Intelligent alarm information management method and system

Abstract

The invention relates to the technical field of intelligent security information processing, and discloses an intelligent alarm information management method and system.The system comprises an alarm information management device and a control device.The alarm information management device comprises an alarm information storage database, an encryption module, a decryption module and a management module; the encryption module obtains the security alarm information of the bank to be managed from the alarm information storage database and encrypts the security alarm information, the encrypted security alarm information of the bank to be managed is transmitted to the management module through the encryption module, the management module is connected with the decryption module, and the management module manages the security alarm information of the bank to be managed; and the control device comprises an acquisition unit, a judgment unit, a processing unit and a grading unit, and is used for controlling the alarm information management device to manage the alarm information. According to the invention, accurate evaluation and classification of the alarm information can be realized, so that quick response to emergency and important alarm information is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent security information processing, and in particular, to an intelligent alarm information management method and system. Background Art

[0002] With the country's advocacy of digital transformation, all walks of life are gradually promoting the process of digital reform. By applying a new generation of information technology, a closed-loop system of data collection, transmission, storage, processing, and feedback is constructed, breaking data barriers between different levels and industries, improving the overall operation efficiency of the industry, and thus building a new digital economy system.

[0003] The advent of the digital age has brought unprecedented development opportunities to the banking industry, but also new challenges. In the process of digital technology reshaping the social structure, bank branches need to transform the traditional business model and accelerate the transformation towards intelligent operation and intelligent security. There are many deficiencies in the alarm information printing devices in traditional bank branches, which cannot meet the needs of the intelligent transformation of banking services, bringing increasingly more problems to security management personnel at all levels of banks. In the bank security system, due to its particularity, a printer is usually connected to the alarm host to record alarm information.

[0004] However, there are many problems with using a printer to record alarm information, including: high printing consumable costs, expensive maintenance costs, and the printed alarm information is not easy to save, easy to be lost or tampered with, bringing great difficulties to the subsequent traceability of security incidents. In addition, the traditional printing method cannot achieve instant remote transmission and sharing of alarm information, restricting the rapid response and handling capabilities of security management personnel for alarm events.

[0005] Therefore, it is necessary to design an intelligent alarm information management method and system to solve the problems existing in the current technology. Summary of the Invention

[0006] In view of this, the present invention proposes an intelligent alarm information management method and system, aiming to improve the processing efficiency and management quality of bank security alarm information.

[0007] On the one hand, the present invention proposes an intelligent alarm information management system, including:

[0008] Alarm information management device and control device, wherein the alarm information management device includes an alarm information storage database, an encryption module, a decryption module and a management module. The encryption module obtains the bank security alarm information to be managed from the alarm information storage database and encrypts it. The encrypted bank security alarm information to be managed is transmitted by the encryption module to the management module. The management module is connected to the decryption module, and the management module manages the bank security alarm information to be managed; the control device includes a collection unit, a judgment unit, a processing unit and a grading unit, and the control device is used to control the alarm information management device to manage alarm information;

[0009] The collection unit is configured to collect the alarm type and urgency level of the bank security alarm information to be managed, and determine an initial processing index of the bank security alarm information to be managed based on the alarm type and urgency level;

[0010] The judgment unit is configured to control the collection unit to collect the historical alarm frequency of the bank security alarm information to be managed, and judge whether to adjust the initial processing index according to the historical alarm frequency;

[0011] The processing unit is configured to decrypt the bank security alarm information to be managed when it is determined to adjust the initial processing index, obtain the decryption time, availability score and integrity score of the bank security alarm information to be managed, and calculate a processing impact factor of the initial processing index based on the decryption time, availability score and integrity score;

[0012] The processing unit is further configured to control the collection unit to collect the historical alarm effectiveness index corresponding to the alarm type of the bank security alarm information to be managed, obtain an adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjust the initial processing index according to the adjustment coefficient to obtain a final processing index;

[0013] The grading unit is configured to divide the bank security alarm information to be managed into different processing priorities according to the final processing index, and select a processing strategy for the bank security alarm information to be managed according to different processing priorities.

[0014] Further, when determining the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency level, it includes:

[0015] Assign values to the alarm type and urgency level respectively to obtain an alarm type assignment and an urgency level assignment;

[0016] Perform a weighted sum of the assigned alarm type and the assigned urgency level to obtain the initial processing index of the security alarm information of the bank to be managed.

[0017] Further, when determining whether to adjust the initial processing index based on the historical alarm frequency, it includes:

[0018] Compare the historical alarm frequency with the historical alarm frequency threshold, and determine whether to adjust the initial processing index according to the comparison result;

[0019] When the historical alarm frequency is greater than the historical alarm frequency threshold, it is determined to adjust the initial processing index;

[0020] When the historical alarm frequency is less than or equal to the historical alarm frequency threshold, it is determined not to adjust the initial processing index.

[0021] Further, when calculating the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score, it includes:

[0022] The processing unit detects the readable range of the decrypted security alarm information of the bank to be managed based on a readability evaluation tool, and obtains the proportion of the readable range;

[0023] Compare the proportion of the readable range with a first readable range proportion threshold and a second readable range proportion threshold, and determine the availability score according to the comparison result; wherein, the first readable range proportion threshold is less than the second readable range proportion threshold;

[0024] When the proportion of the readable range is less than or equal to the first readable range proportion threshold, determine that the availability score is the first availability score;

[0025] When the proportion of the readable range is greater than the first readable range proportion threshold and less than or equal to the second readable range proportion threshold, determine that the availability score is the second availability score;

[0026] When the proportion of the readable range is greater than the second readable range proportion threshold, determine that the availability score is the third availability score.

[0027] Further, when calculating the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score, it also includes:

[0028] The processing unit obtains a security hash value according to the metadata of the security alarm information of the bank to be managed, and calculates a decryption hash value according to the decrypted security alarm information of the bank to be managed;

[0029] Compare the security hash value with the decryption hash value, and determine the integrity score according to the comparison result;

[0030] When the security hash value is the same as the decryption hash value, determine that the integrity score is 1;

[0031] When the security hash value is different from the decryption hash value, determine that the integrity score is 0.

[0032] Further, when calculating the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score, it further includes:

[0033] The processing impact factor is obtained by the following formula:

[0034]

[0035] Where Y represents the processing impact factor; T represents the decryption time; Sk represents the availability score; Sw represents the integrity score; α represents the first weight coefficient; β represents the second weight coefficient; γ represents the third weight coefficient; δ represents the adjustment coefficient.

[0036] Further, the historical alarm effectiveness index is obtained by the following formula:

[0037]

[0038] Where B represents the alarm effectiveness index; Z1 represents the number of alarms actually causing problems; Z represents the total number of alarm triggers.

[0039] Further, when obtaining the adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjusting the initial processing index according to the adjustment coefficient to obtain the final processing index, it includes:

[0040] Compare the historical alarm effectiveness index with the historical alarm effectiveness index threshold respectively, and compare the processing impact factor with the processing impact factor threshold, and determine the adjustment coefficient of the initial processing index according to the comparison result;

[0041] When the historical alarm effectiveness index is less than or equal to the historical alarm effectiveness index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the first adjustment coefficient, and use the product value of the first adjustment coefficient and the initial processing index as the final processing index;

[0042] When the historical alarm effectiveness index is less than or equal to the historical alarm effectiveness index threshold, and the processing impact factor is greater than the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the second adjustment coefficient, and use the product value of the second adjustment coefficient and the initial processing index as the final processing index;

[0043] When the historical alarm effectiveness index is greater than the historical alarm effectiveness index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the third adjustment coefficient, and use the product value of the third adjustment coefficient and the initial processing index as the final processing index;

[0044] When the historical alarm effectiveness index is greater than the historical alarm effectiveness index threshold, and the processing impact factor is greater than the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the fourth adjustment coefficient, and use the product value of the fourth adjustment coefficient and the initial processing index as the final processing index.

[0045] Further, when classifying the security alarm information of the bank to be managed into different processing priorities according to the final processing index and selecting the processing strategy of the security alarm information of the bank to be managed according to different processing priorities, it includes:

[0046] Compare the final processing index with the first final processing index and the second final processing index, determine the processing priority of the security alarm information of the bank to be managed according to the comparison result, and select the processing strategy of the security alarm information of the bank to be managed according to different processing priorities; wherein, the first final processing index is less than the second final processing index;

[0047] When the final processing index is less than or equal to the first final processing index, determine that the processing priority of the security alarm information of the bank to be managed is the high priority, and determine that the processing strategy of the security alarm information of the bank to be managed is to respond immediately and give priority to processing;

[0048] When the final processing index is greater than the first final processing index and less than or equal to the second final processing index, determine that the processing priority of the security alarm information of the bank to be managed is the medium priority, and determine that the processing strategy of the security alarm information of the bank to be managed is to process within the specified time;

[0049] When the final processing index is greater than the second final processing index, determine that the processing priority of the security alarm information of the bank to be managed is the low priority, and determine that the processing strategy of the security alarm information of the bank to be managed is to process according to the normal process.

[0050] Compared with the prior art, the beneficial effects of the present invention are as follows: The intelligent alarm information management system provided by the present invention has the characteristics of high intelligence and automation, and can greatly improve the processing efficiency and accuracy of bank security alarm information. By comprehensively considering multiple key indicators of alarm information, the system can achieve accurate evaluation and classification of alarm information, thereby ensuring a rapid response to emergency and important alarm information. At the same time, the system can also dynamically adjust the processing strategy according to historical data and real-time situations to adapt to the changing security environment and alarm requirements.

[0051] On the other hand, the present invention also proposes an intelligent alarm information management method, including the following steps:

[0052] S100: Collect the alarm type and urgency level of the bank security alarm information to be managed, and determine the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency level;

[0053] S200: Collect the historical alarm frequency of the bank security alarm information to be managed, and determine whether to adjust the initial processing index according to the historical alarm frequency;

[0054] S300: When it is determined to adjust the initial processing index, decrypt the bank security alarm information to be managed, obtain the decryption time, availability score, and integrity score of the bank security alarm information to be managed, and calculate the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score;

[0055] S400: Collect the historical alarm effectiveness index corresponding to the alarm type of the bank security alarm information to be managed, obtain the adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjust the initial processing index according to the adjustment coefficient to obtain the final processing index;

[0056] S500: Divide the bank security alarm information to be managed into different processing priorities according to the final processing index, and select the processing strategy of the bank security alarm information to be managed according to different processing priorities.

[0057] It can be understood that the above intelligent alarm information management method and system have the same beneficial effects, which will not be elaborated here. Description of the Drawings

[0058] Upon reading the following detailed description of the preferred embodiments, various other advantages and benefits will become apparent to those of ordinary skill in the art. The accompanying drawings are only for the purpose of showing the preferred embodiments and are not considered to be a limitation of the present invention. Also, throughout the drawings, the same reference numerals are used to represent the same components. In the drawings:

[0059] Figure 1 is a structural block diagram of an intelligent alarm information management system provided by an embodiment of the present invention;

[0060] Figure 2 is a flowchart of an intelligent alarm information management method provided by an embodiment of the present invention. Detailed Embodiments

[0061] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be fully conveyed to those skilled in the art. It should be noted that, without conflict, the embodiments in the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the drawings and in conjunction with the embodiments.

[0062] Referring to Figure 1 as shown, in some embodiments of the present application, an intelligent alarm information management system is provided, including:

[0063] an alarm information management device and a control device, wherein the alarm information management device includes an alarm information storage database, an encryption module, a decryption module, and a management module. The encryption module obtains the bank security alarm information to be managed from the alarm information storage database and encrypts it. The encrypted bank security alarm information to be managed is transmitted by the encryption module to the management module. The management module is connected to the decryption module, and the management module manages the bank security alarm information to be managed. The control device includes a collection unit, a judgment unit, a processing unit, and a classification unit. The control device is used to control the alarm information management device to manage alarm information;

[0064] The collection unit is configured to collect the alarm type and urgency level of the bank security alarm information to be managed, and determine an initial processing index of the bank security alarm information to be managed based on the alarm type and urgency level;

[0065] The judgment unit is configured to control the collection unit to collect the historical alarm frequency of the bank security alarm information to be managed, and judge whether to adjust the initial processing index according to the historical alarm frequency;

[0066] The processing unit is configured to decrypt the bank security alarm information to be managed when it is determined that the initial processing index needs to be adjusted, obtain the decryption time, availability score, and integrity score of the bank security alarm information to be managed, and calculate the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score;

[0067] The processing unit is further configured to control the acquisition unit to acquire the historical alarm effectiveness index corresponding to the alarm type of the bank security alarm information to be managed, obtain the adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjust the initial processing index according to the adjustment coefficient to obtain the final processing index;

[0068] The grading unit is configured to divide the bank security alarm information to be managed into different processing priorities according to the final processing index, and select the processing strategy of the bank security alarm information to be managed according to different processing priorities.

[0069] It can be understood that the intelligent alarm information management system provided in this embodiment realizes the intelligent management of alarm information by collecting multiple key indicators of the bank security alarm information to be managed and using these indicators for comprehensive evaluation and processing. First, the system obtains the alarm type and urgency level through the acquisition unit, which is the basis for determining the initial processing index. Subsequently, the judgment unit uses the historical alarm frequency as a reference to judge whether the initial processing index needs to be adjusted. If adjustment is required, the processing unit further intervenes. By decrypting the alarm information, it obtains the decryption time, availability score, and integrity score, which together constitute the calculation basis for the processing impact factor. On this basis, the system also collects the historical alarm effectiveness index, combines the processing impact factor, and obtains the adjustment coefficient through a complex algorithm, and finally adjusts the initial processing index to form a more accurate final processing index. The grading unit divides the alarm information into different processing priorities according to this index and selects the corresponding processing strategy accordingly.

[0070] It can be understood that the intelligent alarm information management system provided in this embodiment has the characteristics of high intelligence and automation, and can greatly improve the processing efficiency and accuracy of bank security alarm information. By comprehensively considering multiple key indicators of alarm information, the system can achieve accurate evaluation and classification of alarm information, thus ensuring a rapid response to urgent and important alarm information. At the same time, the system can also dynamically adjust the processing strategy according to historical data and real-time situations to adapt to the changing security environment and alarm requirements.

[0071] Specifically, when determining the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency level, it includes:

[0072] Assign values to the alarm type and urgency level respectively to obtain the alarm type assignment and the urgency level assignment;

[0073] Perform weighted summation on the alarm type assignment and the urgency level assignment to obtain the initial processing index of the bank security alarm information to be managed.

[0074] In this embodiment, the alarm types include intrusion alarm, fire alarm, robbery alarm, etc. The intrusion alarm is assigned 3 points, the fire alarm is assigned 5 points, and the robbery alarm is assigned 7 points; the urgency level is divided into three levels: general, urgent, and special, corresponding to the assigned values of 1 point, 3 points, and 5 points respectively. Through the weighted summation of the alarm type assignment and the urgency level assignment, the system can preliminarily evaluate the urgency level and processing priority of the bank security alarm information to be managed, providing an important reference for subsequent processing. This assignment method is both simple and clear, and can fully reflect the actual situation of the alarm information, ensuring that the system can respond accurately and quickly.

[0075] Specifically, when judging whether to adjust the initial processing index according to the historical alarm frequency, it includes:

[0076] Compare the historical alarm frequency with the historical alarm frequency threshold, and judge whether to adjust the initial processing index according to the comparison result;

[0077] When the historical alarm frequency is greater than the historical alarm frequency threshold, it is determined to adjust the initial processing index;

[0078] When the historical alarm frequency is less than or equal to the historical alarm frequency threshold, it is determined not to adjust the initial processing index.

[0079] It can be understood that the historical alarm frequency is an important indicator reflecting the importance and urgency of alarm information. If the historical alarm frequency of a certain type of alarm information is high, it indicates that it may have a high occurrence probability or potential risk. Therefore, it is necessary to adjust the initial processing index to increase the attention and processing priority for this type of alarm information. On the contrary, if the historical alarm frequency is low, it indicates that its occurrence probability is small or the risk is low. At this time, the initial processing index can be maintained unchanged to avoid unnecessary resource waste. Through such a judgment mechanism, the system can achieve dynamic management and optimized processing of alarm information, ensuring the effective utilization of resources and the improvement of response speed.

[0080] Specifically, when calculating the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score, it includes:

[0081] The processing unit detects the readable range of the decrypted bank security alarm information to be managed based on a readability evaluation tool, and obtains the proportion of the readable range.

[0082] Compare the proportion of the readable range with a first readable range proportion threshold and a second readable range proportion threshold, and determine the availability score according to the comparison result; wherein, the first readable range proportion threshold is less than the second readable range proportion threshold.

[0083] When the proportion of the readable range is less than or equal to the first readable range proportion threshold, determine that the availability score is the first availability score.

[0084] When the proportion of the readable range is greater than the first readable range proportion threshold and less than or equal to the second readable range proportion threshold, determine that the availability score is the second availability score.

[0085] When the proportion of the readable range is greater than the second readable range proportion threshold, determine that the availability score is the third availability score.

[0086] It can be understood that the first availability score < the second availability score < the third availability score. Through the readability evaluation tool, the system can quantitatively measure the readability of the decrypted alarm information, and then provide an objective score for its availability. This step is crucial because it directly relates to the selection of subsequent processing strategies and the allocation of resources. If the readability of the alarm information is poor, even if its content is important, it may lose its value because it is difficult to be understood and utilized. Therefore, the system divides the availability score into three levels by setting different readable range proportion thresholds to ensure that it can accurately reflect the actual readability of the alarm information and provide strong support for subsequent processing.

[0087] Specifically, when calculating the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score, it further includes:

[0088] The processing unit obtains a security hash value according to the metadata of the bank security alarm information to be managed, and calculates a decryption hash value according to the decrypted bank security alarm information to be managed.

[0089] Compare the security hash value with the decryption hash value, and determine the integrity score according to the comparison result.

[0090] When the security hash value is consistent with the decryption hash value, determine that the integrity score is 1.

[0091] When the security hash value is inconsistent with the decryption hash value, determine that the integrity score is 0.

[0092] In this embodiment, the security hash value refers to the unique identifier obtained by calculating the original data of the alarm information before encrypted storage through a specific algorithm, while the decryption hash value is the hash value recalculated after the alarm information is decrypted. By comparing these two hash values, the system can accurately determine whether the alarm information has been tampered with or damaged during transmission and decryption. If the two are consistent, it indicates that the alarm information is intact, and at this time, the integrity score is 1, indicating that the system can perform subsequent processing on this alarm information. If the two are inconsistent, it indicates that there may be a problem with the alarm information during transmission or decryption. At this time, the integrity score is 0, and the system will mark or discard this alarm information to avoid misjudgment or missed judgment caused by using incomplete or incorrect alarm information. This integrity verification method based on hash values is not only simple and efficient but also can ensure the accuracy and reliability of the alarm information, providing a strong guarantee for the stable operation of the system.

[0093] Specifically, when calculating the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score, it further includes:

[0094] The processing impact factor is obtained through the following formula:

[0095]

[0096] Where Y represents the processing impact factor; T represents the decryption time; Sk represents the availability score; Sw represents the integrity score; α represents the first weight coefficient; β represents the second weight coefficient; γ represents the third weight coefficient; δ represents the adjustment coefficient.

[0097] In this embodiment, the preferred value of α is 0.3, the preferred value of β is 0.4, the preferred value of γ is 0.2, and the preferred value of δ is 0.1. Through such weight allocation and setting of the adjustment coefficient, the system can comprehensively consider the impacts of the decryption time, availability score, and integrity score on the processing impact factor to ensure the accuracy and rationality of the evaluation results.

[0098] It can be understood that the decryption time T reflects the efficiency of the system in processing the alarm information. The availability score Sk and the integrity score Sw respectively measure the readability of the alarm information and the degree of maintaining the original appearance during transmission and storage.

[0099] It can be understood that the calculation formula of the processing impact factor Y comprehensively considers multiple factors such as the decryption time T, availability score Sk, integrity score Sw, and adjustment coefficient δ, and weights them through the first weight coefficient α, the second weight coefficient β, and the third weight coefficient γ. This design aims to comprehensively evaluate various key indicators of the alarm information during the processing process to ensure that the system can make a more accurate and reasonable response.

[0100] Specifically, the historical alarm effectiveness index is obtained by the following formula:

[0101]

[0102] Where B represents the alarm effectiveness index; Z1 represents the number of alarms actually causing problems; Z represents the total number of alarm triggers.

[0103] It can be understood that the alarm effectiveness index B reflects the probability of the alarm information causing problems in actual applications and is an important indicator for measuring the accuracy and effectiveness of alarm information. By calculating the ratio of the number of alarms Z1 actually causing problems to the total number of alarm triggers Z, the system can intuitively understand the reliability and practical value of the alarm information. If the alarm effectiveness index is relatively high, it indicates that the alarm information received by the system has high accuracy and effectiveness, can truly reflect the bank's security situation, and provides strong support for subsequent processing. On the contrary, if the alarm effectiveness index is relatively low, it indicates that there may be a large number of false alarms or invalid alarms in the system. At this time, the system needs to further optimize the collection and processing process of alarm information to improve the accuracy and effectiveness of alarm information and reduce unnecessary resource waste.

[0104] Specifically, when obtaining the adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor and adjusting the initial processing index according to the adjustment coefficient to obtain the final processing index, it includes:

[0105] Compare the historical alarm effectiveness index with the historical alarm effectiveness index threshold respectively, and compare the processing impact factor with the processing impact factor threshold, and determine the adjustment coefficient of the initial processing index according to the comparison results;

[0106] When the historical alarm effectiveness index is less than or equal to the historical alarm effectiveness index threshold and the processing impact factor is less than or equal to the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the first adjustment coefficient, and take the product value of the first adjustment coefficient and the initial processing index as the final processing index;

[0107] When the historical alarm effectiveness index is less than or equal to the historical alarm effectiveness index threshold and the processing impact factor is greater than the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the second adjustment coefficient, and take the product value of the second adjustment coefficient and the initial processing index as the final processing index;

[0108] When the historical alarm effectiveness index is greater than the historical alarm effectiveness index threshold and the processing impact factor is less than or equal to the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the third adjustment coefficient, and use the product value of the third adjustment coefficient and the initial processing index as the final processing index;

[0109] When the historical alarm effectiveness index is greater than the historical alarm effectiveness index threshold and the processing impact factor is greater than the processing impact factor threshold, determine that the adjustment coefficient of the initial processing index is the fourth adjustment coefficient, and use the product value of the fourth adjustment coefficient and the initial processing index as the final processing index.

[0110] It can be understood that the setting of the adjustment coefficient is designed to dynamically adjust the initial processing index according to different combinations of the historical alarm effectiveness index and the processing impact factor, so as to ensure that the final processing index can more accurately reflect the actual urgency and processing priority of the alarm information. Through such an adjustment mechanism, the system can achieve refined management and optimized processing of alarm information, improving processing efficiency and accuracy. The magnitude relationship of the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient, and the fourth adjustment coefficient is: the first adjustment coefficient < the second adjustment coefficient < the third adjustment coefficient < the fourth adjustment coefficient. Through such a setting, the system can ensure that when processing different types of alarm information, reasonable resource allocation and response strategy selection can be made according to their urgency and processing priority. If the historical alarm effectiveness index of the alarm information is low and the processing impact factor is also small, it indicates that the alarm information may not be very important or the urgency is low. At this time, the system can select a smaller first adjustment coefficient to reduce the attention and processing priority of the alarm information. On the contrary, if the historical alarm effectiveness index of the alarm information is high and the processing impact factor is also large, it indicates that the alarm information may have high importance and urgency. At this time, the system can select a larger fourth adjustment coefficient to increase the attention and processing priority of the alarm information, ensuring that it can be processed in a timely and effective manner. Through such a dynamic adjustment mechanism, the system can achieve intelligent management and optimized processing of alarm information, improving processing efficiency and accuracy, and providing more powerful support for the bank's security work.

[0111] Specifically, when dividing the bank security alarm information to be managed into different processing priorities according to the final processing index and selecting the processing strategy of the bank security alarm information to be managed according to different processing priorities, it includes:

[0112] Compare the final processing index with the first final processing index and the second final processing index, determine the processing priority of the security alarm information of the bank to be managed according to the comparison result, and select the processing strategy for the security alarm information of the bank to be managed according to different processing priorities; wherein, the first final processing index is less than the second final processing index;

[0113] When the final processing index is less than or equal to the first final processing index, determine that the processing priority of the security alarm information of the bank to be managed is high priority, and determine that the processing strategy for the security alarm information of the bank to be managed is to respond immediately and give priority to processing;

[0114] When the final processing index is greater than the first final processing index and less than or equal to the second final processing index, determine that the processing priority of the security alarm information of the bank to be managed is medium priority, and determine that the processing strategy for the security alarm information of the bank to be managed is to process it within a specified time;

[0115] When the final processing index is greater than the second final processing index, determine that the processing priority of the security alarm information of the bank to be managed is low priority, and determine that the processing strategy for the security alarm information of the bank to be managed is to process it according to the normal process.

[0116] In this embodiment, the normal process refers to the standard steps and procedures for the system to process alarm information daily, including receiving alarm information, preliminary analysis, classification processing, resource allocation, execution of processing measures, recording feedback, etc.

[0117] It can be understood that dividing the security alarm information of the bank to be managed into different processing priorities and formulating corresponding processing strategies are key steps for the system to achieve efficient response and optimal resource allocation. Alarm information with high priority means that its urgency and processing requirements are relatively high. Therefore, the system needs to respond immediately and give priority to processing to ensure that problems can be solved in a timely manner and prevent the further deterioration of the situation. Alarm information with medium priority, although its urgency is slightly lower than that of high priority, still needs to be processed within a specified time to avoid the accumulation and spread of potential risks. Alarm information with low priority can be processed according to the normal process to ensure the reasonable utilization of system resources and the balance of response speed. Through such a processing strategy, the system can achieve hierarchical management and optimized processing of alarm information, ensuring the rapid response to high-urgency alarm information and avoiding the lag in processing low-urgency alarm information caused by excessive resource tilt, thus achieving an overall improvement in the security level.

[0118] Refer to Figure 2 As shown, in some embodiments of the present application, this embodiment provides an intelligent alarm information management method, including the following steps:

[0119] S100: Collect the alarm type and urgency level of the security alarm information of the bank to be managed, and determine the initial processing index of the security alarm information of the bank to be managed based on the alarm type and urgency level;

[0120] S200: Collect the historical alarm frequency of the security alarm information of the bank to be managed, and determine whether to adjust the initial processing index according to the historical alarm frequency;

[0121] S300: When it is determined to adjust the initial processing index, decrypt the security alarm information of the bank to be managed, obtain the decryption time, availability score, and integrity score of the security alarm information of the bank to be managed, and calculate the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score;

[0122] S400: Collect the historical alarm effectiveness index corresponding to the alarm type of the security alarm information of the bank to be managed, obtain the adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjust the initial processing index according to the adjustment coefficient to obtain the final processing index;

[0123] S500: Divide the security alarm information of the bank to be managed into different processing priorities according to the final processing index, and select the processing strategy of the security alarm information of the bank to be managed according to different processing priorities.

[0124] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0125] The present application is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams can be implemented by computer program instructions, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can also be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate for implementing in the process Figure 1 one process or multiple processes and / or blocks Figure 1means for the functions specified in one or more boxes.

[0126] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device that implements the process Figure 1 one process or more processes and / or boxes Figure 1 the functions specified in one box or more boxes.

[0127] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process. Thus, the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in Figure 1 one process or more processes and / or boxes Figure 1 the functions specified in one box or more boxes.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the specific implementation manners of the present invention can still be modified or equivalently replaced, and any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the protection scope of the claims of the present invention.

Claims

1. An intelligent alarm information management system, characterized in that: include: An alarm information management device and a control device, wherein the alarm information management device comprises an alarm information storage database, an encryption module, a decryption module, and a management module, wherein the encryption module obtains the bank security alarm information to be managed from the alarm information storage database and encrypts it, and the encrypted bank security alarm information to be managed is transmitted from the encryption module to the management module, the management module is connected to the decryption module, and the management module manages the bank security alarm information to be managed; the control device comprises a collection unit, a judgment unit, a processing unit, and a classification unit, and the control device is used to control the alarm information management device to manage the alarm information; The collection unit is configured to collect the alarm type and urgency of the bank security alarm information to be managed, and determine the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency; The judgment unit is configured to control the collection unit to collect the historical alarm frequency of the security alarm information of the bank to be managed, and judge whether to adjust the initial processing index according to the historical alarm frequency; The processing unit is configured to, when it is determined that the initial processing index is to be adjusted, decrypt the security alarm information of the bank to be managed, obtain the decryption time, availability score and integrity score of the security alarm information of the bank to be managed, and calculate the processing impact factor of the initial processing index based on the decryption time, availability score and integrity score; The processing unit is further configured to control the collection unit to collect the historical alarm effectiveness index corresponding to the alarm type of the bank security alarm information to be managed, obtain the adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing influencing factor, and adjust the initial processing index according to the adjustment coefficient to obtain the final processing index; The grading unit is configured to classify the bank security alarm information to be managed into different processing priorities according to the final processing index, and select a processing strategy for the bank security alarm information to be managed according to the different processing priorities.

2. The intelligent alarm information management system according to claim 1 is characterized in that: Determining the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency includes: Assigning values ​​to the alarm type and the urgency level respectively to obtain an alarm type assignment and an urgency level assignment; The alarm type value and the urgency value are weighted and summed to obtain an initial processing index for the bank security alarm information to be managed.

3. The intelligent alarm information management system according to claim 1 is characterized in that: When judging whether to adjust the initial processing index according to the historical alarm frequency, it includes: Comparing the historical alarm frequency with the historical alarm frequency threshold, and determining whether to adjust the initial processing index according to the comparison result; When the historical alarm frequency is greater than the historical alarm frequency threshold, determining to adjust the initial processing index; When the historical alarm frequency is less than or equal to the historical alarm frequency threshold, it is determined that the initial processing index is not adjusted.

4. The intelligent alarm information management system according to claim 1, characterized in that: When calculating the processing impact factor of the initial processing index based on the decryption time, the availability score and the integrity score, it includes: The processing unit detects the readable range of the decrypted bank security alarm information to be managed based on the readability assessment tool, and obtains the readable range ratio; Comparing the readable range proportion with a first readable range proportion threshold and a second readable range proportion threshold, and determining the availability score according to the comparison result; wherein the first readable range proportion threshold is less than the second readable range proportion threshold; When the readable range ratio is less than or equal to the first readable range ratio threshold, determining the usability score to be a first usability score; When the readable range ratio is greater than the first readable range ratio threshold and less than or equal to the second readable range ratio threshold, determining that the usability score is a second usability score; When the readable range ratio is greater than the second readable range ratio threshold, the availability score is determined to be a third availability score.

5. The intelligent alarm information management system according to claim 4 is characterized in that: When calculating the processing impact factor of the initial processing index based on the decryption time, the availability score and the integrity score, it also includes: The processing unit obtains a security hash value according to the metadata of the bank security alarm information to be managed, and calculates a decrypted hash value according to the decrypted bank security alarm information to be managed; Comparing the security hash value with the decrypted hash value, and determining an integrity score based on the comparison result; When the security hash value is consistent with the decrypted hash value, determining that the integrity score is 1; When the security hash value is inconsistent with the decrypted hash value, the integrity score is determined to be 0.

6. The intelligent alarm information management system according to claim 5, characterized in that: When calculating the processing impact factor of the initial processing index based on the decryption time, the availability score and the integrity score, it also includes: The treatment impact factor is obtained by the following formula: Among them, Y represents the processing impact factor; T represents the decryption time; Sk represents the availability score; Sw represents the integrity score; α represents the first weight coefficient; β represents the second weight coefficient; γ represents the third weight coefficient; δ represents the adjustment coefficient.

7. The intelligent alarm information management system according to claim 1, characterized in that: The historical alarm effectiveness index is obtained by the following formula: Among them, B represents the alarm effectiveness index; Z1 represents the number of alarms that actually cause problems; and Z represents the total number of alarm triggers.

8. The intelligent alarm information management system according to claim 1, characterized in that: The method comprises: obtaining an adjustment coefficient of the initial processing index based on the historical alarm validity index and the processing influence factor, and adjusting the initial processing index according to the adjustment coefficient to obtain a final processing index, including: Respectively comparing the historical alarm validity index with the historical alarm validity index threshold, comparing the processing impact factor with the processing impact factor threshold, and determining the adjustment coefficient of the initial processing index according to the comparison results; When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as the first adjustment coefficient, and taking the product value of the first adjustment coefficient and the initial processing index as the final processing index; When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is greater than the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as the second adjustment coefficient, and taking the product value of the second adjustment coefficient and the initial processing index as the final processing index; When the historical alarm validity index is greater than the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a third adjustment coefficient, and taking the product value of the third adjustment coefficient and the initial processing index as the final processing index; When the historical alarm validity index is greater than the historical alarm validity index threshold and the processing impact factor is greater than the processing impact factor threshold, the adjustment coefficient of the initial processing index is determined to be the fourth adjustment coefficient, and the product value of the fourth adjustment coefficient and the initial processing index is used as the final processing index.

9. The intelligent alarm information management system according to claim 1, characterized in that: The method further comprises: dividing the bank security alarm information to be managed into different processing priorities according to the final processing index, and selecting a processing strategy for the bank security alarm information to be managed according to the different processing priorities, including: Comparing the final processing index with the first final processing index and the second final processing index, determining the processing priority of the bank security alarm information to be managed according to the comparison result, and selecting the processing strategy of the bank security alarm information to be managed according to the different processing priorities; wherein the first final processing index is less than the second final processing index; When the final processing index is less than or equal to the first final processing index, determining that the processing priority of the bank security alarm information to be managed is a high priority, and determining that the processing strategy of the bank security alarm information to be managed is an immediate response and priority processing; When the final processing index is greater than the first final processing index and less than or equal to the second final processing index, determining that the processing priority of the bank security alarm information to be managed is medium priority, and determining that the processing strategy of the bank security alarm information to be managed is to process within a specified time; When the final processing index is greater than the second final processing index, the processing priority of the bank security alarm information to be managed is determined to be a low priority, and the processing strategy of the bank security alarm information to be managed is determined to be processed according to a conventional process.

10. An intelligent alarm information management method, applied to the intelligent alarm information management system according to any one of claims 1 to 9, characterized in that: include: Collecting the alarm type and urgency of the bank security alarm information to be managed, and determining an initial processing index of the bank security alarm information to be managed based on the alarm type and urgency; Collecting the historical alarm frequency of the security alarm information of the bank to be managed, and determining whether to adjust the initial processing index according to the historical alarm frequency; When it is determined that the initial processing index is to be adjusted, the bank security alarm information to be managed is decrypted to obtain the decryption time, availability score and integrity score of the bank security alarm information to be managed, and the processing impact factor of the initial processing index is calculated based on the decryption time, availability score and integrity score; Collecting the historical alarm effectiveness index corresponding to the alarm type of the bank security alarm information to be managed, obtaining the adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing influencing factor, and adjusting the initial processing index according to the adjustment coefficient to obtain the final processing index; The bank security alarm information to be managed is divided into different processing priorities according to the final processing index, and a processing strategy for the bank security alarm information to be managed is selected according to the different processing priorities.

Images