Alarm aggregation processing method and device, electronic equipment and storage medium

Abstract

The invention discloses an alarm aggregation processing method and device, electronic equipment and a storage medium, which are used for solving the problem of low alarm aggregation accuracy of an existing alarm aggregation processing mode. Obtaining an alarm log of the network security equipment in the current time period; respectively extracting alarm feature information of each alarm log, and determining an associated alarm log in each time window of the current time period based on the alarm feature information of each alarm log; aggregating the associated alarm logs in the same time window of the current time period to obtain an aggregated alarm log set; for every two aggregated alarm log sets, counting the number of the same alarm feature information contained in the two aggregated alarm log sets; according to the number of the same alarm feature information in the two aggregation alarm log sets and the total number of the alarm feature information, the relevancy of the two aggregation alarm log sets is determined; and performing associated display on the two aggregated alarm log sets of which the relevancy is greater than a relevancy threshold.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an alarm aggregation processing method, device, electronic device and storage medium. Background Art

[0002] With the development of network information technology, network security equipment plays an important role in protecting network security. With the surge in network traffic and the scripting and automation of network attacks, the alarm logs of network security equipment have increased sharply. Faced with a large number of alarm logs, network operators cannot view them one by one, nor can they identify the correlation between alarm logs, resulting in network security alarms forming isolated network security events, making it impossible to trace the source of the attack.

[0003] In the related art, alarm aggregation processing is usually performed according to predefined association rules to identify the correlation between alarm logs, such as using predefined association rules or expert systems to associate according to the attributes and context information of the alarms. However, this alarm aggregation processing method relies on complex association rules and association engines for alarm association, which requires a lot of prior knowledge. However, actual network attacks are often scattered and disordered, and cannot completely match the prior rules, resulting in low accuracy of alarm aggregation. Summary of the invention

[0004] In order to solve the problem of low accuracy of alarm aggregation in the existing alarm aggregation processing method, the embodiments of the present application provide an alarm aggregation processing method, device, electronic device and storage medium.

[0005] In a first aspect, an embodiment of the present application provides an alarm aggregation processing method, including:

[0006] Obtain the alarm logs of network security devices within the current time period;

[0007] Extracting the alarm characteristic information of each alarm log respectively, and determining the associated alarm logs in each time window of the current time period based on the alarm characteristic information of each alarm log;

[0008] Aggregating the related alarm logs in the same time window of the current time period to obtain an aggregated alarm log set;

[0009] For every two aggregated alarm log sets, counting the number of identical alarm feature information contained in the two aggregated alarm log sets;

[0010] Determine the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of the alarm feature information, wherein the correlation between the two aggregated alarm log sets represents the degree of association between the two aggregated alarm log sets;

[0011] Two aggregated alarm log sets whose correlation is greater than the correlation threshold are associated and displayed.

[0012] In one embodiment, the alarm characteristic information includes at least the following characteristic information: attack source IP address information, attack target IP address information, attack type information and attack time information;

[0013] Before determining the associated alarm log of the alarm log within each time window of the current time period based on the alarm characteristic information of each alarm log, the method further includes:

[0014] Determine the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period according to the alarm characteristic information of each alarm log, the alarm density of the alarm log represents the number of units of the alarm log within the time interval between the attack time information of the last appearance of the alarm log in the time window and the attack time information of the first appearance; the related alarm log of the alarm log is an alarm log with the same attack source IP address information or attack target IP address information as that contained in the alarm log, but with different attack type information;

[0015] Determine the isolated alarm logs in the corresponding time window according to the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period;

[0016] Delete isolated alarm logs within each time window.

[0017] In one embodiment, determining the associated alarm logs in each time window of the current time period based on the alarm feature information of each alarm log specifically includes:

[0018] For each time window of the current time period, the alarm logs with the same first characteristic information contained in the time window are determined as associated alarm logs, where the first characteristic information is any characteristic information in the alarm characteristic information.

[0019] In one implementation, determining the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of the alarm feature information specifically includes:

[0020] The ratio of the number of identical alarm feature information contained in the two aggregated alarm log sets to the total number of the alarm feature information is determined as the correlation between the two aggregated alarm log sets.

[0021] In one embodiment, determining the alarm density of each alarm log in each time window of the current time period according to the alarm characteristic information of each alarm log specifically includes:

[0022] For each time window of the current time period, the alarm density of each alarm log in the time window is calculated by the following formula:

[0023]

[0024] in, Indicates the i-th alarm log A in the time window i The alarm density;

[0025] n represents the i-th alarm log A in the time window i the number of

[0026] A i,n .timestamp indicates the i-th alarm log A i Attack time information at the nth occurrence within the time window;

[0027] A i,1 .timestamp indicates the i-th alarm log A i Attack time information at the first occurrence within the time window.

[0028] In one embodiment, determining the isolated alarm logs in the corresponding time window according to the alarm density of each alarm log in each time window of the current time period specifically includes:

[0029] The alarm logs whose alarm density in each time window is less than the density threshold are determined as isolated alarm logs in the corresponding time window.

[0030] In one embodiment, determining the number of related alarm logs of each alarm log in each time window of the current time period according to the alarm characteristic information of each alarm log specifically includes:

[0031] For each alarm log in each time window of the current time period, the first alarm log in the time window that is the same as the attack source IP address information or the attack target IP address information in the alarm feature information of the alarm log and different from the attack type information in the alarm feature information of the alarm log is determined as a related alarm log of the alarm log;

[0032] Count the number of related alarm logs of each alarm log.

[0033] In one embodiment, determining the isolated alarm logs in the corresponding time window according to the number of related alarm logs of each alarm log in each time window of the current time period specifically includes:

[0034] The alarm logs whose number of related alarm logs in each time window is less than the number threshold are determined as isolated alarm logs in the corresponding time window.

[0035] In a second aspect, an embodiment of the present application provides an alarm aggregation processing device, including:

[0036] An acquisition module is used to obtain the alarm logs of network security devices within the current time period;

[0037] A first determination module, configured to extract the alarm characteristic information of each alarm log respectively, and determine the associated alarm logs in each time window of the current time period based on the alarm characteristic information of each alarm log;

[0038] An aggregation module, used to aggregate the associated alarm logs in the same time window of the current time period to obtain an aggregated alarm log set;

[0039] A statistical module, used for counting the number of identical alarm feature information contained in each of two aggregated alarm log sets;

[0040] A second determination module is used to determine the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of the alarm feature information, wherein the correlation between the two aggregated alarm log sets represents the degree of association between the two aggregated alarm log sets;

[0041] The display module is used to associate and display two aggregated alarm log sets whose correlation is greater than a correlation threshold.

[0042] In one embodiment, the alarm characteristic information includes at least the following characteristic information: attack source IP address information, attack target IP address information, attack type information and attack time information;

[0043] The device further comprises:

[0044] A third determination module is used to determine the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period according to the alarm characteristic information of each alarm log before determining the associated alarm log of the alarm log in each time window of the current time period based on the alarm characteristic information of each alarm log, wherein the alarm density of the alarm log represents the number of units of the alarm log within the time interval between the attack time information of the last appearance of the alarm log in the time window and the attack time information of the first appearance; the related alarm log of the alarm log is an alarm log having the same attack source IP address information or attack target IP address information as that contained in the alarm log, but with different attack type information;

[0045] A fourth determination module, configured to determine the isolated alarm logs in the corresponding time window according to the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period;

[0046] The deletion module is used to delete isolated alarm logs within each time window.

[0047] The first determination module is specifically used to determine, for each time window of the current time period, alarm logs with the same first characteristic information contained in the time window as associated alarm logs, where the first characteristic information is any characteristic information in the alarm characteristic information.

[0048] In one implementation, the second determination module is specifically configured to determine the ratio of the number of identical alarm feature information contained in the two aggregated alarm log sets to the total number of the alarm feature information as the correlation between the two aggregated alarm log sets.

[0049] In one implementation, the third determination module is specifically configured to calculate, for each time window of the current time period, the alarm density of each alarm log in the time window by using the following formula:

[0050]

[0051] in, Indicates the i-th alarm log A in the time window i The alarm density;

[0052] n represents the i-th alarm log A in the time window i the number of

[0053] A i,n .timestamp indicates the i-th alarm log A i Attack time information at the nth occurrence within the time window;

[0054] A i,1 .timestamp indicates the i-th alarm log A i Attack time information at the first occurrence within the time window.

[0055] In one implementation, the fourth determination module is specifically configured to determine the alarm logs whose alarm density in each time window is less than a density threshold as isolated alarm logs in the corresponding time window.

[0056] In one embodiment, the third determination module is specifically used to determine, for each alarm log in each time window of the current time period, the first alarm log in the time window that is the same as the attack source IP address information or the attack target IP address information in the alarm characteristic information of the alarm log and different from the attack type information in the alarm characteristic information of the alarm log, as a related alarm log of the alarm log; and to count the number of related alarm logs of each alarm log respectively.

[0057] In one implementation, the fourth determination module is specifically configured to determine the alarm logs whose number of related alarm logs in each time window is less than a number threshold as isolated alarm logs in the corresponding time window.

[0058] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the alarm aggregation processing method described in the present application when executing the program.

[0059] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps in the alarm aggregation processing method described in the present application are implemented.

[0060] The beneficial effects of this application are as follows:

[0061] The alarm aggregation processing method, device, electronic device and storage medium provided in the embodiments of the present application are as follows: a server obtains the alarm logs of the network security equipment in the current time period, extracts the alarm characteristic information of each alarm log respectively, determines the associated alarm logs in each time window of the current time period based on the alarm characteristic information of each alarm log, aggregates the associated alarm logs in the same time window of the current time period to obtain an aggregated alarm log set, and for every two aggregated alarm log sets, counts the number of identical alarm characteristic information contained in the two aggregated alarm log sets, determines the correlation between the two aggregated alarm log sets based on the number of identical alarm characteristic information contained in the two aggregated alarm log sets and the total number of alarm characteristic information, and displays the two aggregated alarm log sets whose correlation is greater than the correlation threshold as associated ones. In the embodiment of the present application, the associated alarm logs in each time window of the current time period are determined according to the alarm feature information of each alarm log, and then the associated key logs in the same time window of the current time period are aggregated to obtain an aggregated alarm log set, and the correlation between each two aggregated alarm log sets is determined according to the number of identical alarm feature information contained in each two aggregated alarm log sets and the total number of alarm feature information, so as to merge alarms and obtain alarm correlation, and associate and display the aggregated alarm log sets with high correlation as the basis for subsequent attack chain restoration and judgment. Compared with the prior art, the present application determines the associated alarm logs from the alarm feature dimension and generates an aggregated alarm log set, identifies the aggregated alarm log set with a high correlation greater than the correlation threshold, and can conveniently obtain the associated alarm logs and the correlation between each two aggregated alarm log sets without relying on a large amount of complex prior knowledge and association rules, thereby improving the accuracy of alarm aggregation.

[0062] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0064] Figure 1 A schematic diagram of an application scenario of the alarm aggregation processing method provided in an embodiment of the present application;

[0065] Figure 2 A flowchart of the alarm aggregation processing method provided in an embodiment of the present application;

[0066] Figure 3 A schematic diagram of a process for filtering isolated alarm logs provided in an embodiment of the present application;

[0067] Figure 4 A schematic diagram of a process for determining the number of related alarm logs of each alarm log in each time window of the current time period provided by an embodiment of the present application;

[0068] Figure 5 An example diagram of the distribution of alarm logs provided in the embodiment of the present application;

[0069] Figure 6 A schematic diagram of the structure of an alarm aggregation processing device provided in an embodiment of the present application;

[0070] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to solve the problem of low accuracy of alarm aggregation in the existing alarm aggregation processing method, the embodiments of the present application provide an alarm aggregation processing method, device, electronic device and storage medium.

[0072] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0073] In this article, it is necessary to understand that the technical terms involved in this application are:

[0074] 1. Network security incident: refers to any activity occurring in the network that may cause damage, destruction or unauthorized access to network systems, data or services.

[0075] 2. Alarm aggregation: It is a commonly used technology in network monitoring and security management. It combines multiple similar or related alarm information into a comprehensive alarm event to reduce alarm noise and improve the efficiency and accuracy of alarm processing.

[0076] 3. Attack chain stage: In the field of network security, the attack chain usually includes the following seven stages:

[0077] Reconnaissance: The attacker collects information about the target through various means, including network topology, system configuration, user information, etc. This may include network scanning, social engineering attacks, etc.

[0078] Weaponization: Attackers package malicious code or tools to enable them to be executed on the target system. This may include exploiting vulnerabilities, creating malware, etc.

[0079] Delivery: The attacker delivers weaponized malicious code or tools to the target system. This can be done via email, website, USB device, etc.

[0080] Exploitation: Malicious code or tools are executed on the target system and use system vulnerabilities to gain control of the system.

[0081] Installation: The attacker installs malware such as backdoors and Trojans on the target system in order to gain long-term control over the target system.

[0082] Command and Control (C2): The attacker establishes a communication channel with the controlled target system in order to send instructions and receive data.

[0083] Actions on Objectives: The attacker achieves his or her attack objectives, which may include stealing data, destroying systems, and extorting money.

[0084] First reference Figure 1, which is a schematic diagram of an application scenario of the alarm aggregation processing method provided in an embodiment of the present application, and may include network security devices 101: network security devices 101-1 to 101-M, an alarm library 101, a server 103, and an alarm aggregation library 104, wherein M is the number of network security devices, and M is at least 1. After each network security device 101 generates an alarm log, the alarm log is sent to the alarm library for storage. The server 103 obtains the alarm log of each network security device 101 from the alarm library according to a preset time period. After the server 103 obtains all the alarm logs of each network security device 101 in the current time period from the alarm library 101, the alarm feature information of each alarm log is extracted respectively, and the associated alarm logs in each time window of the current time period are determined based on the alarm feature information of each alarm log, and the associated alarm logs in the same time window of the current time period are aggregated to obtain To the aggregated alarm log set, the server 103 stores each aggregated alarm log set in the alarm aggregation library 104. Then, for every two aggregated alarm log sets, the server 103 counts the number of identical alarm feature information contained in the two aggregated alarm log sets, and determines the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of alarm feature information, thereby obtaining the correlation between every two aggregated alarm log sets, and associating and displaying the two aggregated alarm log sets with correlation greater than the correlation threshold on the front-end interface. The embodiment of the present application determines the associated alarm logs from the alarm feature dimension and generates an aggregated alarm log set, identifies the aggregated alarm log set with a correlation greater than the correlation threshold, and can conveniently obtain the associated alarm logs and the correlation between every two aggregated alarm log sets without relying on a large amount of complex prior knowledge and association rules, thereby improving the accuracy of alarm aggregation.

[0085] The network security device 101 may include, but is not limited to, at least one of the following devices: a firewall, an intrusion detection system (IDS), an intrusion prevention system (IPS), and a security gateway, etc., which is not limited in the embodiments of the present application.

[0086] The server 103 may be an independent physical server or a cloud server that provides basic cloud computing services such as cloud servers, cloud databases, and cloud storage, which is not limited in the present embodiment. The alarm library 101 and the alarm aggregation library 104 may be databases of the same type, which is not limited in the present embodiment.

[0087] The network security device 101 and the alarm library 102 may be connected via a network, the server 103 and the alarm library 102 may be connected via a network, and the server and the alarm aggregation library 104 may be connected via a network, which is not limited in this embodiment of the present application.

[0088] Based on the above application scenarios, the following will refer to the attached Figures 2 to 5 The exemplary embodiments of the present application are described in more detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present application, and the implementation of the present application is not limited in any way. On the contrary, the implementation of the present application can be applied to any applicable scenario.

[0089] like Figure 2 As shown, it is a schematic diagram of the implementation process of the alarm aggregation processing method provided in the embodiment of the present application. The alarm aggregation processing method can be applied to the above-mentioned server 103, and specifically can include the following steps:

[0090] S21. The server obtains the alarm log of the network security device in the current time period.

[0091] During specific implementation, the server can obtain the alarm log of each network security device from the alarm library according to a preset time period. The preset time period can be set according to needs, such as 12 hours or 24 hours, or any other duration, which is not limited to this embodiment of the present application.

[0092] In this step, the server obtains the alarm log of each network security device in the current time period from the alarm library.

[0093] S22: extract the alarm characteristic information of each alarm log respectively, and determine the associated alarm logs in each time window of the current time period based on the alarm characteristic information of each alarm log.

[0094] During specific implementation, the alarm characteristic information includes at least the following characteristic information: attack source IP address information, attack target IP address information, attack type information and attack time information.

[0095] After the server obtains the alarm log of each network security device in the current time period, it can normalize each alarm log according to the specified field of the alarm log to facilitate subsequent processing.

[0096] Specifically, for each alarm log, the server can extract threat source field information, attack target field information, attack mode field information, and attack time field information. The alarm feature information contained in each field is shown in Table 1:

[0097] Table 1

[0098]

[0099]

[0100] As shown in Table 1, the threat source may include the following alarm feature information: attack source IP address information (i.e., attacker IP address information), geographic location feature information (i.e., geographic location to which the attack source IP address belongs), feature tag (i.e., feature information of the attacker, such as the attack organization to which the attacker belongs), attacker port information and protocol information (i.e., the communication protocol used). The attack target (i.e., the attacked object) may include the following alarm feature information: attack target IP address information, geographic location feature (i.e., geographic location to which the attack target IP address belongs), attack target port information and feature tag (i.e., feature information of the attack target, such as the organization to which the attack target belongs). The attack mode may include the following alarm feature information: attack type information (i.e., alarm type, such as vulnerability attack, Web attack, virus attack, etc.), target type information (i.e., attack target type, such as infrastructure, operator, corporate website, etc.), target manufacturer information, target product information, attack chain stage information (including seven stages), harm intention information (such as ransomware, etc.) and severity level (which may include: high, medium, low). The attack time may include: start time (ie, the start time or occurrence time of the attack behavior), end time (ie, the end time of the attack behavior) and duration (ie, the duration of the attack behavior).

[0101] There are usually a large number of isolated alarm logs in the alarm log. Isolated alarm events cannot form a complete attack chain, and the probability of false alarms is high. In order to improve the accuracy of alarm aggregation, before determining the associated alarm logs of the alarm logs in each time window of the current time period based on the alarm feature information of each alarm log, you can also filter the isolated alarm logs first. You can do this as follows: Figure 3 The process shown in the figure filters isolated alarm logs, including the following steps:

[0102] S31. Determine the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period according to the alarm characteristic information of each alarm log.

[0103] The alarm density of the alarm log represents the number of alarm log units within the time interval between the attack time information of the last occurrence of the alarm log within the time window and the attack time information of the first occurrence. The related alarm log of the alarm log is the alarm log that contains the same attack source IP address information or attack target IP address information as the alarm log, but has different attack type information.

[0104] In specific implementation, isolated alarm logs can be identified in two ways: the first way is to determine the isolated alarm logs in each time window based on the alarm density of the alarm logs in each time window of the current time period; the second way is to determine the isolated alarm logs in each time window based on the number of related alarm logs in each time window of the current time period.

[0105] Specifically, by analyzing multiple attack instances, we found that the density of real alarms and false alarms is different: real alarms are usually generated in large quantities in a short period of time, with a high alarm density, while false alarms also generate more alarm logs in a short period of time, but their density is lower than that of real alarms and they last longer. The alarm density of alarm logs refers to the number of alarm logs with the same feature information except for the attack time information contained in the alarm logs within the time window between the last attack time information and the first attack time information.

[0106] In the first method, for each time window of the current time period, the alarm density of each alarm log in the time window can be calculated by the following formula:

[0107]

[0108] in, Indicates the i-th alarm log A in the time window i The alarm density;

[0109] n represents the i-th alarm log A in the time window i The number of alarm logs A in the time window (i.e., the number of alarm logs A in the time window i Generated n times);

[0110] A i,n .timestamp indicates the i-th alarm log A i The attack time information of the nth occurrence within the time window, wherein the attack time is the attack start time, that is, the attack occurrence time;

[0111] A i,1 .timestamp indicates the i-th alarm log A i The attack time information of the first occurrence within the time window, wherein the attack time is the attack start time, that is, the attack occurrence time.

[0112] During implementation, the time window can be set by oneself, such as being set to 30 minutes or 1 hour, or being set to any other duration, which is not limited in the embodiments of the present application.

[0113] Within a time window, false alarms and true alarms differ in the number of relevant alarm logs. The number of relevant alarm logs for true alarms is relatively large within a time window, while the number of relevant alarm logs for false alarms is less than that of true alarms.

[0114] In the second method, it can be determined according to the process as Figure 4 shown to obtain the number of relevant alarm logs for each alarm log within each time window of the current time period, including the following steps:

[0115] S41. For each alarm log within each time window of the current time period, the first alarm log within the time window that has the same source IP address information or target IP address information as the alarm feature information of the alarm log and different attack type information from the alarm feature information of the alarm log is determined as the relevant alarm log of the alarm log.

[0116] Specifically, the relevant alarm log of an alarm log refers to the alarm log within the time window that is related to the IP address in the alarm feature information of the alarm log but has a different alarm type.

[0117] Specifically, for each alarm log within each time window of the current time period, the server determines the first alarm log within the time window that has the same source IP address information as the alarm feature information of the alarm log and different attack type information from the alarm feature information of the alarm log as the relevant alarm log of the alarm log; or determines the first alarm log within the time window that has the same target IP address information as the alarm feature information of the alarm log and different attack type information from the alarm information of the alarm log as the relevant alarm log of the alarm log.

[0118] For two alarm logs Ai and Aj within the same time window, they are relevant alarm logs to each other when the following conditions are met:

[0119] |Ai.timestamp - Aj.timestamp| < T, where T is the time window, that is: Ai and Aj are within the same time window;

[0120] The attack types are different, that is, |Ai.type ≠ Aj.type|, where Ai.type is the attack type information included in the alarm log Ai, and Aj.type is the attack type information included in the alarm log Aj;

[0121] Ai.sip is the attack source IP address information contained in the alarm log Ai, Ai.dip is the attack target IP address information contained in the alarm log Ai, Aj.sip is the attack source IP address information contained in the alarm log Aj, and Aj.dip is the attack target IP address information contained in the alarm log Aj.

[0122] S42: Count the number of related alarm logs of each alarm log.

[0123] In specific implementation, for each alarm log in each time window of the current time period, the server counts the number of related alarm logs of each alarm log in the time window.

[0124] S32: Determine the isolated alarm logs in the corresponding time window according to the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period.

[0125] In the specific implementation, in the first method, according to the alarm density of each alarm log in each time window of the current time period, the isolated alarm log in the corresponding time window is determined, specifically including:

[0126] The alarm logs whose alarm density in each time window is less than the density threshold are determined as isolated alarm logs in the corresponding time window.

[0127] Specifically, the server pre-sets a density threshold, and determines the alarm logs in each time window whose alarm density is less than the density threshold as isolated alarm logs in the corresponding time window, wherein the density threshold can be set according to the attack type. For example, when the attack type is a vulnerability attack, the density threshold can be set to, but not limited to, 10; when the attack type is a blasting attack, the density threshold can be set to, but not limited to, 100 times. This embodiment of the present application does not limit this.

[0128] In the second method, according to the number of related alarm logs of each alarm log in each time window of the current time period, the isolated alarm log in the corresponding time window is determined, specifically including:

[0129] The alarm logs whose number of related alarm logs in each time window is less than the number threshold are determined as isolated alarm logs in the corresponding time window.

[0130] Specifically, the server can pre-set a quantity threshold and determine the alarm logs in each time window whose number of related alarm logs is less than the quantity threshold as isolated alarm logs in the corresponding time window. The quantity threshold can be set according to actual needs, such as 10 or other values, and this application example does not limit this.

[0131] S33. Delete the isolated alarm logs in each time window.

[0132] In specific implementation, the server deletes the isolated alarm logs in each time window of the current time period, and retains the alarm logs with alarm density greater than or equal to the density threshold in each time window as key alarm logs, or retains the alarm logs with the number of related alarm logs greater than or equal to the number threshold in each time window as key alarm logs.

[0133] Furthermore, for the key alarm logs retained in each time window of the current time period, the server determines, for each time window of the current time period, the alarm logs with the same first characteristic information contained in the time window as associated alarm logs, where the first characteristic information is any characteristic information in the alarm characteristic information. The associated alarm log refers to an alarm log with an associated relationship, and the first characteristic information can be any characteristic information among the attack source IP address information, the attack target IP address information, the attack type information and the attack time information.

[0134] S23: Aggregate the related alarm logs in the same time window of the current time period to obtain an aggregated alarm log set.

[0135] In specific implementation, the server aggregates the related alarm logs in each time window of the current time period to obtain an aggregated alarm log set, and stores each aggregated alarm log set in the alarm aggregation library. Figure 5 In the alarm log distribution example diagram shown, it is assumed that time window 1 contains alarm logs a1 and a2, time window 2 contains alarm logs b1 and a3, time window 3 contains alarm logs b2, b3 and a4, and time window 4 contains alarm logs b4 and a5, wherein the attack source IP address information in the alarm logs a1 to a5 is the same, the attack source IP address information in the alarm logs b1 to b4 is the same, and the attack source IP address information in the alarm logs a1 to a5 is different from the attack source IP address information in the alarm logs b1 to b4. Then, a1 and a2 can be aggregated to obtain a corresponding aggregate alarm log set A, A = {a1, a2}, that is: A contains alarm logs a1 and a2, b2 and b3 can be aggregated to obtain a corresponding aggregate alarm log set B, B = {b2, b3}, that is: B contains alarm logs b2 and b3.

[0136] S24: For every two aggregated alarm log sets, count the number of identical alarm feature information contained in the two aggregated alarm log sets.

[0137] In the specific implementation, the server pre-selects the alarm feature information for calculating the correlation of the aggregated alarm log set. The correlation of two aggregated alarm log sets represents the degree of association between the two aggregated alarm log sets. For example, the attack target IP address information, attack type information, attack chain stage information and attack target type information can be selected as the alarm feature information for calculating the correlation of the two aggregated alarm log sets, but this embodiment of the present application does not limit this. The selected alarm feature information is recorded as fj, j = 1, 2, ..., m, m is the number of selected alarm feature information, and taking the above 4 alarm feature information as an example, m = 4.

[0138] The server counts the number of identical alarm feature information contained in each of the two aggregated alarm log sets.

[0139] S25: Determine the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of alarm feature information.

[0140] In a specific implementation, the server determines the ratio of the number of identical alarm feature information contained in the two aggregated alarm log sets to the total number of alarm feature information as the correlation between the two aggregated alarm log sets.

[0141] Still taking the example of the server selecting the above four alarm feature information, the total number of selected alarm feature information is m=4. Assuming that the number of the same alarm feature information among the above four alarm feature information contained in the alarm logs a1 and a2 in the aggregated alarm log set A and the alarm logs b2 and b3 in the aggregated alarm log set B is p, and p=2, then the correlation between the aggregated alarm log sets A and B is: p / m=2 / 4=50%.

[0142] In this way, the server can calculate the correlation between every two aggregated alarm log sets and update the correlation table, as shown in Table 2:

[0143] Table 2

[0144]

[0145]

[0146] As shown in Table 2, the correlation between the aggregated alarm log sets A and B is 75%, and the related alarm features, that is, the same alarm features, include three: f1, f2 and f4. The correlation between the aggregated alarm log sets A and C is 50%, and the related alarm features include two: f1 and f3. The correlation between the aggregated alarm log sets C and D is 80%, and the related alarm features include four: f1, f2, f4 and f5.

[0147] S26. Correlate and display two aggregated alarm log sets whose correlation is greater than a correlation threshold.

[0148] In specific implementation, the server pre-sets a correlation threshold. If the correlation of two aggregated alarm logs is greater than the correlation threshold, the two aggregated alarm logs are associated and displayed on the server front end. In implementation, the correlation threshold can be set according to demand, such as 60%, which is not limited in the embodiment of the present application.

[0149] The alarm aggregation processing method provided in the embodiment of the present application is that the server obtains the alarm logs of the network security equipment in the current time period, extracts the alarm feature information of each alarm log respectively, determines the related alarm logs in each time window of the current time period based on the alarm feature information of each alarm log, aggregates the related alarm logs in the same time window of the current time period to obtain an aggregated alarm log set, and for every two aggregated alarm log sets, counts the number of identical alarm feature information contained in the two aggregated alarm log sets, determines the correlation between the two aggregated alarm log sets based on the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of alarm feature information, and displays the two aggregated alarm log sets whose correlation is greater than the correlation threshold as associated. In the embodiment of the present application, the associated alarm logs in each time window of the current time period are determined according to the alarm feature information of each alarm log, and then the associated key logs in the same time window of the current time period are aggregated to obtain an aggregated alarm log set, and the correlation between each two aggregated alarm log sets is determined according to the number of identical alarm feature information contained in each two aggregated alarm log sets and the total number of alarm feature information, so as to merge alarms and obtain alarm correlation, and associate and display the aggregated alarm log sets with high correlation as the basis for subsequent attack chain restoration and judgment. Compared with the prior art, the present application determines the associated alarm logs from the alarm feature dimension and generates an aggregated alarm log set, identifies the aggregated alarm log set with a high correlation greater than the correlation threshold, and can conveniently obtain the associated alarm logs and the correlation between each two aggregated alarm log sets without relying on a large amount of complex prior knowledge and association rules, thereby improving the accuracy of alarm aggregation.

[0150] Based on the same inventive concept, an embodiment of the present application also provides an alarm aggregation processing device. Since the principle of solving the problem by the above-mentioned alarm aggregation processing device is similar to the above-mentioned alarm aggregation processing method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0151] like Figure 6 As shown, it is a schematic diagram of the structure of the alarm aggregation processing device provided in the embodiment of the present application, which can be applied to Figure 1In the server 103 shown, the alarm aggregation processing device includes:

[0152] An acquisition module 51 is used to acquire the alarm logs of network security devices within the current time period;

[0153] A first determination module 52, configured to extract the alarm characteristic information of each alarm log respectively, and determine the associated alarm logs in each time window of the current time period based on the alarm characteristic information of each alarm log;

[0154] Aggregation module 53, used for aggregating related alarm logs in the same time window of the current time period to obtain an aggregated alarm log set;

[0155] A statistics module 54, configured to count, for each two aggregated alarm log sets, the number of identical alarm feature information contained in the two aggregated alarm log sets;

[0156] A second determination module 55 is used to determine the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of the alarm feature information, wherein the correlation between the two aggregated alarm log sets represents the degree of association between the two aggregated alarm log sets;

[0157] The display module 56 is used to associate and display two aggregated alarm log sets whose correlation is greater than a correlation threshold.

[0158] In one embodiment, the alarm characteristic information includes at least the following characteristic information: attack source IP address information, attack target IP address information, attack type information and attack time information;

[0159] The device further comprises:

[0160] A third determination module is used to determine the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period according to the alarm characteristic information of each alarm log before determining the associated alarm log of the alarm log in each time window of the current time period based on the alarm characteristic information of each alarm log, wherein the alarm density of the alarm log represents the number of units of the alarm log within the time interval between the attack time information of the last appearance of the alarm log in the time window and the attack time information of the first appearance; the related alarm log of the alarm log is an alarm log having the same attack source IP address information or attack target IP address information as that contained in the alarm log, but with different attack type information;

[0161] A fourth determination module, configured to determine the isolated alarm logs in the corresponding time window according to the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period;

[0162] The deletion module is used to delete isolated alarm logs in each time window.

[0163] The first determination module 52 is specifically configured to determine, for each time window of the current time period, alarm logs with the same first characteristic information contained in the time window as associated alarm logs, where the first characteristic information is any characteristic information in the alarm characteristic information.

[0164] In one implementation, the second determination module 55 is specifically configured to determine the ratio of the number of identical alarm feature information contained in the two aggregated alarm log sets to the total number of the alarm feature information as the correlation between the two aggregated alarm log sets.

[0165] In one implementation, the third determination module is specifically configured to calculate, for each time window of the current time period, the alarm density of each alarm log in the time window by using the following formula:

[0166]

[0167] in, Indicates the i-th alarm log A in the time window i The alarm density;

[0168] n represents the i-th alarm log A in the time window i the number of

[0169] A i,n .timestamp indicates the i-th alarm log A i Attack time information at the nth occurrence within the time window;

[0170] A i,1 .timestamp indicates the i-th alarm log A i Attack time information at the first occurrence within the time window.

[0171] In one implementation, the fourth determination module is specifically configured to determine the alarm logs whose alarm density in each time window is less than a density threshold as isolated alarm logs in the corresponding time window.

[0172] In one embodiment, the third determination module is specifically used to determine, for each alarm log in each time window of the current time period, the first alarm log in the time window that is the same as the attack source IP address information or the attack target IP address information in the alarm characteristic information of the alarm log and different from the attack type information in the alarm characteristic information of the alarm log, as a related alarm log of the alarm log; and to count the number of related alarm logs of each alarm log respectively.

[0173] In one implementation, the fourth determination module is specifically configured to determine the alarm logs whose number of related alarm logs in each time window is less than a number threshold as isolated alarm logs in the corresponding time window.

[0174] Based on the same technical concept, the present application embodiment also provides an electronic device 600, referring to Figure 7 As shown, the electronic device 600 is used to implement the alarm aggregation processing method recorded in the above method embodiment. The electronic device 600 of this embodiment may include: a memory 601, a processor 602, and a computer program stored in the memory and executable on the processor, such as an alarm aggregation processing program. When the processor executes the computer program, the steps in the above-mentioned various alarm aggregation processing method embodiments are implemented.

[0175] The specific connection medium between the memory 601 and the processor 602 is not limited in the embodiment of the present application. Figure 7 In the embodiment, the memory 601 and the processor 602 are connected via a bus 603. The bus 603 is Figure 7 The connection between other components is shown by bold lines, which is only for schematic illustration and is not intended to be limiting. The bus 603 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0176] The memory 601 may be a volatile memory, such as a random-access memory (RAM); the memory 601 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 601 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 601 may be a combination of the above memories.

[0177] Processor 602 is used to implement the alarm aggregation processing method provided in the embodiment of the present application.

[0178] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0179] In some possible implementations, various aspects of the alarm aggregation processing method provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the alarm aggregation processing method according to various exemplary implementations of the present application described above in this specification.

[0180] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0181] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0182] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0183] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0184] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0185] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for processing alarm aggregation, characterized in that: include: Obtain the alarm logs of network security devices within the current time period; Extracting the alarm characteristic information of each alarm log respectively, and determining the associated alarm logs in each time window of the current time period based on the alarm characteristic information of each alarm log; Aggregating the related alarm logs in the same time window of the current time period to obtain an aggregated alarm log set; For every two aggregated alarm log sets, counting the number of identical alarm feature information contained in the two aggregated alarm log sets; Determine the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of the alarm feature information, wherein the correlation between the two aggregated alarm log sets represents the degree of association between the two aggregated alarm log sets; Two aggregated alarm log sets whose correlation is greater than the correlation threshold are associated and displayed.

2. The method according to claim 1, characterized in that The alarm characteristic information includes at least the following characteristic information: attack source IP address information, attack target IP address information, attack type information and attack time information; Before determining the associated alarm log of the alarm log within each time window of the current time period based on the alarm characteristic information of each alarm log, the method further includes: Determine the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period according to the alarm characteristic information of each alarm log, the alarm density of the alarm log represents the number of units of the alarm log within the time interval between the attack time information of the last appearance of the alarm log in the time window and the attack time information of the first appearance; the related alarm log of the alarm log is an alarm log with the same attack source IP address information or attack target IP address information as that contained in the alarm log, but with different attack type information; Determine the isolated alarm logs in the corresponding time window according to the alarm density of each alarm log or the number of related alarm logs in each time window of the current time period; Delete isolated alarm logs within each time window.

3. The method according to claim 1 or 2, characterized in that Determining the associated alarm logs in each time window of the current time period based on the alarm feature information of each alarm log specifically includes: For each time window of the current time period, the alarm logs with the same first characteristic information contained in the time window are determined as associated alarm logs, where the first characteristic information is any characteristic information in the alarm characteristic information.

4. The method according to claim 3, characterized in that Determining the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of the alarm feature information specifically includes: The ratio of the number of identical alarm feature information contained in the two aggregated alarm log sets to the total number of the alarm feature information is determined as the correlation between the two aggregated alarm log sets.

5. The method according to claim 2, characterized in that Determining the alarm density of each alarm log in each time window of the current time period according to the alarm feature information of each alarm log specifically includes: For each time window of the current time period, the alarm density of each alarm log in the time window is calculated by the following formula: Among them, ρ Ai Indicates the i-th alarm log A in the time window i The alarm density; n represents the i-th alarm log A in the time window i the number of A i,n .timestamp indicates the i-th alarm log A i Attack time information at the nth occurrence within the time window; A i,1 .timestamp indicates the i-th alarm log A i Attack time information at the first occurrence within the time window.

6. The method according to claim 2 or 5, characterized in that Determining, according to the alarm density of each alarm log in each time window of the current time period, an isolated alarm log in the corresponding time window, specifically includes: The alarm logs whose alarm density in each time window is less than the density threshold are determined as isolated alarm logs in the corresponding time window.

7. The method according to claim 2, characterized in that Determining the number of related alarm logs of each alarm log in each time window of the current time period according to the alarm characteristic information of each alarm log specifically includes: For each alarm log in each time window of the current time period, the first alarm log in the time window that is the same as the attack source IP address information or the attack target IP address information in the alarm feature information of the alarm log and different from the attack type information in the alarm feature information of the alarm log is determined as a related alarm log of the alarm log; Count the number of related alarm logs of each alarm log.

8. The method according to claim 2 or 7, characterized in that Determining the isolated alarm logs in the corresponding time window according to the number of related alarm logs of each alarm log in each time window of the current time period specifically includes: The alarm logs whose number of related alarm logs in each time window is less than the number threshold are determined as isolated alarm logs in the corresponding time window.

9. An alarm aggregation processing device, characterized in that: include: An acquisition module is used to obtain the alarm logs of network security devices within the current time period; A first determination module, configured to extract the alarm characteristic information of each alarm log respectively, and determine the associated alarm logs in each time window of the current time period based on the alarm characteristic information of each alarm log; An aggregation module, used to aggregate the associated alarm logs in the same time window of the current time period to obtain an aggregated alarm log set; A statistical module, used for counting the number of identical alarm feature information contained in each of two aggregated alarm log sets; A second determination module is used to determine the correlation between the two aggregated alarm log sets according to the number of identical alarm feature information contained in the two aggregated alarm log sets and the total number of the alarm feature information, wherein the correlation between the two aggregated alarm log sets represents the degree of association between the two aggregated alarm log sets; The display module is used to associate and display two aggregated alarm log sets whose correlation is greater than a correlation threshold.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the alarm aggregation processing method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the alarm aggregation processing method according to any one of claims 1 to 8 are implemented.

Images