Intelligent alarm information management method and system

Abstract

The present invention relates to the field of intelligent security information processing technology, and discloses an intelligent alarm information management method and system. The system comprises: an alarm information management device and a control device, wherein the alarm information management device comprises an alarm information storage database, an encryption module, a decryption module, and a management module. The encryption module obtains and encrypts the security alarm information of a bank to be managed from the alarm information storage database. The encrypted security alarm information of the bank to be managed is transmitted by the encryption module to the management module, which is connected to the decryption module and manages the security alarm information of the bank to be managed. The control device comprises a collection unit, a judgment unit, a processing unit, and a classification unit, and is used to control the alarm information management device to manage the alarm information. The present invention can achieve accurate assessment and classification of alarm information, thereby ensuring a rapid response to urgent and important alarm information.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent security information processing, and in particular to an intelligent alarm information management method and system. Background Art

[0002] With the country's advocacy for digital transformation, all industries are gradually advancing their digital reforms. By applying next-generation information technology, a closed-loop system for data collection, transmission, storage, processing, and feedback is being established. This will break down data barriers between different levels and industries, improve overall industry operational efficiency, and ultimately build a new digital economy.

[0003] The advent of the digital age has brought unprecedented development opportunities to the banking industry, but also new challenges. As digital technology reshapes society, bank branches must transform their traditional operating models and accelerate their transition to intelligent operations and smart security. Traditional bank branch alarm information printing equipment has numerous shortcomings and cannot meet the demands of intelligent banking transformation, presenting increasing challenges for bank security managers at all levels. Due to the unique nature of bank security systems, printers are often connected to alarm host computers to record alarm information.

[0004] However, using printers to record alarm information presents numerous challenges, including high costs for printing supplies and maintenance. Printed alarm information is difficult to store and can be easily lost or tampered with, significantly complicating subsequent security incident tracing. Furthermore, traditional printing methods cannot achieve instant remote transmission and sharing of alarm information, limiting security managers' ability to quickly respond to and address alarm events.

[0005] Therefore, it is necessary to design an intelligent alarm information management method and system to solve the problems existing in the current technology. Summary of the Invention

[0006] In view of this, the present invention proposes an intelligent alarm information management method and system, aiming to improve the processing efficiency and management quality of bank security alarm information.

[0007] In one aspect, the present invention provides an intelligent alarm information management system, comprising:

[0008] An alarm information management device and a control device, wherein the alarm information management device includes an alarm information storage database, an encryption module, a decryption module, and a management module. The encryption module obtains and encrypts the bank security alarm information to be managed from the alarm information storage database. The encrypted bank security alarm information to be managed is transmitted by the encryption module to the management module. The management module is connected to the decryption module, and the management module manages the bank security alarm information to be managed. The control device includes a collection unit, a judgment unit, a processing unit, and a classification unit. The control device is used to control the alarm information management device to manage alarm information.

[0009] The collecting unit is configured to collect the alarm type and urgency of the bank security alarm information to be managed, and determine the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency;

[0010] The judgment unit is configured to control the collection unit to collect the historical alarm frequency of the security alarm information of the bank to be managed, and judge whether to adjust the initial processing index according to the historical alarm frequency;

[0011] The processing unit is configured to, when determining to adjust the initial processing index, decrypt the security alarm information of the bank to be managed, obtain a decryption time, an availability score, and an integrity score of the security alarm information of the bank to be managed, and calculate a processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score;

[0012] The processing unit is further configured to control the collection unit to collect historical alarm effectiveness indexes corresponding to the alarm types of the bank security alarm information to be managed, obtain an adjustment coefficient for the initial processing index based on the historical alarm effectiveness indexes and the processing impact factor, and adjust the initial processing index according to the adjustment coefficient to obtain a final processing index;

[0013] The grading unit is configured to classify the bank security alarm information to be managed into different processing priorities according to the final processing index, and select a processing strategy for the bank security alarm information to be managed according to the different processing priorities.

[0014] Furthermore, when determining the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency, the method includes:

[0015] Assigning values ​​to the alarm type and urgency respectively to obtain an alarm type value and an urgency value;

[0016] The alarm type assignment and the urgency assignment are weighted and summed to obtain an initial processing index for the bank security alarm information to be managed.

[0017] Furthermore, when determining whether to adjust the initial processing index according to the historical alarm frequency, it includes:

[0018] Comparing the historical alarm frequency with a historical alarm frequency threshold, and determining whether to adjust the initial processing index based on the comparison result;

[0019] When the historical alarm frequency is greater than the historical alarm frequency threshold, determining to adjust the initial processing index;

[0020] When the historical alarm frequency is less than or equal to the historical alarm frequency threshold, it is determined that the initial processing index is not adjusted.

[0021] Furthermore, when calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score, it includes:

[0022] The processing unit detects the readability range of the decrypted bank security alarm information to be managed based on the readability assessment tool, and obtains the readability range ratio;

[0023] Comparing the readable range percentage with a first readable range percentage threshold and a second readable range percentage threshold, and determining the usability score according to the comparison result; wherein the first readable range percentage threshold is less than the second readable range percentage threshold;

[0024] When the readable range ratio is less than or equal to the first readable range ratio threshold, determining the usability score to be a first usability score;

[0025] When the readable range ratio is greater than the first readable range ratio threshold and less than or equal to the second readable range ratio threshold, determining the usability score to be a second usability score;

[0026] When the readable range ratio is greater than the second readable range ratio threshold, the usability score is determined to be a third usability score.

[0027] Furthermore, when calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score, the method further includes:

[0028] The processing unit obtains a security hash value according to the metadata of the security alarm information of the bank to be managed, and calculates a decrypted hash value according to the decrypted security alarm information of the bank to be managed;

[0029] Comparing the security hash value with the decrypted hash value, and determining an integrity score based on the comparison result;

[0030] When the security hash value is consistent with the decrypted hash value, determining the integrity score to be 1;

[0031] When the security hash value is inconsistent with the decrypted hash value, the integrity score is determined to be 0.

[0032] Furthermore, when calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score, the method further includes:

[0033] The treatment impact factor is obtained by the following formula:

[0034]

[0035] Among them, Y represents the processing impact factor; T represents the decryption time; Sk represents the availability score; Sw represents the integrity score; α represents the first weight coefficient; β represents the second weight coefficient; γ represents the third weight coefficient; δ represents the adjustment coefficient.

[0036] Furthermore, the historical alarm effectiveness index is obtained by the following formula:

[0037]

[0038] Among them, B represents the alarm effectiveness index; Z1 represents the number of alarms that actually cause problems; and Z represents the total number of alarm triggers.

[0039] Furthermore, obtaining an adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjusting the initial processing index according to the adjustment coefficient to obtain a final processing index includes:

[0040] Comparing the historical alarm effectiveness index with the historical alarm effectiveness index threshold, and comparing the processing impact factor with the processing impact factor threshold, respectively, and determining the adjustment coefficient of the initial processing index according to the comparison results;

[0041] When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a first adjustment coefficient, and taking the product value of the first adjustment coefficient and the initial processing index as the final processing index;

[0042] When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is greater than the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a second adjustment coefficient, and taking the product of the second adjustment coefficient and the initial processing index as the final processing index;

[0043] When the historical alarm validity index is greater than the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a third adjustment coefficient, and taking the product value of the third adjustment coefficient and the initial processing index as the final processing index;

[0044] When the historical alarm validity index is greater than the historical alarm validity index threshold and the processing impact factor is greater than the processing impact factor threshold, the adjustment coefficient of the initial processing index is determined to be the fourth adjustment coefficient, and the product value of the fourth adjustment coefficient and the initial processing index is used as the final processing index.

[0045] Furthermore, the bank security alarm information to be managed is divided into different processing priorities according to the final processing index, and the processing strategy for the bank security alarm information to be managed is selected according to the different processing priorities, including:

[0046] comparing the final processing index with a first final processing index and a second final processing index, determining a processing priority of the bank security alarm information to be managed based on the comparison result, and selecting a processing strategy for the bank security alarm information to be managed based on the different processing priorities; wherein the first final processing index is less than the second final processing index;

[0047] When the final processing index is less than or equal to the first final processing index, determining that the processing priority of the bank security alarm information to be managed is high priority, and determining that the processing strategy of the bank security alarm information to be managed is immediate response and priority processing;

[0048] When the final processing index is greater than the first final processing index and less than or equal to the second final processing index, determining that the processing priority of the bank security alarm information to be managed is medium priority, and determining that the processing strategy of the bank security alarm information to be managed is to be processed within a specified time;

[0049] When the final processing index is greater than the second final processing index, the processing priority of the bank security alarm information to be managed is determined to be low priority, and the processing strategy of the bank security alarm information to be managed is determined to be processed according to the normal process.

[0050] Compared with existing technologies, the present invention offers the following advantages: the intelligent alarm information management system is highly intelligent and automated, significantly improving the efficiency and accuracy of bank security alarm processing. By comprehensively considering multiple key indicators of alarm information, the system accurately assesses and categorizes alarms, ensuring rapid response to urgent and critical alarms. Furthermore, the system dynamically adjusts processing strategies based on historical data and real-time conditions to adapt to the ever-changing security environment and alarm requirements.

[0051] In another aspect, the present invention further proposes an intelligent alarm information management method, comprising the following steps:

[0052] S100: Collecting the alarm type and urgency of the bank security alarm information to be managed, and determining an initial processing index of the bank security alarm information to be managed based on the alarm type and urgency;

[0053] S200: Collecting historical alarm frequencies of the security alarm information of the bank to be managed, and determining whether to adjust the initial processing index according to the historical alarm frequencies;

[0054] S300: When it is determined that the initial processing index needs to be adjusted, the security alarm information of the bank to be managed is decrypted to obtain the decryption time, availability score, and integrity score of the security alarm information of the bank to be managed, and a processing impact factor of the initial processing index is calculated based on the decryption time, availability score, and integrity score;

[0055] S400: Collecting historical alarm effectiveness indexes corresponding to the alarm types of the bank security alarm information to be managed, obtaining an adjustment coefficient for the initial processing index based on the historical alarm effectiveness indexes and the processing impact factor, and adjusting the initial processing index according to the adjustment coefficient to obtain a final processing index;

[0056] S500: Classifying the bank security alarm information to be managed into different processing priorities according to the final processing index, and selecting a processing strategy for the bank security alarm information to be managed according to the different processing priorities.

[0057] It is understandable that the above-mentioned intelligent alarm information management method and system have the same beneficial effects, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0059] Figure 1 A structural diagram of the intelligent alarm information management system provided by an embodiment of the present invention;

[0060] Figure 2 This is a flow chart of the intelligent alarm information management method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, unless there is a conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0062] See Figure 1 As shown, in some embodiments of the present application, this embodiment provides an intelligent alarm information management system, including:

[0063] An alarm information management device and a control device, wherein the alarm information management device includes an alarm information storage database, an encryption module, a decryption module, and a management module. The encryption module obtains and encrypts the bank security alarm information to be managed from the alarm information storage database. The encrypted bank security alarm information to be managed is transmitted by the encryption module to the management module. The management module is connected to the decryption module, and the management module manages the bank security alarm information to be managed. The control device includes a collection unit, a judgment unit, a processing unit, and a classification unit. The control device is used to control the alarm information management device to manage alarm information.

[0064] The collecting unit is configured to collect the alarm type and urgency of the bank security alarm information to be managed, and determine the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency;

[0065] The judgment unit is configured to control the collection unit to collect the historical alarm frequency of the security alarm information of the bank to be managed, and judge whether to adjust the initial processing index according to the historical alarm frequency;

[0066] The processing unit is configured to, when determining to adjust the initial processing index, decrypt the security alarm information of the bank to be managed, obtain a decryption time, an availability score, and an integrity score of the security alarm information of the bank to be managed, and calculate a processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score;

[0067] The processing unit is further configured to control the collection unit to collect historical alarm effectiveness indexes corresponding to the alarm types of the bank security alarm information to be managed, obtain an adjustment coefficient for the initial processing index based on the historical alarm effectiveness indexes and the processing impact factor, and adjust the initial processing index according to the adjustment coefficient to obtain a final processing index;

[0068] The grading unit is configured to classify the bank security alarm information to be managed into different processing priorities according to the final processing index, and select a processing strategy for the bank security alarm information to be managed according to the different processing priorities.

[0069] It is understood that the intelligent alarm information management system provided in this embodiment achieves intelligent management of alarm information by collecting multiple key indicators of the bank security alarm information to be managed and using these indicators for comprehensive evaluation and processing. First, the system obtains the alarm type and urgency through the collection unit, which serves as the basis for determining the initial processing index. Subsequently, the judgment unit uses the historical alarm frequency as a reference to determine whether the initial processing index needs to be adjusted. If adjustment is required, the processing unit further intervenes and decrypts the alarm information to obtain the decryption time, availability score, and integrity score. These indicators together form the basis for calculating the processing impact factor. On this basis, the system also collects the historical alarm effectiveness index, combines it with the processing impact factor, and uses a complex algorithm to derive an adjustment coefficient. Ultimately, the initial processing index is adjusted to form a more accurate final processing index. Based on this index, the grading unit classifies the alarm information into different processing priorities and selects the corresponding processing strategy accordingly.

[0070] It can be understood that the intelligent alarm information management system provided by this embodiment is highly intelligent and automated, significantly improving the efficiency and accuracy of bank security alarm processing. By comprehensively considering multiple key indicators of alarm information, the system can accurately evaluate and classify alarm information, thereby ensuring a rapid response to urgent and important alarms. Furthermore, the system can dynamically adjust its processing strategies based on historical data and real-time conditions to adapt to the ever-changing security environment and alarm requirements.

[0071] Specifically, determining the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency includes:

[0072] Assigning values ​​to the alarm type and urgency respectively to obtain an alarm type value and an urgency value;

[0073] The alarm type assignment and the urgency assignment are weighted and summed to obtain an initial processing index for the bank security alarm information to be managed.

[0074] In this embodiment, alarm types include intrusion alarms, fire alarms, and robbery alarms. Intrusion alarms are assigned a score of 3, fire alarms are assigned a score of 5, and robbery alarms are assigned a score of 7. Urgency levels are divided into three levels: general, emergency, and special, with corresponding scores of 1, 3, and 5, respectively. By weightedly summing the alarm type and urgency values, the system can preliminarily assess the urgency and processing priority of the bank's security alarm information under management, providing important reference for subsequent processing. This simple and clear assignment method fully reflects the actual situation of the alarm information, ensuring that the system can respond accurately and quickly.

[0075] Specifically, determining whether to adjust the initial processing index according to the historical alarm frequency includes:

[0076] Comparing the historical alarm frequency with a historical alarm frequency threshold, and determining whether to adjust the initial processing index based on the comparison result;

[0077] When the historical alarm frequency is greater than the historical alarm frequency threshold, determining to adjust the initial processing index;

[0078] When the historical alarm frequency is less than or equal to the historical alarm frequency threshold, it is determined that the initial processing index is not adjusted.

[0079] It's understandable that historical alarm frequency is a key indicator of the importance and urgency of alarm information. If a certain type of alarm information has a high historical alarm frequency, it may indicate a higher probability of occurrence or potential risk. Therefore, it's necessary to adjust the initial processing index to increase attention and processing priority for that type of alarm information. Conversely, if the historical alarm frequency is low, it indicates a lower probability of occurrence or a lower risk. In this case, the initial processing index can be maintained unchanged to avoid unnecessary waste of resources. Through this judgment mechanism, the system can dynamically manage and optimize the processing of alarm information, ensuring efficient resource utilization and improved response speed.

[0080] Specifically, the calculation of the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score includes:

[0081] The processing unit detects the readability range of the decrypted bank security alarm information to be managed based on the readability assessment tool, and obtains the readability range ratio;

[0082] Comparing the readable range percentage with a first readable range percentage threshold and a second readable range percentage threshold, and determining the usability score according to the comparison result; wherein the first readable range percentage threshold is less than the second readable range percentage threshold;

[0083] When the readable range ratio is less than or equal to the first readable range ratio threshold, determining the usability score to be a first usability score;

[0084] When the readable range ratio is greater than the first readable range ratio threshold and less than or equal to the second readable range ratio threshold, determining the usability score to be a second usability score;

[0085] When the readable range ratio is greater than the second readable range ratio threshold, the usability score is determined to be a third usability score.

[0086] It is understandable that the first usability score is less than the second usability score and less than the third usability score. Through the readability assessment tool, the system can quantify the readability of the decrypted alarm information and provide an objective score for its usability. This step is crucial because it is directly related to the selection of subsequent processing strategies and the allocation of resources. If the alarm information is poorly readable, even the most important content may lose its value due to difficulty in understanding and utilizing it. Therefore, the system subdivides the usability score into three levels by setting different readability range percentage thresholds to ensure that it accurately reflects the actual readability of the alarm information and provide strong support for subsequent processing.

[0087] Specifically, when calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score, the following is further included:

[0088] The processing unit obtains a security hash value according to the metadata of the security alarm information of the bank to be managed, and calculates a decrypted hash value according to the decrypted security alarm information of the bank to be managed;

[0089] Comparing the security hash value with the decrypted hash value, and determining an integrity score based on the comparison result;

[0090] When the security hash value is consistent with the decrypted hash value, determining the integrity score to be 1;

[0091] When the security hash value is inconsistent with the decrypted hash value, the integrity score is determined to be 0.

[0092] In this embodiment, the security hash value refers to the unique identifier obtained by calculating the original data of the alarm information before encryption and storage through a specific algorithm, while the decryption hash value is the hash value recalculated after the alarm information is decrypted. By comparing these two hash values, the system can accurately determine whether the alarm information has been tampered with or damaged during the transmission and decryption process. If the two are consistent, it means that the alarm information is intact and the integrity score is 1, indicating that the system can perform subsequent processing on the alarm information. If the two are inconsistent, it means that there may be a problem with the alarm information during transmission or decryption. At this time, the integrity score is 0, and the system will mark or discard the alarm information to avoid misjudgment or missed judgment due to incomplete or erroneous alarm information. This hash value-based integrity verification method is not only simple and efficient, but also can ensure the accuracy and reliability of the alarm information, providing a strong guarantee for the stable operation of the system.

[0093] Specifically, when calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score, the following is further included:

[0094] The treatment impact factor is obtained by the following formula:

[0095]

[0096] Among them, Y represents the processing impact factor; T represents the decryption time; Sk represents the availability score; Sw represents the integrity score; α represents the first weight coefficient; β represents the second weight coefficient; γ represents the third weight coefficient; δ represents the adjustment coefficient.

[0097] In this embodiment, the preferred value of α is 0.3, the preferred value of β is 0.4, the preferred value of γ is 0.2, and the preferred value of δ is 0.1. By assigning weights in this way and setting adjustment coefficients, the system can comprehensively consider the impact of decryption time, availability score, and integrity score on the processing impact factor, ensuring the accuracy and rationality of the evaluation results.

[0098] It is understandable that the decryption time T reflects the efficiency of the system in processing alarm information. The usability score Sk and integrity score Sw respectively measure the readability of the alarm information and the degree to which its original appearance is preserved during transmission and storage.

[0099] As you can understand, the calculation formula for the processing impact factor Y comprehensively considers multiple factors, including decryption time T, availability score Sk, integrity score Sw, and adjustment coefficient δ, and weights them using the first weight coefficient α, the second weight coefficient β, and the third weight coefficient γ. This design aims to comprehensively evaluate key indicators of the alarm information processing process to ensure that the system can respond more accurately and appropriately.

[0100] Specifically, the historical alarm effectiveness index is obtained by the following formula:

[0101]

[0102] Among them, B represents the alarm effectiveness index; Z1 represents the number of alarms that actually cause problems; and Z represents the total number of alarm triggers.

[0103] It's understandable that the alarm effectiveness index B reflects the probability that alarm information will cause problems in actual applications and is an important indicator for measuring the accuracy and effectiveness of alarm information. By calculating the ratio of the number of alarms that actually cause problems, Z1, to the total number of alarm triggers, Z, the system can intuitively understand the reliability and practical value of alarm information. A high alarm effectiveness index indicates that the alarm information received by the system is highly accurate and effective, truly reflecting the bank's security status and providing strong support for subsequent processing. Conversely, a low alarm effectiveness index indicates that the system may contain a large number of false alarms or invalid alarms. In this case, the system needs to further optimize the alarm information collection and processing process to improve the accuracy and effectiveness of alarm information and reduce unnecessary resource waste.

[0104] Specifically, obtaining an adjustment coefficient of the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjusting the initial processing index according to the adjustment coefficient to obtain a final processing index includes:

[0105] Comparing the historical alarm effectiveness index with the historical alarm effectiveness index threshold, and comparing the processing impact factor with the processing impact factor threshold, respectively, and determining the adjustment coefficient of the initial processing index according to the comparison results;

[0106] When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a first adjustment coefficient, and taking the product value of the first adjustment coefficient and the initial processing index as the final processing index;

[0107] When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is greater than the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a second adjustment coefficient, and taking the product of the second adjustment coefficient and the initial processing index as the final processing index;

[0108] When the historical alarm validity index is greater than the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a third adjustment coefficient, and taking the product value of the third adjustment coefficient and the initial processing index as the final processing index;

[0109] When the historical alarm validity index is greater than the historical alarm validity index threshold and the processing impact factor is greater than the processing impact factor threshold, the adjustment coefficient of the initial processing index is determined to be the fourth adjustment coefficient, and the product value of the fourth adjustment coefficient and the initial processing index is used as the final processing index.

[0110] It can be understood that the adjustment coefficients are designed to dynamically adjust the initial processing index based on different combinations of historical alarm validity indexes and processing impact factors, ensuring that the final processing index more accurately reflects the actual urgency and processing priority of the alarm information. Through this adjustment mechanism, the system can achieve refined management and optimized processing of alarm information, improving processing efficiency and accuracy. The relationship between the first, second, third, and fourth adjustment coefficients is: first adjustment coefficient < second adjustment coefficient < third adjustment coefficient < fourth adjustment coefficient. This setting ensures that when processing different types of alarm information, resource allocation and response strategy selection are optimized based on their urgency and processing priority. If an alarm information's historical alarm validity index is low and its processing impact factor is also low, it may be of low importance or urgency. In this case, the system can select a smaller first adjustment coefficient, reducing the attention and processing priority of the alarm information. Conversely, if an alarm information's historical alarm validity index is high and its processing impact factor is also large, it may be of high importance and urgency. In this case, the system can select a larger fourth adjustment coefficient, increasing the attention and processing priority of the alarm information, ensuring timely and effective processing. Through such a dynamic adjustment mechanism, the system can realize intelligent management and optimized processing of alarm information, improve processing efficiency and accuracy, and provide more powerful support for the bank's security work.

[0111] Specifically, the bank security alarm information to be managed is divided into different processing priorities according to the final processing index, and the processing strategy of the bank security alarm information to be managed is selected according to the different processing priorities, including:

[0112] comparing the final processing index with a first final processing index and a second final processing index, determining a processing priority of the bank security alarm information to be managed based on the comparison result, and selecting a processing strategy for the bank security alarm information to be managed based on the different processing priorities; wherein the first final processing index is less than the second final processing index;

[0113] When the final processing index is less than or equal to the first final processing index, determining that the processing priority of the bank security alarm information to be managed is high priority, and determining that the processing strategy of the bank security alarm information to be managed is immediate response and priority processing;

[0114] When the final processing index is greater than the first final processing index and less than or equal to the second final processing index, determining that the processing priority of the bank security alarm information to be managed is medium priority, and determining that the processing strategy of the bank security alarm information to be managed is to be processed within a specified time;

[0115] When the final processing index is greater than the second final processing index, the processing priority of the bank security alarm information to be managed is determined to be low priority, and the processing strategy of the bank security alarm information to be managed is determined to be processed according to the normal process.

[0116] In this embodiment, the routine process refers to the standard steps and procedures for the system to process alarm information on a daily basis, including receiving alarm information, preliminary analysis, classification processing, resource allocation, execution of processing measures, recording feedback, etc.

[0117] It's understandable that classifying bank security alarms into different processing priorities and developing corresponding handling strategies are key steps in achieving efficient system response and optimizing resource allocation. High-priority alarms represent a higher level of urgency and processing requirements, requiring immediate system response and prioritization to ensure timely resolution and prevent further escalation. Medium-priority alarms, while slightly less urgent than high-priority ones, still require processing within a specified timeframe to prevent the accumulation and spread of potential risks. Low-priority alarms, on the other hand, can be handled according to standard procedures to ensure a balanced utilization of system resources and response speed. This processing strategy enables hierarchical management and optimized processing of alarms, ensuring a rapid response to high-urgency alarms while avoiding the delay in processing low-urgency alarms due to excessive resource allocation, thereby comprehensively improving overall security.

[0118] See Figure 2 As shown, in some embodiments of the present application, this embodiment provides an intelligent alarm information management method, including the following steps:

[0119] S100: Collecting the alarm type and urgency of the bank security alarm information to be managed, and determining an initial processing index of the bank security alarm information to be managed based on the alarm type and urgency;

[0120] S200: Collecting historical alarm frequencies of the security alarm information of the bank to be managed, and determining whether to adjust the initial processing index according to the historical alarm frequencies;

[0121] S300: When it is determined that the initial processing index needs to be adjusted, the security alarm information of the bank to be managed is decrypted to obtain the decryption time, availability score, and integrity score of the security alarm information of the bank to be managed, and a processing impact factor of the initial processing index is calculated based on the decryption time, availability score, and integrity score;

[0122] S400: Collecting historical alarm effectiveness indexes corresponding to the alarm types of the bank security alarm information to be managed, obtaining an adjustment coefficient for the initial processing index based on the historical alarm effectiveness indexes and the processing impact factor, and adjusting the initial processing index according to the adjustment coefficient to obtain a final processing index;

[0123] S500: Classifying the bank security alarm information to be managed into different processing priorities according to the final processing index, and selecting a processing strategy for the bank security alarm information to be managed according to the different processing priorities.

[0124] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or a combination of software and hardware embodiments. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0125] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0126] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0127] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. An intelligent alarm information management system, characterized in that: include: An alarm information management device and a control device, wherein the alarm information management device includes an alarm information storage database, an encryption module, a decryption module, and a management module. The encryption module obtains and encrypts the bank security alarm information to be managed from the alarm information storage database. The encrypted bank security alarm information to be managed is transmitted by the encryption module to the management module. The management module is connected to the decryption module, and the management module manages the bank security alarm information to be managed. The control device includes a collection unit, a judgment unit, a processing unit, and a classification unit. The control device is used to control the alarm information management device to manage alarm information. The collecting unit is configured to collect the alarm type and urgency of the bank security alarm information to be managed, and determine the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency; The judgment unit is configured to control the collection unit to collect the historical alarm frequency of the security alarm information of the bank to be managed, and judge whether to adjust the initial processing index according to the historical alarm frequency; The processing unit is configured to, when determining to adjust the initial processing index, decrypt the security alarm information of the bank to be managed, obtain a decryption time, an availability score, and an integrity score of the security alarm information of the bank to be managed, and calculate a processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score; The processing unit is further configured to control the collection unit to collect historical alarm effectiveness indexes corresponding to the alarm types of the bank security alarm information to be managed, obtain an adjustment coefficient for the initial processing index based on the historical alarm effectiveness indexes and the processing impact factor, and adjust the initial processing index according to the adjustment coefficient to obtain a final processing index; The grading unit is configured to classify the bank security alarm information to be managed into different processing priorities according to the final processing index, and select a processing strategy for the bank security alarm information to be managed according to the different processing priorities; Obtaining an adjustment coefficient for the initial processing index based on the historical alarm effectiveness index and the processing impact factor, and adjusting the initial processing index according to the adjustment coefficient to obtain a final processing index, including: Comparing the historical alarm effectiveness index with the historical alarm effectiveness index threshold, and comparing the processing impact factor with the processing impact factor threshold, respectively, and determining the adjustment coefficient of the initial processing index according to the comparison results; When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a first adjustment coefficient, and taking the product value of the first adjustment coefficient and the initial processing index as the final processing index; When the historical alarm validity index is less than or equal to the historical alarm validity index threshold, and the processing impact factor is greater than the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a second adjustment coefficient, and taking the product of the second adjustment coefficient and the initial processing index as the final processing index; When the historical alarm validity index is greater than the historical alarm validity index threshold, and the processing impact factor is less than or equal to the processing impact factor threshold, determining the adjustment coefficient of the initial processing index as a third adjustment coefficient, and taking the product value of the third adjustment coefficient and the initial processing index as the final processing index; When the historical alarm validity index is greater than the historical alarm validity index threshold and the processing impact factor is greater than the processing impact factor threshold, the adjustment coefficient of the initial processing index is determined to be the fourth adjustment coefficient, and the product value of the fourth adjustment coefficient and the initial processing index is used as the final processing index.

2. The intelligent alarm information management system according to claim 1, characterized in that: Determining the initial processing index of the bank security alarm information to be managed based on the alarm type and urgency includes: Assigning values ​​to the alarm type and urgency respectively to obtain an alarm type value and an urgency value; The alarm type assignment and the urgency assignment are weighted and summed to obtain an initial processing index for the bank security alarm information to be managed.

3. The intelligent alarm information management system according to claim 1, characterized in that: When determining whether to adjust the initial processing index according to the historical alarm frequency, the method includes: Comparing the historical alarm frequency with a historical alarm frequency threshold, and determining whether to adjust the initial processing index based on the comparison result; When the historical alarm frequency is greater than the historical alarm frequency threshold, determining to adjust the initial processing index; When the historical alarm frequency is less than or equal to the historical alarm frequency threshold, it is determined that the initial processing index is not adjusted.

4. The intelligent alarm information management system according to claim 1, characterized in that: Calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score includes: The processing unit detects the readability range of the decrypted bank security alarm information to be managed based on the readability assessment tool, and obtains the readability range ratio; Comparing the readable range percentage with a first readable range percentage threshold and a second readable range percentage threshold, and determining the usability score according to the comparison result; wherein the first readable range percentage threshold is less than the second readable range percentage threshold; When the readable range ratio is less than or equal to the first readable range ratio threshold, determining the usability score to be a first usability score; When the readable range ratio is greater than the first readable range ratio threshold and less than or equal to the second readable range ratio threshold, determining the usability score to be a second usability score; When the readable range ratio is greater than the second readable range ratio threshold, the usability score is determined to be a third usability score.

5. The intelligent alarm information management system according to claim 4, characterized in that: When calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score, the following is further included: The processing unit obtains a security hash value according to the metadata of the security alarm information of the bank to be managed, and calculates a decrypted hash value according to the decrypted security alarm information of the bank to be managed; Comparing the security hash value with the decrypted hash value, and determining an integrity score based on the comparison result; When the security hash value is consistent with the decrypted hash value, determining the integrity score to be 1; When the security hash value is inconsistent with the decrypted hash value, the integrity score is determined to be 0.

6. The intelligent alarm information management system according to claim 5, characterized in that: When calculating the processing impact factor of the initial processing index based on the decryption time, the availability score, and the integrity score, the following is further included: The treatment impact factor is obtained by the following formula: Among them, Y represents the processing impact factor; T represents the decryption time; Sk represents the availability score; Sw represents the integrity score; α represents the first weight coefficient; β represents the second weight coefficient; γ represents the third weight coefficient; δ represents the adjustment coefficient.

7. The intelligent alarm information management system according to claim 1, characterized in that: The historical alarm effectiveness index is obtained by the following formula: Among them, B represents the alarm effectiveness index; Z1 represents the number of alarms that actually cause problems; and Z represents the total number of alarm triggers.

8. The intelligent alarm information management system according to claim 1, characterized in that: Classifying the bank security alarm information to be managed into different processing priorities according to the final processing index, and selecting a processing strategy for the bank security alarm information to be managed according to the different processing priorities, including: comparing the final processing index with a first final processing index and a second final processing index, determining a processing priority of the bank security alarm information to be managed based on the comparison result, and selecting a processing strategy for the bank security alarm information to be managed based on the different processing priorities; wherein the first final processing index is less than the second final processing index; When the final processing index is less than or equal to the first final processing index, determining that the processing priority of the bank security alarm information to be managed is high priority, and determining that the processing strategy of the bank security alarm information to be managed is immediate response and priority processing; When the final processing index is greater than the first final processing index and less than or equal to the second final processing index, determining that the processing priority of the bank security alarm information to be managed is medium priority, and determining that the processing strategy of the bank security alarm information to be managed is to be processed within a specified time; When the final processing index is greater than the second final processing index, the processing priority of the bank security alarm information to be managed is determined to be low priority, and the processing strategy of the bank security alarm information to be managed is determined to be processed according to the normal process.

9. An intelligent alarm information management method, applied to the intelligent alarm information management system according to any one of claims 1 to 8, characterized in that: include: Collecting the alarm type and urgency of the bank security alarm information to be managed, and determining an initial processing index of the bank security alarm information to be managed based on the alarm type and urgency; Collecting historical alarm frequencies of the security alarm information of the bank to be managed, and determining whether to adjust the initial processing index according to the historical alarm frequencies; When it is determined that the initial processing index is to be adjusted, decrypting the security alarm information of the bank to be managed, obtaining the decryption time, availability score, and integrity score of the security alarm information of the bank to be managed, and calculating the processing impact factor of the initial processing index based on the decryption time, availability score, and integrity score; Collecting historical alarm effectiveness indexes corresponding to the alarm types of the bank security alarm information to be managed, obtaining an adjustment coefficient for the initial processing index based on the historical alarm effectiveness indexes and the processing impact factor, and adjusting the initial processing index according to the adjustment coefficient to obtain a final processing index; The bank security alarm information to be managed is divided into different processing priorities according to the final processing index, and a processing strategy for the bank security alarm information to be managed is selected according to the different processing priorities.

Images