A method and related device for processing a security alert whitelist

Abstract

The application provides a processing method for security alarm whitelist management and a related device. The method comprises the following steps: obtaining a first alarm whitelist and first alarm information matched with the first alarm whitelist, and obtaining second alarm information generated in a first set time period; determining matched alarm information matched with the first alarm whitelist from the second alarm information, and determining similar alarm information similar to the first alarm information from the second alarm information; determining a quality evaluation result of the first alarm whitelist according to the number of the second alarm information, the number of the matched alarm information and the number of the similar alarm information; and optimizing the first alarm whitelist in response to the quality evaluation result of the first alarm whitelist not satisfying a first set condition. The method effectively evaluates the quality of the alarm whitelist, guarantees the quality of the alarm whitelist, and ensures the protection performance of a security protection product (such as a CWPP, a HIDS or a CSPM).

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device, computer-readable storage medium, and computer program product for processing a security alert whitelist. Background Art

[0002] With the continuous development of computer technology, security protection products for security testing have emerged. Security protection products can test computing devices such as computers and hosts, or virtual operating environments such as containers, thereby ensuring operational security.

[0003] Typically, security products support configuring an alarm whitelist, which can be used to identify and exclude unimportant alarms. This means that if an alarm matches a whitelisted item, it will not trigger an alarm event.

[0004] However, whether it is a manually written alarm whitelist or an alarm whitelist generated using a model, the quality of the alarm whitelist is difficult to guarantee. Poor quality alarm whitelists can affect the protection performance of security protection products. Summary of the Invention

[0005] This application provides a method for processing a security alert whitelist. This method can effectively evaluate the quality of the alert whitelist and ensure the protective performance of security protection products. This application also provides a device, electronic device, computer-readable storage medium, and computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides a method for processing a security alert whitelist, the method comprising:

[0007] Obtaining a first alarm whitelist and first alarm information matching the first alarm whitelist, and obtaining second alarm information generated within a first set time period; wherein the first alarm information and the second alarm information are associated with an alarm tag, and the alarm tag is used to indicate whether it is a false alarm;

[0008] Determining, from the second alarm information, matching alarm information that matches the first alarm whitelist, and determining, from the second alarm information, similar alarm information that is similar to the first alarm information;

[0009] Determining a quality assessment result of the first alarm whitelist according to the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information;

[0010] In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, optimizing the first alarm whitelist.

[0011] In a second aspect, the present application provides a device for processing a security alert whitelist, the device comprising:

[0012] an acquisition module, configured to acquire a first alarm whitelist and first alarm information matching the first alarm whitelist, and to acquire second alarm information generated within a first set time period; wherein the first alarm information and the second alarm information are associated with an alarm tag, the alarm tag being used to indicate whether the alarm is a false alarm;

[0013] a determining module, configured to determine, from the second alarm information, matching alarm information that matches the first alarm whitelist, and, from the second alarm information, determine similar alarm information that is similar to the first alarm information;

[0014] An evaluation module, configured to determine a quality evaluation result of the first alarm whitelist according to the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information;

[0015] The optimization module is configured to optimize the first alarm whitelist in response to a quality evaluation result of the first alarm whitelist failing to meet a first set condition.

[0016] In a third aspect, the present application provides an electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is configured to execute instructions stored in the memory to cause the electronic device to perform the security alert whitelist processing method described in the first aspect or any implementation of the first aspect.

[0017] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and the instructions instruct the electronic device to execute the security alert whitelist processing method described in the above-mentioned first aspect or any implementation method of the first aspect.

[0018] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the method for processing the security alert whitelist as described in the first aspect or any one of the implementations of the first aspect.

[0019] Based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods.

[0020] It can be seen from the above technical solutions that this application has the following advantages:

[0021] The present application provides a method for processing a security alarm whitelist, which first obtains a first alarm whitelist and a first alarm message that matches the first alarm whitelist, and obtains second alarm message generated within a first set time period, wherein the first alarm message and the second alarm message are associated with an alarm tag, and the alarm tag is used to indicate whether it is a false alarm. From the second alarm message, matching alarm information that matches the first alarm whitelist is determined, and similar alarm information that is similar to the first alarm information is determined from the second alarm message. According to the number of second alarm messages, the number of matching alarm messages, and the number of similar alarm messages, a quality assessment result of the first alarm whitelist is determined. In response to the quality assessment result of the first alarm whitelist not meeting the first set condition, the first alarm whitelist is optimized.

[0022] In this method, by determining the number of second alarm messages within the historical time period, the number of matching alarm messages in the second alarm messages that can be matched by the alarm whitelist, and the number of similar alarm messages that are similar to the alarm messages matched by the alarm whitelist, the overall performance of the alarm whitelist is quantified, and the quality of the alarm whitelist is effectively evaluated. When the quality is unqualified, the alarm whitelist is optimized to ensure the quality of the alarm whitelist and the protection performance of the security protection product. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical methods of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments.

[0024] Figure 1 A flowchart of a method for processing a security alert whitelist provided in an embodiment of the present application;

[0025] Figure 2 A flowchart of a method for processing a security alert whitelist provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of the structure of a security alarm whitelist processing device provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The terms "first" and "second" in the embodiments of this application are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, features specified as "first" or "second" may explicitly or implicitly include one or more of the features.

[0029] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0030] With the continuous advancement of computer technology, security protection products have emerged to conduct security checks and ensure the operational security of computing devices such as computers and hosts, or virtual operating environments such as containers. Security protection products can perform multifaceted security checks across a variety of operational scenarios. For example, a cloud workload protection platform (CWPP) can perform checks on both host and network security. Another example is a host-based intrusion detection system (HIDS), which can perform security checks on the behavior and state of computer systems. Another example is cloud security posture management (CSPM), which can assess and manage cloud security risks and identify configuration errors and security vulnerabilities in cloud environments.

[0031] Security protection products typically support the configuration of alarm whitelists. Alarm whitelists, also known as security alarm whitelists, can be used to identify and exclude unimportant alarms. Specifically, an alarm whitelist includes alarms that are configured as requiring no action. When an alarm message matches a message on the alarm whitelist, it is ignored and does not trigger an alarm event. This process is also known as "whitelisting" the alarm message, and the alarm message is also known as "whitelisted alarm information." By configuring an alarm whitelist, security protection focuses on important alarm messages, improving security operations and maintenance efficiency.

[0032] In related technologies, alarm whitelists are often manually compiled or automatically generated using models. In the manual compilation method, users (e.g., security operations personnel) compile alarm whitelists based on their security operations experience. In the automatic model-based generation method, a model (e.g., one with alarm information analysis capabilities) analyzes historical alarm information and automatically generates an alarm whitelist.

[0033] However, whether manually compiled or model-generated, the quality of whitelists is difficult to guarantee. Poor whitelists can negatively impact the performance of security products. Furthermore, relevant technologies lack reliable and effective whitelist quality assessment schemes. Typically, these schemes can only verify the effectiveness of whitelists, but not their quality.

[0034] In view of this, the present application provides a method for processing a security alarm whitelist, which first obtains a first alarm whitelist and a first alarm information that matches the first alarm whitelist, and obtains a second alarm information generated within a first set time period, wherein the first alarm information and the second alarm information are associated with an alarm label, and the alarm label is used to indicate whether it is a false alarm. From the second alarm information, matching alarm information that matches the first alarm whitelist is determined, and similar alarm information similar to the first alarm information is determined from the second alarm information. According to the number of second alarm information, the number of matching alarm information and the number of similar alarm information, the quality evaluation result of the first alarm whitelist is determined. In response to the quality evaluation result of the first alarm whitelist not meeting the first set condition, the first alarm whitelist is optimized.

[0035] In this method, by determining the number of second alarm messages within the historical time period, the number of matching alarm messages in the second alarm messages that can be matched by the alarm whitelist, and the number of similar alarm messages that are similar to the alarm messages matched by the alarm whitelist, the overall performance of the alarm whitelist is quantified, and the quality of the alarm whitelist is effectively evaluated. When the quality is unqualified, the alarm whitelist is optimized to ensure the quality of the alarm whitelist and the protection performance of the security protection product.

[0036] To facilitate understanding of the technical solutions provided in the embodiments of the present application, the following description will be made with reference to the accompanying drawings. Figure 1 The flowchart of a method for managing an alarm whitelist is shown in FIG. , and the method specifically includes:

[0037] S101: Acquire a first alarm whitelist and first alarm information matching the first alarm whitelist, and acquire second alarm information generated within a first set time period.

[0038] The first alarm whitelist can be understood as an alarm whitelist with quality assessment requirements. The alarm information may lead to the occurrence of an alarm event, wherein the alarm event can be understood as an event that may generate an operational risk. In an embodiment of the present application, the alarm information (including the first alarm information, the second alarm information, the matching alarm information, and the similar alarm information) can be composed of multiple alarm fields. For example, the alarm information may include a command line field, a parent process command line field, a process group command line field, a process tree information field, a runtime link field, an execution directory field, etc.

[0039] In some possible implementations, the first alarm whitelist can be in the form of a regular expression. That is, the alarm information is whitelisted by performing a regular expression match against the first alarm whitelist. Furthermore, since alarm information can consist of multiple alarm fields, the first alarm whitelist can include regular expressions corresponding to multiple alarm fields. Regular expressions corresponding to different alarm fields can have different logical relationships, such as "and" or "or."

[0040] For example, the first alarm whitelist can include the regular expression "python3.7-m pyspark.xxxx" corresponding to the "process group command line", the regular expression " / opt / xxxx / yyyy / container" corresponding to the "execution directory", and the regular expression "tar-xxx\.\ / yyyy-Network.*-C\.\ / yyyy-Network" corresponding to the "process command line". The regular expressions corresponding to the three alarm fields can be in an "and" logical relationship.

[0041] The first alarm information that matches the first alarm whitelist can be understood as the alarm information related to the first alarm whitelist. The first alarm whitelist can whitelist the first alarm information. The embodiment of the present application supports obtaining the first alarm whitelist and the first alarm information in different ways, which are introduced below.

[0042] In some embodiments, the first alarm information may be alarm information that generates a first alarm whitelist. In other words, after the first alarm information is generated, a first alarm whitelist is generated to whitelist the first alarm information using the first alarm whitelist. Specifically, in response to receiving multiple alarm messages within a second set time period, the multiple alarm messages received within the second set time period being similar, and the proportion of alarm tags associated with the multiple alarm messages received within the second set time period indicating false alarms meeting a second set condition, a first alarm whitelist is generated based on the multiple alarm messages received within the second set time period, and the multiple alarm messages received within the second set time period are determined to be first alarm messages associated with the first alarm whitelist.

[0043] In other words, the scenario for evaluating the alarm whitelist may be: evaluating the newly generated first alarm whitelist. In this scenario, the second set time period can be understood as the time period used to determine whether a new alarm whitelist needs to be generated. Typically, the second set time period is relatively short, for example, the second set time period may be one day before the current time.

[0044] The similarity of the multiple alarm messages received within the second set time period can be understood as the similarity of the multiple alarm messages received within the second set time period being greater than the first similarity threshold, that is, multiple similar alarm messages are generated within the second set time period.

[0045] For multiple alarm messages generated within the second set time period, a user (e.g., a security operations and maintenance personnel) or a security protection product can determine whether they are false alarms and generate alarm tags associated with each of the multiple alarm messages generated within the second set time period. The second set condition can be understood as that the proportion of alarm tags associated with the multiple alarm messages received within the second set time period that indicate false alarms is greater than a proportion threshold, that is, multiple alarm messages that are false alarms were generated within the second set time period.

[0046] Combined with the above two conditions, when multiple similar alarm messages that are false alarms are generated within the second set time period, it indicates that the multiple alarm messages generated within the second set time period should be whitelisted through the alarm whitelist to avoid frequent false alarms. Therefore, a new first alarm whitelist is generated. For example, the first alarm whitelist is written by a user (such as a security operation and maintenance personnel), or the first alarm whitelist is automatically generated using a model. The newly generated first alarm whitelist can be understood as an alarm whitelist that can match multiple alarm messages received within the second set time period, that is, based on the multiple alarm messages received within the second set time period, a new first alarm whitelist is generated. In this case, the first alarm message is multiple alarm messages received within the second set time period.

[0047] In other embodiments, the first alarm information may be alarm information that has been whitelisted by a first alarm whitelist. In other words, with respect to an existing first alarm whitelist, during operation of the security protection product, the first alarm information is whitelisted by the first alarm whitelist. Specifically, a first alarm whitelist is determined from a set of alarm whitelists, multiple alarm information matching the first alarm whitelist within a third set time period is obtained, and the multiple alarm information matching the first alarm whitelist within the third set time period is determined as the first alarm information matching the first alarm whitelist.

[0048] That is, the scenario for evaluating the alarm whitelist may be: evaluating the existing first alarm whitelist. In this scenario, the third set time period may be understood as the time period for determining the first alarm information, and the length of the third set time period may be determined based on actual evaluation requirements.

[0049] In this case, the first alarm information may be a plurality of alarm information that matches the first alarm whitelist within the third set time period, that is, the alarm information whitelisted within the third set time period.

[0050] The second alarm information can be understood as the alarm information generated within the historical time period (i.e., the first set time period). In the embodiment of the present application, the second alarm information can be used as evaluation information for evaluating the quality of the first alarm whitelist. The first set time period can be set based on actual evaluation requirements. For example, the first set time period can be one month before the current time.

[0051] In an embodiment of the present application, the first alarm information and the second alarm information are associated with an alarm tag, and the alarm tag can be used to indicate whether it is a false alarm. In other words, by associating the alarm tag, for example, a user (such as a security operation and maintenance personnel) or a security protection product marks the first alarm information or the second alarm information as a false alarm or not (i.e., a real alarm). In the subsequent alarm whitelist evaluation process, the alarm tag is combined with the alarm label for quantitative evaluation.

[0052] S102: Determine, from the second alarm information, matching alarm information that matches the first alarm whitelist, and determine, from the second alarm information, similar alarm information that is similar to the first alarm information.

[0053] The second alarm information is whitelisted using the first alarm whitelist, and alarm information in the second alarm information that can be whitelisted by the first alarm whitelist is screened out. For example, when the first alarm whitelist is in the form of a regular expression, alarm information in the second alarm information that satisfies the regular expression of the first alarm whitelist is screened out. In the embodiment of the present application, the alarm information that can be whitelisted by the first alarm whitelist is referred to as matching alarm information. It can be understood that matching alarm information is part of the alarm information in the second alarm information.

[0054] The first alarm information is used to perform a similarity calculation on the second alarm information, and alarm information in the second alarm information having a high similarity with the first alarm information is screened out. For example, alarm information in the second alarm information having a similarity greater than a second similarity threshold is screened out. In the embodiment of the present application, the alarm information in the second alarm information having a high similarity with the first alarm information is referred to as similar alarm information. It is understandable that the similar alarm information is part of the alarm information in the second alarm information.

[0055] Similarly, since the second alarm information is associated with an alarm tag, the matching alarm information and the similar alarm information are also associated with an alarm tag, and the matching alarm information and the similar alarm information can continue to use the alarm tag associated with the second alarm information.

[0056] S103: Determine a quality assessment result of the first alarm whitelist according to the number of second alarm information, the number of matching alarm information, and the number of similar alarm information.

[0057] In the embodiment of the present application, the quality assessment result can be used to evaluate one or more of the matching efficiency, matching stability, and matching accuracy of the first alarm whitelist. In other words, the quality of the first alarm whitelist is comprehensively assessed from one or more of the three dimensions of matching efficiency, matching stability, and matching accuracy.

[0058] Matching efficiency can be understood as whitelisting efficiency. In other words, matching efficiency can be used to measure the proportion of false alarms whitelisted by the first alarm whitelist. Matching stability can be understood as whitelisting stability. In other words, matching stability can be used to measure the proportion of similar alarms correctly whitelisted by the first alarm whitelist. Matching accuracy can be understood as whitelisting precision. In other words, matching accuracy can be used to measure the proportion of incorrect whitelisted alarms by the first alarm whitelist.

[0059] In specific implementations, different quality indicator values ​​are used to represent the evaluation results under different dimensions, and then the different quality indicator values ​​are combined to determine the final quality evaluation result. Based on the number of second alarm messages, the number of matching alarm messages, and the number of similar alarm messages, one or more of the first quality indicator value, the second quality indicator value, and the third quality indicator value are determined. Based on the first quality indicator value, the second quality indicator value, and the third quality indicator value, the quality evaluation result of the first alarm whitelist is determined.

[0060] Among them, the first quality index value can be used to characterize the matching efficiency of the first alarm whitelist, the second quality index value can be used to characterize the matching stability of the first alarm whitelist, and the third quality index value can be used to characterize the matching accuracy of the first alarm whitelist.

[0061] In this way, first determine the quality indicator values ​​corresponding to one or more of the three dimensions of matching efficiency, matching stability and matching accuracy, and then combine the quality indicator values ​​corresponding to one or more of the three dimensions to determine the quality assessment results of the first alarm whitelist, realize the quantitative assessment of the first alarm whitelist from different dimensions, detect the quality of the alarm whitelist in real time, and ensure the continuity and effectiveness of security protection.

[0062] In some possible implementations, the alarm tag may include a first alarm tag and a second alarm tag. The first alarm tag may be used to indicate that the alarm is not a false alarm, and the second alarm tag may be used to indicate that the alarm is a false alarm. In this case, one or more of the following operations are performed: a first quality indicator value is determined based on the number of matching alarm messages associated with the second alarm tag and the number of second alarm messages associated with the second alarm tag. A second quality indicator value is determined based on the number of matching alarm messages associated with the second alarm tag and the number of similar alarm messages associated with the second alarm tag during multiple unit times of a first set time period. A third quality indicator value is determined based on the number of matching alarm messages associated with the first alarm tag and the number of second alarm messages.

[0063] That is to say, the matching efficiency of the first alarm whitelist is determined by judging what proportion of false alarms the first alarm whitelist can whiten. The matching stability of the first alarm whitelist is determined by judging how much of the false alarms the first alarm whitelist can whiten in similar alarm information change over multiple unit times. The matching accuracy of the first alarm whitelist is determined by judging the proportion of alarm information that is incorrectly whitened by the first alarm whitelist. In this way, a quantitative evaluation is performed on one or more of the matching efficiency, matching stability, and matching accuracy of the first alarm whitelist based on the number of second alarm information, the number of matching alarm information, the number of similar alarm information, and the alarm tags associated with the above alarm information.

[0064] In some embodiments, the first quality indicator value is recorded as E, the number of matching alarm information associated with the second alarm tag is recorded as LowAlertMatched, and the number of second alarm information associated with the second alarm tag is recorded as LowAlertTotal, then E = LowAlertMatched / LowAlertTotal, that is, the first quality indicator value is obtained by dividing the number of matching alarm information associated with the second alarm tag by the number of second alarm tags associated with the second alarm information, which represents the proportion of false alarms that can be whitelisted by the first alarm whitelist.

[0065] Let the matching rate be M, and the number of similar alarm messages associated with the second alarm label be LowAlertSimilar, then M = LowAlertMatched / LowAlertSimilar, that is, the matching rate M represents the proportion of false alarms that the first alarm whitelist can match in similar alarm messages. The denominator of the matching rate M is the number of alarm messages that are false alarms in similar alarm messages, so it is not easily affected by fluctuations in the number of second alarm messages. For example, if the frequency of the second alarm message is affected by time fluctuations, when the number of second alarm messages is small, the first quality indicator value E will decrease accordingly, but because the number of similar alarm messages will also decrease, the matching rate M will be less affected.

[0066] The standard deviation of the matching rate is recorded as SD, and the following formula is obtained:

[0067]

[0068] Wherein, n represents multiple unit times of the first set time period. For example, when the first set time period is one month before the current time, n can represent one week therein. i represents the matching rate of the i-th unit time, Represents the mean of the matching rates over n time units. In other words, the matching rate for each time unit within the first set time period is calculated. Based on the matching rate for each time unit within the first set time period, the matching rate standard deviation (SD) is determined to characterize the temporal stability of the matching rate. A smaller SD indicates a more stable matching rate.

[0069] The matching rate stability is denoted as F, then F = 1 / (SD + 0.001), that is, the matching rate stability is the inverse of the matching rate standard deviation. 0.001 is added to the denominator to prevent the denominator from being 0 due to the matching rate standard deviation being 0. The larger F is, the more stable the matching rate is. The maximum value of F is 1000.

[0070] Let the stability coefficient be G, the duration of the first set time period be TotalAlertTime, and the duration that similar alarm information appears in the first set time period be SimilarAlertTime, then G = SimilarAlertTime / TotalAlertTime, that is, the stability coefficient is the duration that similar alarm information appears divided by the total duration of the second alarm information. For similar alarm information, if the time window of appearance is long, it indicates that the behavior corresponding to the similar alarm information appears for a long time, and it is necessary to focus on the stability of the alarm whitelist. Conversely, if the time window of appearance is short, it indicates that the behavior corresponding to the similar alarm information appears occasionally, and there is no need to focus on the stability of the alarm whitelist.

[0071] The second quality index value is G×F, that is, the second quality index value is obtained by multiplying the matching rate stability by the stability coefficient. In actual applications, the longer the life cycle of similar alarm information, the less stable the first alarm whitelist. Only when the life cycle of similar alarm information is short can the first alarm whitelist be more stable. In other words, the matching rate stability and the stability coefficient are negatively correlated. By multiplying the two, the second quality index value for evaluating the matching efficiency of the first alarm whitelist can be obtained while reducing the order of magnitude.

[0072] Let the false alarm rate be L, the number of matching alarm information associated with the first alarm label be HighAlertMatched, and the number of second alarm information be AlertTotal, then L = HighAlertMatched / AlertTotal, that is, the false alarm rate is the number of matching alarm information associated with the first alarm label divided by the number of second alarm information, which represents the proportion of the first alarm whitelist that may cause leakage (that is, alarm information that should not be whitelisted is whitelisted).

[0073] The third quality indicator value is 1-L, that is, the difference between the third quality indicator value 1 and the false negative rate, which can be used to evaluate the matching accuracy of the first alarm whitelist.

[0074] The quality assessment result is recorded as Q, where Q = E + G × F + (1-L). That is, the quality assessment result is the sum of the first quality index value, the second quality index value, and the third quality index value. In this way, by quantitatively evaluating the matching efficiency, matching stability, and matching accuracy of the first alarm whitelist, a comprehensive assessment result of the first alarm whitelist is obtained.

[0075] S104: In response to the quality assessment result of the first alarm whitelist not satisfying the first set condition, optimizing the first alarm whitelist.

[0076] The first set condition can be understood as a condition that characterizes that the quality of the alarm whitelist meets the requirements. For example, the first set condition may be that the quality assessment result is greater than or equal to the quality assessment threshold. In other words, when the quality assessment result of the first alarm whitelist is less than the quality assessment threshold, it indicates that the quality of the first alarm whitelist does not meet the requirements.

[0077] When the quality of the first alarm whitelist does not meet the requirements, the first alarm whitelist is optimized to improve the quality of the first alarm whitelist and enhance the performance of the first alarm whitelist.

[0078] In this method, by determining the number of second alarm messages within the historical time period, the number of matching alarm messages in the second alarm messages that can be matched by the alarm whitelist, and the number of similar alarm messages that are similar to the alarm messages matched by the alarm whitelist, the overall performance of the alarm whitelist is quantified, and the quality of the alarm whitelist is effectively evaluated. When the quality is unqualified, the alarm whitelist is optimized to ensure the quality of the alarm whitelist and the protection performance of the security protection product.

[0079] See also Figure 2 In the alarm whitelist management method provided in the embodiment of the present application, the security protection product may include an alarm whitelist evaluator and an alarm whitelist optimizer. The alarm whitelist evaluator may evaluate the quality of the first alarm whitelist in combination with the first alarm whitelist and the second alarm information. When the quality evaluation result of the first alarm whitelist does not meet the first set condition, the alarm whitelist optimizer may optimize the first alarm whitelist to obtain an optimized first alarm whitelist, thereby improving the quality of the first alarm whitelist.

[0080] The specific process of optimizing the first alarm whitelist is described below. In some possible implementations, in response to a quality assessment result of the first alarm whitelist not meeting a first set condition, an optimization parameter value is determined, and the first alarm whitelist is optimized based on the optimization parameter value.

[0081] The optimized parameter value can be understood as the parameter value used to generate the optimized first alarm whitelist. That is, based on the optimized parameter value, the quality of the first alarm whitelist is optimized to generate the optimized first alarm whitelist. The optimized parameter value may include at least one of the following: a first parameter value used to determine a plurality of third alarm information, based on which the optimized first alarm whitelist is generated; a second parameter value used to indicate the alarm fields included in the optimized first alarm whitelist or the logical relationship between the alarm fields included in the optimized first alarm whitelist; a third parameter value used to describe the characteristics of the optimized first alarm whitelist.

[0082] In other words, the first parameter value can be understood as a similarity threshold for aggregating alarm information. By adjusting the first parameter value, the third alarm information is obtained by aggregating with different similarity thresholds, and the first alarm whitelist is regenerated using different third alarm information. The second parameter value can be understood as the alarm fields involved in the optimized first alarm whitelist and / or the logical relationship between different alarm fields in the optimized first alarm whitelist (for example, regular expressions corresponding to different alarm fields). By adjusting the second parameter value, the optimized first alarm whitelist includes different alarm fields, or is composed of alarm whitelists corresponding to alarm fields with different logical relationships. The third parameter value can be used to characterize the optimization direction of the first alarm whitelist. For example, the third parameter value can be used to emphasize the high accuracy and strong generalization of the optimized first alarm whitelist, so as to focus on improving the quality of the first alarm whitelist in a certain feature.

[0083] In an embodiment of the present application, the optimization process of the first alarm whitelist is converted into a process of determining the optimization parameter values. By adjusting the optimization parameter values, the first alarm whitelist can be optimized based on the optimization requirements, and the optimized first alarm whitelist can be adaptively generated in different environments.

[0084] In some embodiments, the optimized parameter value includes a first parameter value, a second parameter value, and a third parameter value. The process of optimizing the first alarm whitelist can be as follows: determining multiple third alarm information whose similarity with the first alarm information satisfies the first parameter value, modifying the multiple third alarm information so that the modified multiple third alarm information only includes the alarm field indicated by the second parameter value, generating a first prompt word, sending the first prompt word to the language model, and receiving the optimized first alarm whitelist returned by the language model.

[0085] That is, during the optimization of the first alarm whitelist, first, based on the first parameter value, multiple third alarm information pieces are determined for regenerating the first alarm whitelist. This allows the multiple third alarm information pieces to be used to subsequently regenerate the alarm whitelist, thereby optimizing the first alarm whitelist. Next, based on the second parameter value, the alarm fields indicated by the second parameter value in the multiple third alarm information pieces are retained, so that the subsequently generated optimized first alarm whitelist only includes the alarm fields indicated by the second parameter value. Finally, the language model is used to automatically generate the optimized first alarm whitelist.

[0086] The language model can be a language model that has natural language processing capabilities, can understand the meaning of natural language, and can handle different types of natural language tasks. For example, the language model can be a deep learning model trained using text data.

[0087] In an embodiment of the present application, the language model optimizes the first warning whitelist based on prompt learning. Prompts can be used to guide the language model to specific outputs in generative tasks (e.g., text generation tasks, question-answering tasks, and dialogue tasks). By configuring prompts, the language model understands the context and requirements of the task, enabling it to handle different types of natural language processing tasks without retraining the language model, thereby increasing its scalability and flexibility.

[0088] Specifically, the first prompt word includes: modified multiple third alarm information, information used to indicate that an alarm whitelist that satisfies the logical relationship between the alarm fields indicated by the second parameter value is generated based on the modified multiple third alarm information, and a third parameter value used to describe the characteristics of the alarm whitelist to be generated.

[0089] Since the first prompt word includes the above information, the language model can generate an alarm whitelist based on the prompt ability of the first prompt word and the modified multiple third alarm information according to the characteristics described by the third parameter value, so that the logical relationship between each alarm field in the optimized first alarm whitelist satisfies the second parameter value.

[0090] For example, the first prompt word can be as follows:

[0091] "You are an excellent false alarm analysis expert. Please generate a suitable alarm whitelist based on the following similar alarm information. The logical relationship between the alarm fields in the alarm whitelist satisfies [second parameter value].

[0092] Warning information: [modified multiple third warning information]

[0093] Constraints: [the third parameter value used to describe the characteristics of the alarm whitelist to be generated]"

[0094] The embodiments of the present application support determining optimization parameter values ​​in different ways, and three ways are used as examples below to illustrate.

[0095] The first method: prior knowledge optimization.

[0096] In response to the quality assessment result of the first alarm whitelist not meeting the first set condition, determine the size relationship between the first quality index value and the first index threshold, the size relationship between the second quality index value and the second index threshold, and the size relationship between the third quality index value and the third index threshold, and determine the optimization parameter value based on the size relationship between the first quality index value and the first index threshold, the size relationship between the second quality index value and the second index threshold, and the size relationship between the third quality index value and the third index threshold.

[0097] In other words, different quality indicator values ​​correspond to different indicator thresholds. By comparing the quality indicator values ​​with the indicator thresholds, we can determine which dimension or dimensions of the first warning whitelist have quality deficiencies. Furthermore, optimization rules are pre-defined for each dimension, allowing targeted optimization to be performed on those dimensions of the first warning whitelist with quality deficiencies.

[0098] For example, when the first quality indicator value is less than the first indicator threshold, it indicates that there is a defect in the quality of the first alarm whitelist in the dimension of matching efficiency. In this case, the optimization parameter value can be set to a smaller first parameter value, and the second parameter value in the optimization parameter value can indicate that the "and" logical relationship between multiple alarm fields is reduced and the "or" logical relationship is increased.

[0099] When the second quality indicator value is less than the second indicator threshold, it indicates that the quality of the first alarm whitelist in the dimension of matching stability is defective. In this case, the third parameter value in the optimization parameter value can describe the enhancement of the generalization of the first alarm whitelist.

[0100] When the third alarm index value is less than the third index threshold, it indicates that there is a defect in the quality of the first alarm whitelist in the dimension of matching accuracy. In this case, the optimization parameter value can be set to a larger first parameter value, and the second parameter value in the optimization parameter value can indicate that the "and" logical relationship between multiple alarm fields is increased and the "or" logical relationship is reduced.

[0101] When the second quality indicator value is much larger than the second indicator threshold and the third alarm indicator value is smaller than the third indicator threshold, it indicates that the generalization ability of the first alarm whitelist is too strong. In this case, the third parameter value in the optimization parameter value can be used to describe the weakening of the generalization of the first alarm whitelist and improve the accuracy of the first alarm whitelist.

[0102] The second method: grid search.

[0103] In response to the quality assessment result of the first alarm whitelist not meeting the first set condition, determine the parameter range of at least one parameter field involved in the optimization parameter value, form a search space based on the parameter range of at least one parameter field, traverse the parameter range of at least one parameter field within the search space, determine multiple candidate optimization parameter values ​​and the optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values, respectively determine the quality assessment results of the optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values, and determine the optimization parameter value from the multiple candidate optimization parameter values ​​based on the quality assessment results of the optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values.

[0104] That is to say, the search space is composed of all possible configurations (i.e., parameter ranges) of each parameter field in the optimized parameter value. For example, for the parameter field corresponding to the first parameter value, the parameter range can be 0.8 to 0.99, for the parameter field corresponding to the second parameter value, the parameter range can be a combination of different alarm fields, and for the parameter field corresponding to the third parameter value, the parameter range can be "enhanced generalization" or "enhanced precision."

[0105] Next, traverse each configuration in the search space, that is, combine different parameter values ​​within the parameter range of each parameter field to form different candidate optimization parameter values, generate an optimized first alarm whitelist under each configuration, and determine the quality evaluation results of the optimized first alarm whitelist according to the evaluation method of the alarm whitelist described above, select the optimized first alarm whitelist with the best quality evaluation result, and determine the candidate optimization parameter value corresponding to the optimized first alarm whitelist with the best quality evaluation result as the optimization parameter value.

[0106] In this way, based on the grid search algorithm, the optimization parameter value with the best optimization effect is determined, and the optimization parameter value with the best optimization effect is used to optimize the first alarm whitelist to improve the optimization effect.

[0107] The third method: multi-target genetics.

[0108] In response to the quality assessment results of the first alarm whitelist not meeting the first set condition, a multi-objective fitness function is constructed based on the optimization objectives of the first quality indicator value, the second quality indicator value, and the third quality indicator value, and at least one parameter field involved in the optimization parameter value is used as a decision variable to generate a first population. Next, the following steps are repeated until a termination condition is met: determining the function value of the multi-objective fitness function for each individual in the first population; determining multiple first individuals from the first population based on the function value of the multi-objective fitness function for each individual in the first population; performing crossover and mutation on the multiple first individuals to update the first population; and determining the optimized parameter value based on the parameter value of at least one parameter field corresponding to each individual in the first population.

[0109] That is, the optimization parameter values ​​are determined based on the multi-objective genetic algorithm. In the embodiment of the present application, the multi-objective fitness function of the multi-objective genetic algorithm is related to the first quality index value, the second quality index value, and the third quality index value, and the optimization objectives of the first quality index value, the second quality index value, and the third quality index value are all to maximize the above-mentioned quality index values.

[0110] The parameter field corresponding to the first quality indicator value, the parameter field corresponding to the second quality indicator value, and the parameter field corresponding to the third quality indicator value are used as decision variables to calculate the multi-objective genetic algorithm, wherein the parameter field corresponding to the first quality indicator value can be coded using real numbers, and the parameter field corresponding to the second quality indicator value and the parameter field corresponding to the third quality indicator value can be coded using binary numbers.

[0111] By randomly determining the parameter values ​​of each parameter field, a certain number of individuals are generated to generate an initial population (i.e., the first population). The function value of the multi-objective fitness function of each individual in the initialization population is calculated, that is, the quality assessment result of each individual in the initialization population is calculated, and individuals for reproduction are selected. For example, based on the Pareto frontier algorithm (such as the non-dominated sorting method or the crowding comparison method), individuals for reproduction are selected, and the individuals for reproduction are crossover and mutated to generate new individuals to form a new generation population. The above iterative process is repeated until the termination condition is met, such as the number of iterations reaching the iteration threshold or the function value of the multi-objective fitness function converges. The optimal solution of the final Pareto frontier algorithm is used as the optimization parameter value, so that the optimized first alarm whitelist can achieve the overall optimal matching efficiency, matching stability, and matching accuracy.

[0112] Combined with the above Figure 1 and Figure 2 The method for processing the security alarm whitelist provided in the embodiment of the present application is introduced in detail. The apparatus and device provided in the embodiment of the present application will be introduced below in conjunction with the accompanying drawings.

[0113] See also Figure 3 The schematic diagram of the structure of the security alarm whitelist processing device shown in FIG. 30 includes:

[0114] An acquisition module 301 is configured to acquire a first alarm whitelist and first alarm information matching the first alarm whitelist, and to acquire second alarm information generated within a first set time period; wherein the first alarm information and the second alarm information are associated with an alarm tag, the alarm tag being used to indicate whether the alarm is a false alarm;

[0115] a determination module 302 configured to determine, from the second alarm information, matching alarm information that matches the first alarm whitelist, and to determine, from the second alarm information, similar alarm information that is similar to the first alarm information;

[0116] An evaluation module 303 is configured to determine a quality evaluation result of the first alarm whitelist according to the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information;

[0117] The optimization module 304 is configured to optimize the first alarm whitelist in response to the quality evaluation result of the first alarm whitelist not meeting the first set condition.

[0118] In some possible implementations, the obtaining module 301 is specifically configured to:

[0119] In response to receiving multiple alarm messages within a second set time period, the multiple alarm messages received within the second set time period being similar, and a proportion of alarm tags associated with the multiple alarm messages received within the second set time period indicating false alarms meeting a second set condition, generating a first alarm whitelist based on the multiple alarm messages received within the second set time period;

[0120] The plurality of alarm information received within the second set time period is determined as the first alarm information matching the first alarm whitelist.

[0121] In some possible implementations, the obtaining module 301 is specifically configured to:

[0122] Determine a first alarm whitelist from the alarm whitelist set;

[0123] Acquire multiple alarm information matching the first alarm whitelist within a third set time period, and determine the multiple alarm information matching the first alarm whitelist within the third set time period as first alarm information matching the first alarm whitelist.

[0124] In some possible implementations, the evaluation module 303 is specifically configured to:

[0125] Determining one or more of a first quality index value, a second quality index value, and a third quality index value based on the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information; wherein the first quality index value is used to characterize the matching efficiency of the first alarm whitelist, the second quality index value is used to characterize the matching stability of the first alarm whitelist, and the third quality index value is used to characterize the matching accuracy of the first alarm whitelist;

[0126] A quality assessment result of the first alarm whitelist is determined according to one or more of the first quality indicator value, the second quality indicator value, and the third quality indicator value.

[0127] In some possible implementations, the alarm tag includes a first alarm tag and a second alarm tag, the first alarm tag is used to indicate that the alarm is not a false alarm, and the second alarm tag is used to indicate that the alarm is a false alarm; the evaluation module 303 is specifically configured to:

[0128] Do one or more of the following:

[0129] determining a first quality indicator value according to the number of the matching alarm information associated with the second alarm tag and the number of the second alarm information associated with the second alarm tag;

[0130] determining a second quality indicator value according to the number of the matching alarm information associated with the second alarm tag and the number of the similar alarm information associated with the second alarm tag in a plurality of unit times of the first set time period;

[0131] A third quality indicator value is determined according to the number of the first alarm tags and the number of the second alarm information associated with the matching alarm information.

[0132] In some possible implementations, the optimization module 304 is specifically configured to:

[0133] In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, determining an optimization parameter value;

[0134] Optimizing the first alarm whitelist according to the optimization parameter value;

[0135] The optimization parameter value includes at least one of the following:

[0136] used to determine first parameter values ​​of a plurality of third alarm information, wherein an optimized first alarm whitelist is generated based on the plurality of third alarm information;

[0137] A second parameter value for indicating the alarm fields included in the optimized first alarm whitelist or a logical relationship between the alarm fields included in the optimized first alarm whitelist;

[0138] The third parameter value is used to describe the characteristics of the optimized first alarm whitelist.

[0139] In some possible implementations, the optimized parameter value includes the first parameter value, the second parameter value, and the third parameter value, and the optimization module 304 is specifically configured to:

[0140] determining a plurality of third warning information whose similarity to the first warning information satisfies the first parameter value;

[0141] Modifying the multiple third warning information so that the modified multiple third warning information only includes the warning field indicated by the second parameter value;

[0142] Generate a first prompt word; wherein the first prompt word includes: the modified multiple third alarm information, information for indicating that an alarm whitelist satisfying the logical relationship between the alarm fields indicated by the second parameter value is generated based on the modified multiple third alarm information, and the third parameter value for describing the characteristics of the alarm whitelist to be generated;

[0143] The first prompt word is sent to a language model, and an optimized first alarm whitelist returned by the language model is received.

[0144] In some possible implementations, the quality assessment result of the first alarm whitelist is determined based on the first quality indicator value, the second quality indicator value, and the third quality indicator value; and the optimization module 304 is specifically configured to:

[0145] In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, determining a magnitude relationship between the first quality indicator value and a first indicator threshold, a magnitude relationship between the second quality indicator value and a second indicator threshold, and a magnitude relationship between the third quality indicator value and a third indicator threshold;

[0146] An optimization parameter value is determined according to a magnitude relationship between the first quality index value and a first index threshold, a magnitude relationship between the second quality index value and a second index threshold, and a magnitude relationship between the third quality index value and a third index threshold.

[0147] In some possible implementations, the optimization module 304 is specifically configured to:

[0148] In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, determining a parameter range of at least one parameter field involved in optimizing a parameter value;

[0149] forming a search space according to a parameter range of the at least one parameter field;

[0150] In the search space, traverse the parameter range of the at least one parameter field to determine multiple candidate optimization parameter values ​​and an optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values;

[0151] Determine the quality assessment results of the optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values ​​respectively, and determine the optimization parameter value from the multiple candidate optimization parameter values ​​based on the quality assessment results of the optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values.

[0152] In some possible implementations, the optimization module 304 is specifically configured to:

[0153] In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, constructing a multi-objective fitness function according to an optimization objective of the first quality index value, an optimization objective of the second quality index value, and an optimization objective of the third quality index value, and generating a first population by using at least one parameter field involved in the optimization parameter value as a decision variable;

[0154] Repeating the following steps until a termination condition is met: determining a function value of the multi-objective fitness function for each individual in the first population; determining a plurality of first individuals from the first population based on the function value of the multi-objective fitness function for each individual in the first population, and performing crossover and mutation on the plurality of first individuals to update the first population;

[0155] An optimized parameter value is determined according to a parameter value of at least one parameter field corresponding to each individual in the first population.

[0156] The processing device 30 of the security alarm whitelist according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the processing device 30 of the security alarm whitelist are respectively to achieve Figure 1 For the sake of brevity, the corresponding processes of the various methods in the illustrated embodiments are not described here in detail.

[0157] The embodiment of the present application also provides an electronic device. The electronic device is specifically used to implement Figure 3 The functions of the security warning whitelist processing device 30 in the illustrated embodiment.

[0158] Figure 4 A structural diagram of an electronic device 400 is provided. Figure 4 As shown, electronic device 400 includes bus 401, processor 402, communication interface 403 and memory 404. Processor 402, memory 404 and communication interface 403 communicate with each other via bus 401.

[0159] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0160] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0161] The communication interface 403 is used for communicating with the outside, for example, the communication interface 403 can be used for communicating with a terminal.

[0162] The memory 404 may include volatile memory, such as random access memory (RAM), or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0163] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the aforementioned security warning whitelist processing method.

[0164] Specifically, in the implementation Figure 3 In the case of the embodiment shown, and Figure 3 In the embodiment, each module or unit of the security alarm whitelist processing device 30 is implemented by software. Figure 3 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the aforementioned security warning whitelist processing method.

[0165] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the security alarm whitelist processing method of the processing device 30 applied to the security alarm whitelist.

[0166] The present application also provides a computer program product comprising one or more computer instructions that, when loaded and executed on a computing device, fully or partially generate the process or function described in the present application.

[0167] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0168] When the computer program product is executed by a computer, the computer performs any of the aforementioned weak password protection methods. The computer program product can be a software installation package. When any of the aforementioned weak password protection methods is needed, the computer program product can be downloaded and executed on the computer.

[0169] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to the various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the prescribed logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the prescribed function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0170] The units involved in the embodiments described in this application may be implemented in software or hardware, wherein the name of a unit / module does not, in some cases, constitute a limitation on the unit itself.

[0171] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0172] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0173] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems or devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0174] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0175] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0176] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0177] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing a security warning whitelist, characterized in that: The method comprises: Obtaining a first alarm whitelist and first alarm information matching the first alarm whitelist, and obtaining second alarm information generated within a first set time period; wherein the first alarm information and the second alarm information are associated with an alarm tag, and the alarm tag is used to indicate whether it is a false alarm; Determining, from the second alarm information, matching alarm information that matches the first alarm whitelist, and determining, from the second alarm information, similar alarm information that is similar to the first alarm information; Determining a quality assessment result of the first alarm whitelist according to the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information; In response to a quality assessment result of the first alarm whitelist not meeting a first set condition, optimizing the first alarm whitelist, The determining of the quality assessment result of the first alarm whitelist according to the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information includes: Determining one or more of a first quality index value, a second quality index value, and a third quality index value based on the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information; wherein the first quality index value is used to characterize the matching efficiency of the first alarm whitelist, the second quality index value is used to characterize the matching stability of the first alarm whitelist, and the third quality index value is used to characterize the matching accuracy of the first alarm whitelist; A quality assessment result of the first alarm whitelist is determined according to one or more of the first quality indicator value, the second quality indicator value, and the third quality indicator value.

2. The method according to claim 1, characterized in that The obtaining of the first alarm whitelist and the first alarm information matching the first alarm whitelist includes: In response to receiving multiple alarm messages within a second set time period, the multiple alarm messages received within the second set time period being similar, and a proportion of alarm tags associated with the multiple alarm messages received within the second set time period indicating false alarms meeting a second set condition, generating a first alarm whitelist based on the multiple alarm messages received within the second set time period; The plurality of alarm information received within the second set time period is determined as the first alarm information matching the first alarm whitelist.

3. The method according to claim 1, characterized in that The obtaining of the first alarm whitelist and the first alarm information matching the first alarm whitelist includes: Determine a first alarm whitelist from the alarm whitelist set; Acquire multiple alarm information matching the first alarm whitelist within a third set time period, and determine the multiple alarm information matching the first alarm whitelist within the third set time period as first alarm information matching the first alarm whitelist.

4. The method according to claim 1, wherein The alarm tag includes a first alarm tag and a second alarm tag, the first alarm tag is used to indicate that the alarm is not a false alarm, and the second alarm tag is used to indicate that the alarm is a false alarm; and determining one or more of the first quality indicator value, the second quality indicator value, and the third quality indicator value based on the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information includes: Do one or more of the following: determining a first quality indicator value according to the number of the matching alarm information associated with the second alarm tag and the number of the second alarm information associated with the second alarm tag; determining a second quality indicator value according to the number of the matching alarm information associated with the second alarm tag and the number of the similar alarm information associated with the second alarm tag in a plurality of unit times of the first set time period; A third quality indicator value is determined according to the number of the first alarm tags and the number of the second alarm information associated with the matching alarm information.

5. The method according to any one of claims 1 to 4, characterized in that In response to the quality assessment result of the first alarm whitelist not meeting the first set condition, optimizing the first alarm whitelist includes: In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, determining an optimization parameter value; Optimizing the first alarm whitelist according to the optimization parameter value; The optimization parameter value includes at least one of the following: used to determine first parameter values ​​of a plurality of third alarm information, wherein an optimized first alarm whitelist is generated based on the plurality of third alarm information; A second parameter value for indicating the alarm fields included in the optimized first alarm whitelist or a logical relationship between the alarm fields included in the optimized first alarm whitelist; The third parameter value is used to describe the characteristics of the optimized first alarm whitelist.

6. The method according to claim 5, characterized in that The optimized parameter values ​​include the first parameter value, the second parameter value, and the third parameter value, and optimizing the first alarm whitelist according to the optimized parameter values ​​includes: determining a plurality of third warning information whose similarity to the first warning information satisfies the first parameter value; Modifying the multiple third warning information so that the modified multiple third warning information only includes the warning field indicated by the second parameter value; Generate a first prompt word; wherein the first prompt word includes: the modified multiple third alarm information, information for indicating that an alarm whitelist satisfying the logical relationship between the alarm fields indicated by the second parameter value is generated based on the modified multiple third alarm information, and the third parameter value for describing the characteristics of the alarm whitelist to be generated; The first prompt word is sent to a language model, and an optimized first alarm whitelist returned by the language model is received.

7. The method according to claim 5, characterized in that The quality assessment result of the first alarm whitelist is determined based on the first quality indicator value, the second quality indicator value, and the third quality indicator value; and in response to the quality assessment result of the first alarm whitelist not satisfying the first set condition, determining the optimization parameter value includes: In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, determining a magnitude relationship between the first quality indicator value and a first indicator threshold, a magnitude relationship between the second quality indicator value and a second indicator threshold, and a magnitude relationship between the third quality indicator value and a third indicator threshold; An optimization parameter value is determined according to a magnitude relationship between the first quality index value and a first index threshold, a magnitude relationship between the second quality index value and a second index threshold, and a magnitude relationship between the third quality index value and a third index threshold.

8. The method according to claim 5, characterized in that The determining of the optimization parameter value in response to the quality assessment result of the first alarm whitelist not meeting the first set condition includes: In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, determining a parameter range of at least one parameter field involved in optimizing a parameter value; forming a search space according to a parameter range of the at least one parameter field; In the search space, traverse the parameter range of the at least one parameter field to determine multiple candidate optimization parameter values ​​and an optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values; Determine the quality assessment results of the optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values ​​respectively, and determine the optimization parameter value from the multiple candidate optimization parameter values ​​based on the quality assessment results of the optimized first alarm whitelist corresponding to the multiple candidate optimization parameter values.

9. The method according to claim 5, characterized in that The quality assessment result of the first alarm whitelist is determined based on the first quality indicator value, the second quality indicator value, and the third quality indicator value; and in response to the quality assessment result of the first alarm whitelist not satisfying the first set condition, determining the optimization parameter value includes: In response to a quality assessment result of the first alarm whitelist not satisfying a first set condition, constructing a multi-objective fitness function according to an optimization objective of the first quality index value, an optimization objective of the second quality index value, and an optimization objective of the third quality index value, and generating a first population by using at least one parameter field involved in the optimization parameter value as a decision variable; Repeating the following steps until a termination condition is met: determining a function value of the multi-objective fitness function for each individual in the first population; determining a plurality of first individuals from the first population based on the function value of the multi-objective fitness function for each individual in the first population, and performing crossover and mutation on the plurality of first individuals to update the first population; An optimized parameter value is determined according to a parameter value of at least one parameter field corresponding to each individual in the first population.

10. A device for processing a security warning whitelist, characterized in that: The device comprises: an acquisition module, configured to acquire a first alarm whitelist and first alarm information matching the first alarm whitelist, and to acquire second alarm information generated within a first set time period; wherein the first alarm information and the second alarm information are associated with an alarm tag, the alarm tag being used to indicate whether the alarm is a false alarm; a determining module, configured to determine, from the second alarm information, matching alarm information that matches the first alarm whitelist, and, from the second alarm information, determine similar alarm information that is similar to the first alarm information; An evaluation module, configured to determine a quality evaluation result of the first alarm whitelist according to the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information; an optimization module, configured to optimize the first alarm whitelist in response to a quality evaluation result of the first alarm whitelist not meeting a first set condition, The determining of the quality assessment result of the first alarm whitelist according to the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information includes: Determining one or more of a first quality index value, a second quality index value, and a third quality index value based on the number of the second alarm information, the number of the matching alarm information, and the number of the similar alarm information; wherein the first quality index value is used to characterize the matching efficiency of the first alarm whitelist, the second quality index value is used to characterize the matching stability of the first alarm whitelist, and the third quality index value is used to characterize the matching accuracy of the first alarm whitelist; A quality assessment result of the first alarm whitelist is determined according to one or more of the first quality indicator value, the second quality indicator value, and the third quality indicator value.

11. An electronic device, characterized in that: The electronic device includes a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that The method comprises instructions for instructing an electronic device to execute the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product comprises computer-readable instructions for implementing the method according to any one of claims 1 to 9.

Images