps in the illustrated embodiment. If the components of the above-mentioned alarm information merging device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0136] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted by the computer-readable storage medium. The computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0137] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: various media that can store program codes, such as system memory (Read Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0138] The embodiments described above are merely preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements made to the technical solutions of the present application by ordinary technicians in this field should fall within the protection scope determined by the claims of the present application.

[0139] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1 - Figure 6The specific implementation process of the alarm information merging method in the embodiment shown can be found in Figure 1 - Figure 6 The specific description of the illustrated embodiment will not be repeated here.

[0140] See also Figure 8 A schematic diagram of the structure of an electronic device is provided for an embodiment of the present application. Figure 8 As shown, the electronic device 80 may include: at least one processor 801 , at least one network interface 804 , a user interface 803 , a memory 805 , and at least one communication bus 802 .

[0141] The communication bus 802 is used to realize the connection and communication between these components.

[0142] The user interface 803 may include a display screen (Display) and a camera (Camera), and the optional user interface 803 may also include a standard wired interface and a wireless interface.

[0143] The network interface 804 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0144] Among them, the processor 801 may include one or more processing cores. The processor 801 uses various interfaces and lines to connect various parts of the entire electronic device 80, and executes various functions and processes data of the electronic device 80 by running or executing instructions, programs, code sets or instruction sets stored in the memory 805, and calling data stored in the memory 805. Optionally, the processor 801 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 801 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 401, and it can be implemented by a single chip.

[0145] Among them, the memory 805 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 805 includes a non-transitory computer-readable storage medium. The memory 805 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 805 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store data involved in the above-mentioned method embodiments, etc. The memory 805 may optionally be at least one storage device located away from the aforementioned processor 801. As Figure 8 As shown, the memory 805 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an alarm information merging application.

[0146] exist Figure 8 In the electronic device 80 shown, the user interface 803 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 801 can be used to call the alarm information merging application stored in the memory 805, and specifically perform the following operations:

[0147] Obtaining association analysis rules including a target merging strategy;

[0148] Acquire security data, obtain multiple alarm information based on the security data and the association analysis rule, and obtain a merge key value corresponding to each alarm information based on the target merging strategy;

[0149] At least two target warning information among the multiple warning information are merged according to the merge key value corresponding to each of the warning information to obtain merged warning information; wherein the number of merged warning information corresponding to the multiple warning information is at least one.

[0150] In some possible embodiments, the processor 801 executes the merging key value corresponding to each of the warning information to merge at least two target warning information in the multiple warning information to obtain the merged warning information, specifically performing:

[0151] Determine at least two target warning information among the multiple warning information according to the merge key value corresponding to each of the warning information; wherein the similarity between the merge key values ​​respectively corresponding to the at least two target warning information reaches a preset threshold;

[0152] The at least two target warning information are merged to obtain merged warning information.

[0153] In some possible embodiments, the processor 801 executes the merging key value corresponding to each of the warning information to merge at least two target warning information in the multiple warning information to obtain the merged warning information, specifically performing:

[0154] At least two target alarm information in the multiple alarm information are merged according to the merging key value and the generation time corresponding to each of the alarm information to obtain the merged alarm information.

[0155] In some possible embodiments, the processor 801 performs the merging of at least two target warning information in the multiple warning information according to the merging key value and the generation time corresponding to each of the warning information to obtain the merged warning information, specifically performing:

[0156] At least two target alarm information whose generation times are within the same preset time period among the multiple alarm information are merged according to the merging key value and the generation time corresponding to each of the alarm information to obtain the merged alarm information.

[0157] In some possible embodiments, the processor 801 executes the merging key value corresponding to each of the warning information to merge at least two target warning information in the multiple warning information to obtain the merged warning information, specifically performing:

[0158] Determine whether there is already target merge alarm information corresponding to the target merge key value; wherein the merge key values ​​corresponding to each of the alarm information include the target merge key value;

[0159] In the absence of the target merged alarm information, at least two target alarm information corresponding to the target merge key value in the multiple alarm information are merged to obtain the target merged alarm information; wherein, at least one of the merged alarm information includes the target merged alarm information.

[0160] In some possible embodiments, the processor 801 performs, in the absence of the target merged alarm information, merging at least two target alarm information corresponding to the target merge key value in the multiple alarm information to obtain the target merged alarm information, specifically performing:

[0161] In the absence of the target merged warning information, obtaining the first target merged warning information according to the first target warning information;

[0162] At least one second target warning information is sequentially merged with the first target merged warning information to obtain the target merged warning information; wherein, the at least two target warning information corresponding to the target merge key value include the first target warning information and the at least one second target warning information.

[0163] In some possible embodiments, the processor 801 performs the step of obtaining the first target merged warning information according to the first target warning information in the absence of the target merged warning information, specifically performing:

[0164] Obtaining first content of the first target merge alarm information according to the target merge strategy;

[0165] The second content of the first target combined warning information is obtained according to the first target warning information; wherein the first content and the second content are different.

[0166] In some possible embodiments, after the processor 801 executes the determination of whether the target merge alarm information corresponding to the target merge key value already exists, the processor 801 further executes:

[0167] In the case where the target merged alarm information exists, the target merged alarm information is updated according to at least two target alarm information corresponding to the target merged key value.

[0168] In some possible embodiments, the processor 801 executes, in the case where the target merged alarm information exists, updating the target merged alarm information according to at least two target alarm information corresponding to the target merged key value, specifically executing:

[0169] The third content of the target merged alarm information is updated according to at least two target alarm information corresponding to the target merge key value.

[0170] In some possible embodiments, the processor 801 executes the acquiring of security data, obtains multiple alarm information based on the association analysis rule according to the security data, and obtains a merge key value corresponding to each of the alarm information based on the target merge strategy, specifically performing:

[0171] Obtain security data;

[0172] According to the security data, a plurality of alarm information are obtained based on the association analysis rule, and according to the target merging strategy, the target content in each of the alarm information is extracted to obtain a merging key value corresponding to each of the alarm information.

[0173] In some possible embodiments, the processor 801 executes the acquisition of the association analysis rule including the target merging strategy, specifically performing:

[0174] A plurality of merging strategies are received from a user terminal; wherein the plurality of merging strategies include the target merging strategy.

[0175] In some possible embodiments, the processor 801 executes the acquisition of the association analysis rule including the target merging strategy, specifically performing:

[0176] receiving a user instruction for a target merge strategy among the plurality of merge strategies;

[0177] In response to the user instruction, an association analysis rule including the target merging strategy is obtained according to the target merging strategy.

[0178] In the embodiment of the present application, the electronic device 80 can be a mobile phone, a tablet computer, a desktop, a laptop, a notebook computer, an ultra-mobile personal computer (UMPC), a handheld computer, a netbook, a personal digital assistant (PDA), a wearable electronic device, a virtual reality device, etc.

[0179] In an embodiment of the present application, after receiving a huge amount of security data, multiple alarm information is obtained based on the security data based on the association analysis rule, and the merge key value corresponding to each alarm information is obtained according to the target merging strategy in the association analysis rule, and at least two alarm information with high similarity are determined in the multiple alarm information through the merge key value, and the determined at least two alarm information are merged to obtain the merged alarm information. In addition, different target merging strategies can be referenced according to different security analysis scenarios to obtain a merge key value that can effectively identify the alarm information, ensuring that at least two alarm information with high similarity are merged to obtain the merged alarm information. In other words, when the present application processes a large amount of security data into multiple alarm information, it further merges the multiple alarm information into at least one merged alarm information. Compared with the technical means of directly sending multiple alarm information to relevant terminals separately for threat alarm, the alarm merging method proposed in the present application can effectively reduce the number of alarm information during alarm information management, improve the management efficiency of alarm information, and reduce the interference of a large amount of repeated alarm information to users, thereby avoiding users from being fatigued by a large amount of repeated alarm information and ignoring important alarm information.

Claims

1. A method for merging alarm information, characterized in that: The method comprises: Obtaining association analysis rules including a target merging strategy; Acquire security data, obtain multiple alarm information based on the security data and the association analysis rule, and obtain a merge key value corresponding to each alarm information based on the target merging strategy; At least two target warning information among the multiple warning information are merged according to the merge key value corresponding to each of the warning information to obtain merged warning information; wherein the number of merged warning information corresponding to the multiple warning information is at least one.

2. The method for merging alarm information according to claim 1, characterized in that: The step of merging at least two target warning information in the plurality of warning information according to the merging key value corresponding to each of the warning information to obtain the merged warning information includes: Determine at least two target warning information among the multiple warning information according to the merge key value corresponding to each of the warning information; wherein the similarity between the merge key values ​​respectively corresponding to the at least two target warning information reaches a preset threshold; The at least two target warning information are merged to obtain merged warning information.

3. The method for merging alarm information according to claim 1 or 2, characterized in that: The step of merging at least two target warning information in the plurality of warning information according to the merging key value corresponding to each of the warning information to obtain the merged warning information includes: At least two target alarm information in the multiple alarm information are merged according to the merging key value and the generation time corresponding to each of the alarm information to obtain the merged alarm information.

4. The method for merging alarm information according to claim 3, characterized in that: The step of merging at least two target warning information in the plurality of warning information according to the merging key value and the generation time corresponding to each of the warning information to obtain the merged warning information includes: At least two target alarm information whose generation times are within the same preset time period among the multiple alarm information are merged according to the merging key value and the generation time corresponding to each of the alarm information to obtain the merged alarm information.

5. The method for merging alarm information according to claim 1, characterized in that: The step of merging at least two target warning information in the plurality of warning information according to the merging key value corresponding to each of the warning information to obtain the merged warning information includes: Determine whether there is already target merge alarm information corresponding to the target merge key value; wherein the merge key values ​​corresponding to each of the alarm information include the target merge key value; In the absence of the target merged alarm information, at least two target alarm information corresponding to the target merge key value in the multiple alarm information are merged to obtain the target merged alarm information; wherein, at least one of the merged alarm information includes the target merged alarm information.

6. The method for merging alarm information according to claim 5, characterized in that: In the case where the target merged alarm information does not exist, merging at least two target alarm information corresponding to the target merge key value in the multiple alarm information to obtain the target merged alarm information includes: In the absence of the target merged warning information, obtaining the first target merged warning information according to the first target warning information; At least one second target warning information is sequentially merged with the first target merged warning information to obtain the target merged warning information; wherein, the at least two target warning information corresponding to the target merge key value include the first target warning information and the at least one second target warning information.

7. The method for merging alarm information according to claim 6, characterized in that: The obtaining the first target merged warning information according to the first target warning information in the absence of the target merged warning information includes: Obtaining first content of the first target merge alarm information according to the target merge strategy; The second content of the first target combined warning information is obtained according to the first target warning information; wherein the first content and the second content are different.

8. An alarm information merging device, characterized in that: include: An acquisition module, used for acquiring association analysis rules including a target merging strategy; A processing module, used for acquiring security data, obtaining a plurality of alarm information based on the security data and the association analysis rule, and obtaining a merge key value corresponding to each of the alarm information based on the target merge strategy; A merging module is used to merge at least two target warning information among the multiple warning information according to the merging key value corresponding to each of the warning information to obtain merged warning information; wherein the number of merged warning information corresponding to the multiple warning information is at least one.

9. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executing the method steps according to any one of claims 1-7.

10. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as described in any one of claims 1-7.

Images