Alarm information display method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention relates to an alarm information display method and device, equipment, a storage medium and a program product. The method comprises the steps of displaying an information detail page of target alarm information in response to an alarm information viewing operation; respectively displaying the alarm overview information, the alarm brief introduction information, the alarm analysis details and each analysis dimension identifier in the alarm analysis details presented in a catalogue form in a first display area, a second display area, a third display area and a fourth display area of the information detail page; the alarm overview information comprises at least one of a processing state icon, an alarm category label, a label setting control, alarm times, a first alarm date and a last alarm date; the alarm analysis details are analysis results generated by analyzing the alarm data from a plurality of preset analysis dimensions. Therefore, the information layout structure and the richness of the alarm overview information are optimized, so that the user can quickly position the required information, and the information readability and the information acquisition efficiency are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of information display technology, and in particular, to an alarm information display method, device, equipment, storage medium and program product. Background Art

[0002] In the field of network security, relevant personnel will set some network access isolation policies to monitor whether there are network security threats in the network access request and request response process, and generate alarm information when a network security threat is detected. Then, relevant personnel can trace the source by viewing and analyzing the alarm information, and dispose of corresponding operations or files, etc., to ensure and maintain the security of cloud resources / assets.

[0003] Currently, the alarm information viewed by relevant personnel mainly includes an alarm title, whether the alarm has been processed, resources involved in the alarm, a risk description of the corresponding operation of the alarm, and simple disposal suggestions, etc. Such a display method of alarm information not only displays relatively brief information, which cannot provide sufficient data support for relevant personnel to dispose of alarms, but also the alarm information is mainly in a flat text form, with poor readability and high reading cost, resulting in low efficiency for relevant personnel to obtain information. Summary of the Invention

[0004] To solve the above technical problems, embodiments of the present disclosure provide an alarm information display method, device, equipment, storage medium and program product.

[0005] In a first aspect, an embodiment of the present disclosure provides an alarm information display method, which includes:

[0006] Responding to an alarm information viewing operation, and displaying an information details page of the target alarm information;

[0007] In a first display area, a second display area, a third display area and a fourth display area of the information details page, alarm overview information, alarm brief introduction information, alarm analysis details and each analysis dimension identifier in the alarm analysis details presented in a catalog form are respectively displayed; wherein, the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date and the last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions.

[0008] In a second aspect, an embodiment of the present disclosure further provides an alarm information display device, which includes:

[0009] A page display module, configured to respond to an alarm information viewing operation and display an information details page of the target alarm information;

[0010] An alarm details display module, configured to display alarm overview information, alarm brief introduction information, alarm analysis details, and each analysis dimension identifier in the alarm analysis details presented in a catalog form in the first display area, the second display area, the third display area, and the fourth display area of the information details page respectively; wherein, the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date, and the last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions.

[0011] In a third aspect, an embodiment of the present disclosure further provides an electronic device, which includes:

[0012] A processor;

[0013] A memory for storing executable instructions;

[0014] Wherein, the processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the alarm information display method described in any embodiment of the present disclosure.

[0015] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor is caused to implement the alarm information display method described in any embodiment of the present disclosure.

[0016] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, and the computer program product is used to execute the alarm information display method described in any embodiment of the present disclosure.

[0017] The alarm information display method, device, equipment, storage medium and program product according to the embodiments of the present disclosure can respond to an alarm information viewing operation and display an information details page of target alarm information; in a first display area, a second display area, a third display area and a fourth display area of the information details page, alarm overview information, alarm brief introduction information, alarm analysis details and each analysis dimension identifier in the alarm analysis details presented in a catalog form are respectively displayed; the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date and the last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions; on the one hand, the information details page is divided into four display areas to display each part of the content with logical relationships in the target alarm information, optimizing the display layout structure of the alarm information, enabling the user to quickly determine the display area of the information they want to know, and enabling the user to quickly locate the display position of the information they need from the alarm analysis details rich in information through a catalog form, improving the readability of the alarm information and the information search efficiency; on the other hand, rich alarm analysis details can be displayed through multiple preset analysis dimensions, improving its information content and the analysis depth of the alarm data, so as to provide sufficient data support for relevant personnel to handle alarms; on the other hand, by increasing the information dimension and its value of the alarm overview information, the alarm overview content can be enriched, and the readability of the overview information can be further improved, enabling the user to quickly understand the basic situation of the alarm information as a whole through the alarm overview information, and further improving the efficiency of the user to obtain the information they need.

[0018] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions, and corresponding operation entrances are provided for the user to choose to authorize or reject. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In combination with the accompanying drawings and with reference to the following specific embodiments, the above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic, and the elements and elements are not necessarily drawn to scale.

[0020] Figure 1 It is a schematic diagram of the display of alarm information in the related art;

[0021] Figure 2Schematic flowchart of an alarm information display method provided by an embodiment of the present disclosure;

[0022] Figure 3 Schematic diagram of the display of the information details page of a target alarm information provided by an embodiment of the present disclosure;

[0023] Figure 4 Schematic diagram of the editing process of an alarm category label provided by an embodiment of the present disclosure;

[0024] Figure 5 Schematic diagram of the change process of a processing status icon provided by an embodiment of the present disclosure;

[0025] Figure 6 Schematic diagram of the display of an alarm handling method provided by an embodiment of the present disclosure;

[0026] Figure 7 Schematic diagram of the adjustment process of a risk level identifier provided by an embodiment of the present disclosure;

[0027] Figure 8 Schematic diagram of a process tree in target behavior information provided by an embodiment of the present disclosure;

[0028] Figure 9 Schematic diagram of multiple alarm bases provided by an embodiment of the present disclosure;

[0029] Figure 10 Schematic diagram of an alarm handling suggestion provided by an embodiment of the present disclosure;

[0030] Figure 11(a) is a schematic diagram of some candidate attack graphs provided by an embodiment of the present disclosure;

[0031] Figure 11(b) is a schematic diagram of some other candidate attack graphs provided by an embodiment of the present disclosure;

[0032] Figure 11(c) is a schematic diagram of some more candidate attack graphs provided by an embodiment of the present disclosure;

[0033] Figure 12 Schematic diagram of the distribution of alarm information provided by an embodiment of the present disclosure;

[0034] Figure 13 Schematic diagram of the structure of an alarm information display device provided by an embodiment of the present disclosure;

[0035] Figure 14 Schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Detailed implementation manners

[0036] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Instead, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not used to limit the protection scope of the present disclosure.

[0037] It should be understood that the various steps recited in the method embodiments of the present disclosure can be executed in a different order and / or executed in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this regard.

[0038] As used herein, the term "including" and its variations are open-ended, that is, "including but not limited to". The term "based on" is "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0039] It should be noted that the concepts such as "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or mutual dependency relationship of the functions executed by these devices, modules or units.

[0040] It should be noted that the modifications of "one" and "plural" mentioned in the present disclosure are illustrative rather than restrictive. Those skilled in the art should understand that unless clearly specified otherwise in the context, it should be understood as "one or more".

[0041] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only for illustrative purposes and are not used to limit the scope of these messages or information.

[0042] See Figure 1, the alarm information in the related art is mainly displayed in two parts. One part is the alarm overview information, which includes the alarm title, the risk level of the alarm (such as high risk), the alarm status (such as unprocessed), the resources affected by the alarm (such as xx containers), the time of the most recent alarm, and the alarm handling method of adding to the whitelist; the other part is the risk description, attack type, attack status, trigger policy, handling suggestions, and associated logs that introduce the concept of alarm risk in text form. On the one hand, these alarm information only simply organize the relevant data generated by the alarm, lacking some in-depth analysis information and clear core information, and cannot provide sufficient data support for relevant personnel to handle the alarm, resulting in relatively low handling efficiency and accuracy of the alarm information for relevant personnel; on the other hand, these alarm information are mainly presented in text form, and the information layout is relatively flat, with the key information not prominent, making it have poor readability, high reading cost, reducing the efficiency of relevant personnel to obtain the information they need, and further leading to low handling efficiency of relevant personnel for alarm information.

[0043] Based on the above situation, the embodiments of the present disclosure provide an alarm information display solution to achieve in-depth analysis of alarm data, obtain detailed alarm analysis and simple and clear core labels at the head, and be able to quickly provide sufficient data support for relevant personnel to handle alarms, improving their efficiency in handling alarm information; in addition, the alarm information can be divided into four parts with clear logical relationships for partition display, and the identification of each analysis dimension in the alarm analysis information with a large amount of information is displayed in the form of a directory, which well optimizes the information layout structure and improves the efficiency of relevant personnel to locate the information they need, thereby improving the information acquisition efficiency.

[0044] The alarm information display method provided by the embodiments of the present disclosure is applicable to scenarios of displaying or managing alarm information in the field of network security. This method can be executed by an alarm information display device, which can be implemented in software and / or hardware, and can be integrated in an electronic device with a display function. The electronic device may include, but is not limited to, smartphones, personal digital assistants (PDAs), tablet personal computers (Tablet PCs), laptops, mobile workstations, desktop computers, etc.

[0045] Figure 2 shows a schematic flowchart of an alarm information display method provided by the embodiments of the present disclosure. As Figure 2 shown, the alarm information display method may include the following steps:

[0046] S210. In response to an alarm information viewing operation, display an information details page of the target alarm information.

[0047] Among them, the target alarm information is a selected alarm information to be viewed, which corresponds to an alarm event. Exemplarily, the target alarm information includes the alarm information generated for network security monitoring of cloud resources. Cloud resources are various infrastructure resources such as computing, storage, and network provided in the cloud computing environment, which may include computing resources such as virtual machines, containers, and serverless, may also include storage resources such as object storage, block storage, and file storage, may also include network resources such as virtual private cloud (VPC), load balancer, and content delivery network (CDN), and may also include service resources such as artificial intelligence / machine learning services and big data analysis tools. The alarm information can be obtained by performing network security-related performance monitoring / cloud monitoring on cloud resources through the alarm-related functions provided by public cloud / cloud services.

[0048] Specifically, relevant personnel can perform an interactive operation to view the alarm information, such as selecting one of the alarm information from the alarm list, or starting an application / web page / miniapp with the function of viewing the alarm information. In response to the above interactive operation, the electronic device uses one of the alarm information selected by the relevant personnel or one of the alarm information default selected by the above function as the target alarm information, and displays a page presenting the specific content of the target alarm information (i.e., the information details page).

[0049] S220. In the first display area, second display area, third display area, and fourth display area of the information details page, display the alarm overview information, alarm brief introduction information, alarm analysis details, and each analysis dimension identifier in the alarm analysis details presented in a catalog form respectively; the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date, and the last alarm date.

[0050] Among them, the first display area, second display area, third display area, and fourth display area are four different display areas on the page respectively. These four display areas can be display areas arranged in a certain information viewing direction order, such as four display areas arranged in order from top to bottom; they can also be display areas scattered in the page according to the information importance degree, such as Figure 3The header area 310, the left area 320, the middle area 330, and the right area 340 therein. The alarm overview information is summary information that summarizes and displays the target alarm information generated in the system. The alarm introduction information is information that introduces the basic situation of the alarm event. For example, it may include the alarm occurrence time, the alarm level, the attack type, the policy that triggers the alarm, the attack result of the alarm event, and so on. The alarm analysis details are structured information obtained by deeply analyzing the alarm data. The alarm data are various data generated during the entire process of the alarm event occurring, such as logs, stacks, processes, files, and so on. The alarm analysis details in the embodiments of the present disclosure are analysis results generated by analyzing the alarm data from multiple preset analysis dimensions. The preset analysis dimensions are data analysis dimensions set in advance. For example, they may be the relationship dimension of network attacks, the causal relationship dimension for generating alarm conclusions, the target network resource dimension involved in the alarm, the alarm trigger behavior dimension involved in the alarm, the log dimension, or the alarm handling dimension, etc. The target network resources are cloud resources involved in the alarm event. For example, they may include risk IP addresses / malicious IP addresses, malicious domain names, and file hash values (abbreviated as file hash), etc. The alarm trigger behavior is the operation or behavior that triggers the alarm. For example, it may be accessing a file, executing a process and its context, etc. The analysis dimension identifier is the identifier of the preset analysis dimension. The processing status icon is the processing status (such as processed or unprocessed) of the alarm information displayed in the form of a visual icon. The alarm category label is a visual label that classifies and marks the alarm event, and it can characterize the nature, severity, etc. of the alarm event. The label setting control is an interactive control used to customize the setting of the alarm category label.

[0051] Specifically, the electronic device displays the alarm overview information in the first display area of the information details page. The alarm overview information includes at least one of the processing status icon, the alarm category label, the label setting control, the alarm count, the first alarm date, and the last alarm date. In this way, relevant personnel can more quickly learn about the general situation of the target alarm information through the alarm overview information with higher visualization and richer information, so as to quickly make a reasonable judgment on the severity and processing status of the alarm information. The electronic device displays the relatively basic alarm introduction information in the second display area of the information details page, displays the relatively detailed alarm analysis details in the third display area, and presents the analysis dimension identifiers in the alarm analysis details in a catalog form in the fourth display area. In this way, relevant personnel can view the alarm information in different areas according to their needs, and can quickly locate the specific content in the alarm analysis details with a large amount of content through the cataloged analysis dimension identifiers, greatly improving the alarm analysis depth and information content in the information details page, and better optimizing the page layout structure, making the presented alarm information clear at a glance and highlighting the key points, thereby improving the readability and information acquisition efficiency of the alarm information.

[0052] See Figure 3 As shown in Figure 3 , the electronic device displays the alarm overview information in the header area 310 of the information details page, which includes the alarm title, a prominently displayed visual processing status icon 311, an alarm category label 312, a label setting control 313, the number of times the alarm has occurred (i.e., the alarm count), the first alarm date 314, and the last alarm date 315. In this way, through the alarm overview information, relevant personnel can quickly learn whether the alarm has been processed, the nature of the alarm, the severity of the alarm, the duration and frequency of the alarm occurrence, etc., so as to quickly judge the alarm information. The electronic device displays relatively basic alarm introduction information in the left area 320 of the information details page, displays relatively detailed alarm analysis details of alarm analysis / study in the middle area 330, and displays positioning anchors for each analysis dimension of the alarm analysis details in the right area 340.

[0053] The alarm information display method provided by the embodiments of the present disclosure can, in response to an alarm information viewing operation, display an information details page of the target alarm information; display alarm overview information, alarm introduction information, alarm analysis details, and identification of each analysis dimension in the alarm analysis details presented in a catalog form in the first display area, the second display area, the third display area, and the fourth display area of the information details page respectively; the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, an alarm count, a first alarm date, and a last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions; on the one hand, the information details page is divided into four display areas to display each part of the target alarm information with logical relationships, optimizing the display layout structure of the alarm information, enabling the user to quickly determine the display area of the information they want to know, and enabling the user to quickly locate the display position of the information they need from the information-rich alarm analysis details through the catalog form, improving the readability of the alarm information and the information search efficiency; on the other hand, rich alarm analysis details can be displayed through multiple preset analysis dimensions, enhancing its information content and the depth of analysis of the alarm data, so as to provide sufficient data support for relevant personnel to handle the alarm; on the other hand, by increasing the information dimension and its value of the alarm overview information, the alarm overview content can be enriched, and the readability of the overview information can be further improved, enabling the user to quickly understand the basic situation of the alarm information as a whole through the alarm overview information, and further improving the efficiency of the user to obtain the information they need.

[0054] In some embodiments, when the alarm overview information includes a label setting control, the method further includes: in response to a triggering operation on the label setting control, displaying a label editing interface in the surrounding area of the label setting control, and displaying a plurality of candidate category labels in the label editing interface; in response to a configuration operation on a candidate category label, determining the configured candidate category label as an alarm category label, and displaying the alarm category label in the first display area.

[0055] Specifically, regardless of whether an alarm category label is already displayed in the first display area, the electronic device can display the label setting control in the first display area. For example, when there is no alarm category label, the label setting control is displayed so that relevant personnel can add appropriate alarm category labels by themselves; when there are already some alarm category labels, the label setting control is displayed, which allows relevant personnel to continue adding alarm category labels and / or delete existing alarm category labels to improve the presented alarm category labels.

[0056] See Figure 4 , the electronic device can, in response to a triggering operation by relevant personnel on the label setting control 410, display an interactive interface (i.e., the label editing interface 420) for editing alarm categories in the surrounding area of the label setting control 410 (such as the immediately adjacent lower area, or a pop-up window area, or a floating layer area, etc.). A plurality of candidate alarm category labels (i.e., candidate category labels 421), a radio box 422 corresponding to each candidate category label 421, and a label color setting control 423 are displayed in the label editing interface 420. Relevant personnel can select the corresponding candidate category label 421 by triggering the radio box 422. In addition, relevant personnel can, by triggering the label color setting control 423 corresponding to the selected candidate category label 421, cause the electronic device to display a corresponding label color setting interface 430 in its surrounding area. Then, through a selection operation on each candidate color in the label color setting interface 430, the electronic device can determine the label color of the selected candidate category label 421. After that, the electronic device can use the selected candidate category label 421 as an alarm category label and display it at the position of the label setting control 410 in the first display area according to the selected label color. This can provide relevant personnel with an interactive function for marking the alarm category to which the target alarm information belongs, thereby improving the accuracy of the alarm category label and the richness and visualization of the alarm overview information.

[0057] It should be noted that if the number of alarm category labels set by relevant personnel is too large to be fully displayed in the first display area, then the number of hidden alarm category labels can be displayed around the last alarm category label, such as "+2" after the "rule false alarm" label. In this way, relevant personnel can view the hidden alarm category labels by triggering this label number.

[0058] In some embodiments, referring still to Figure 3 , the electronic device also displays a processing status change control 316 in the first display area (i.e., the head area 310). The processing status change control is an interactive control for changing the processing status of the warning information.

[0059] Based on the above embodiments, the method further includes: in response to a trigger operation on the processing status change control, displaying a processing status change interface in the peripheral area of the processing status change control, and displaying a plurality of candidate processing status information in the processing status change interface; in response to a selection operation on the candidate processing status information, changing the processing status icon based on the selected candidate processing status information.

[0060] Specifically, referring to Figure 5 , the electronic device can, in response to a trigger operation on the processing status change control 510 by a relevant person, display an interactive interface (i.e., the processing status change interface 520) that can change the processing status of the warning information in the peripheral area of the processing status change control 510 (such as the immediately adjacent lower area, or a pop-up window area, or a floating layer area, etc.). In the processing status change interface 520, there are displayed a plurality of illustrative information on the candidate processing statuses (i.e., candidate processing status information), such as "processed and marked as a real risk", "processed and marked as a false alarm", "processed and marked as ignored", etc., and selection controls (such as radio boxes, radio buttons, etc.) are displayed around each candidate processing status information. After the relevant person triggers the selection control corresponding to a certain candidate processing status information, the electronic device can, in response to this trigger operation, determine the final processing status of the target warning information based on the candidate processing status information corresponding to the triggered selection control, and use the processing status icon corresponding to this final processing status to replace the original processing status icon. For example, after the relevant person selects "processed and marked as a real risk", the electronic device can change the original processing status icon of "unprocessed" to the processing status icon of "processed". This can facilitate the relevant person to edit the processing status of the warning information, improve the accuracy of the warning overview information, and thus improve the accuracy of information acquisition by the relevant person.

[0061] In some embodiments, referring still to Figure 3 , the electronic device also displays a warning handling control 317 in the first display area (i.e., the head area 310). The warning handling control is an interactive control for handling the warning information and its related cloud resources.

[0062] Based on the above embodiments, the method further includes: in response to a trigger operation on the alarm handling control, displaying an alarm handling interface in the surrounding area of the alarm handling control, and displaying a plurality of candidate alarm handling methods in the alarm handling interface; in response to a selection operation on the candidate alarm handling method, handling the target alarm information based on the selected candidate handling method.

[0063] Specifically, referring to Figure 6 , the electronic device can, in response to a trigger operation by relevant personnel on the alarm handling control 610, display an interactive interface with alarm handling functions (i.e., the alarm handling interface 620) in the surrounding area of the alarm handling control 610 (such as the immediately adjacent lower area, or the pop-up window area, or the floating layer area, etc.). A plurality of candidate alarm handling methods (i.e., candidate alarm handling methods) are displayed in the alarm handling interface 620, such as "add to whitelist", "block process", "isolate pod", "ban IP", etc. One candidate alarm handling method corresponds to one alarm handling function. After relevant personnel select a certain alarm handling method, the electronic device can execute the corresponding alarm handling function in response to this selection operation. For example, if relevant personnel select the candidate handling method of "kill container" under the "handle container" group, the electronic device can, in response to this selection operation, determine the container hit by the target alarm information, and then terminate or destroy the running container. This can provide a more diverse way to handle alarm information instead of a single way of adding to the whitelist, thereby improving the diversity and convenience of handling alarm information, and further improving the efficiency of handling alarm information.

[0064] In some embodiments, alarm brief information is displayed in the second display area of the information details page, including: sequentially displaying the alarm summary, alarm basic information, and the target resource identifier corresponding to the target alarm information in the alarm brief information in the second display area of the information details page.

[0065] Among them, the alarm summary is obtained by generating a summary of the alarm data, which refines and summarizes the core content of the alarm event, aiming to help relevant personnel quickly understand the key information of the alarm. The alarm basic information is the information in the target warning information that introduces the basic situation of the alarm event. Exemplarily, the alarm basic information includes at least one of the network protection and isolation policy hit by the target alarm information, the type of network access attack that triggers the alarm event (i.e., the attack type), the risk level identifier indicating the severity of the alarm, the key alarm identifier indicating whether the alarm information is an important alarm, and the alarm identifier editing control for editing the key alarm identifier. The target resource identifier is the identifier of the cloud resource affected by the target alarm information, which can include the identifier of the directly affected cloud resource, or the identifiers of the upstream and downstream resources of the directly affected cloud resource.

[0066] Specifically, continue to refer to Figure 3 In the left region 320, the electronic device sequentially displays an alarm summary 321, alarm basic information 322, and a target resource identifier 323 corresponding to the target alarm information.

[0067] The alarm summary 321 can briefly reflect the core content of the alarm event. For example, Figure 3 the alarm summary in

[0068] describes the cause of the target alarm information, such as performing xx behavior on xx resource and triggering xx alarm feature, etc. The alarm basic information 322 includes the occurrence time of the alarm event, the hit network protection isolation policy, the attack type, the alarm automatic response method (such as only alarm, alarm + automatic handling, etc.), the attack stage (such as initial intrusion), the attack direction (such as attacking from outside to inside), the attack status of whether the attack is successful, a risk level identifier 3221, the risk level confidence, a key alarm identifier, and an alarm identifier editing control 3222. Among them, the network protection isolation policy can be presented in the form of an interactive control (such as underlined hyperlink text or button, etc.) to represent the viewing entry of the policy information and improve the convenience of viewing the policy information corresponding to the alarm event. Among them, the attack type, attack stage, attack direction, and attack status, etc., are all highlighted in a display style with a high degree of visualization to reduce the reading cost of these relatively important information and improve the information acquisition efficiency. Here, the risk level identifier and the key alarm identifier can respectively display the initial risk level identifier and the initial key alarm identifier obtained by automatically analyzing the alarm data.

[0069] The target resource identifier 323 displays the identifiers of cloud resources at different levels affected by the alarm event (such as resource name, resource abbreviation, etc.). Cloud resources at different levels can be, for example, directly affected pods, namespaces, clusters, associated applications, associated images, and hosts related to the pods. Moreover, in order to further improve the information acquisition efficiency and convenience of the affected assets, in this embodiment, the target resource identifiers at each level can be displayed in the form of interactive controls (such as underlined hyperlink text or buttons, etc.) to provide a viewing entry for the detailed information of the corresponding resources.

[0070] The alarm profile information grouped and displayed by the alarm summary, alarm basic information, and target resource identifier not only further enriches the information types and information content presented on the page, but also provides viewing entries for more extended information, further improves the viewing convenience and information acquisition efficiency of relevant information, and optimizes the information layout structure and increases the degree of information visualization, further improving the information acquisition efficiency.

[0071] It should also be noted that a region folding control 324 may also be displayed in the left region 320. In this way, the left region 320 can be hidden or shown by triggering the region folding control 324, thereby improving the convenience of displaying the alarm summary information as needed and the convenience of viewing the alarm analysis details in the middle region 330.

[0072] In some embodiments, after the alarm summary, the alarm basic information, and the target resource identifier corresponding to the target alarm information are sequentially displayed in the second display region of the information details page, the method further includes: in response to a triggering operation on the target resource identifier, displaying the resource details of the target resource corresponding to the target resource identifier.

[0073] Specifically, according to the foregoing description, the target resource identifiers are all displayed in the form of interactive controls. Therefore, relevant personnel can trigger any level of target resource identifier. In response to this triggering operation, the electronic device can display the details of the target resource (i.e., the resource details) corresponding to the triggered target resource identifier in the surrounding area of the triggered target resource identifier or in a new page. This can avoid the process for relevant personnel to search for the detailed information of the resources affected by the alarm event by themselves, thereby improving the acquisition efficiency and convenience of the detailed information of these resources.

[0074] In some other embodiments, after the alarm summary, the alarm basic information, and the target resource identifier corresponding to the target alarm information are sequentially displayed in the second display region of the information details page, the method further includes: in response to a triggering operation on the network protection isolation policy, displaying the policy details of the network protection isolation policy.

[0075] Specifically, according to the foregoing description, the network protection isolation policy hit by the alarm event is displayed in the form of an interactive control. Therefore, relevant personnel can trigger the network protection isolation policy. In response to this triggering operation, the electronic device can display the details of the network protection isolation policy (i.e., the policy details) in the surrounding area of the network protection isolation policy or in a new page. This can avoid the process for relevant personnel to search for the detailed information of the network protection isolation policy by themselves, thereby improving the acquisition efficiency and convenience of the policy details.

[0076] In still some other embodiments, after the alarm summary, the alarm basic information, and the target resource identifier corresponding to the target alarm information are sequentially displayed in the second display region of the information details page, the method further includes: in response to a triggering operation on the risk level identifier, displaying a risk level adjustment interface, and in response to an adjustment operation on the risk level adjustment interface, changing the risk level identifier to the adjusted risk level identifier and a level adjustment identifier; wherein, the level adjustment identifier is used to represent the adjustment direction and adjustment step of the risk level.

[0077] Specifically, relevant personnel can modify the risk level identifier displayed in the second display area according to their judgment of the severity of the alarm information. Therefore, to improve the convenience of modifying the risk level identifier, the electronic device can display the risk level identifier in the form of an interactive control (such as the interactive button in Figure 3 ), or display an editing control in the peripheral area of the risk level identifier, etc. Relevant personnel can perform a triggering operation on the risk level identifier 3221 or its corresponding editing control. In response to this triggering operation, the electronic device displays an interface with a risk level adjustment function (i.e., a risk level adjustment interface), as shown in Figure 7 .

[0078] Figure 7 shows that the initially automatically recognized risk level identifier is the "high risk" identifier 710. When relevant personnel trigger it, a risk level adjustment interface 720 can be displayed. In the risk level adjustment interface 720, the operation behaviors or access permissions of the affected containers that are automatically matched and related to the network access isolation policy can be displayed, and a level adjustment identifier is correspondingly displayed at the peripheral position of each operation behavior / access permission. This level adjustment identifier is the adjustment direction and adjustment step for adjusting the risk level of the initial risk level identifier. This adjustment direction can be an adjustment to a higher level ( Figure 7 represented by an upward trend arrow) or an adjustment to a lower level ( Figure 7 represented by a downward trend arrow). The adjustment step is in units of one risk level, such as adjusting one risk level ( Figure 7 represented by the number "1") or adjusting two risk levels ( Figure 7 represented by the number "2"), etc. Relevant personnel can select a certain level adjustment identifier according to their judgment of the alarm event. In response to this selection operation, the electronic device adjusts the initial risk level identifier according to the selected level adjustment identifier, changes the initial risk level identifier displayed in the first display area to the adjusted risk level identifier, and correspondingly displays the selected level adjustment identifier at the peripheral position of the adjusted risk level identifier. For example, Figure 7 shows that the level adjustment identifier for adjusting one risk level upward is selected, the "high risk" identifier 710 can be changed to the "critical" identifier 730, and the level adjustment identifier for adjusting one risk level upward is displayed behind it. This can improve the convenience of modifying the risk level identifier and the accuracy of the risk level identifier, providing more accurate data support for relevant personnel to handle alarm information.

[0079] In some other embodiments, after displaying the alarm summary, the alarm basic information, and the target resource identifier corresponding to the target alarm information in sequence in the second display area of the information details page, the method further includes: in response to a trigger operation on the alarm identifier editing control, displaying an alarm identifier editing interface, and in response to an editing operation on the alarm identifier editing interface, changing the key alarm identifier to the adjusted alarm identifier.

[0080] Specifically, referring to Figure 3 , after a relevant person performs a trigger operation on the alarm identifier editing control 3222, the electronic device can display an interface with the function of editing whether the alarm is important (i.e., the alarm identifier editing interface). In the alarm identifier editing interface, the reasons for whether the target alarm information is important and their corresponding selection controls can be displayed. If a relevant person approves of a certain reason and triggers its corresponding selection control, the electronic device can use the identifier of whether it is important corresponding to this reason (such as a "yes" label or a "no" label) as the adjusted alarm identifier and use it to replace the original key alarm identifier. This can improve the marking accuracy of whether the alarm is important, thereby further providing more accurate data support for relevant personnel to handle alarm information.

[0081] In some embodiments, the alarm analysis details are displayed in the third display area of the information details page, including: sequentially displaying the alarm attack graph, the alarm basis corresponding to the alarm attack graph, associated alarm information, target behavior information, target original logs, and alarm handling suggestions in the alarm analysis details in the third display area of the information details page.

[0082] Among them, the alarm attack graph is a visual relationship graph of the attack process and attack results generated by analyzing alarm data from the relationship dimension of network access attacks. Exemplarily, the alarm attack graph includes an attacker icon, an attacked party icon, an attack direction icon (such as an arrow pattern), an attack type, and other information; the other information includes attack results and / or the number of attacks. The attacker icon can include a visual pattern of the attacker resource (such as an IP address, container, file, command line, or user, etc.) and a pattern representing the attack initiator. The attacked party icon can include a visual pattern of the attacked party resource (such as an IP address, port, container, host, file, command line, or encrypted hijacking instruction receiving address, etc.) and a pattern representing the attacked party. This can enhance the information content in the attack graph and at the same time improve its visualization level, thereby further improving information readability and information acquisition efficiency.

[0083] Among them, the alarm basis is the source information of the attack result generated by analyzing the alarm data from the causal relationship dimension of the alarm conclusion. The associated alarm information (also known as alarm intelligence information) is other alarm information generated by analyzing the alarm data from the target network resource dimension and associated with the target alarm information. The number of associated alarm information can be one or more.

[0084] Among them, the target behavior information (also known as sensitive behavior) is the behavior-related information generated by analyzing the alarm data from the alarm trigger behavior dimension. The behaviors here can cover various operations performed by users, systems, or application programs in the network environment, including but not limited to: process execution behaviors (also known as runtime behaviors) such as starting, stopping, or running a certain program or script, file access behaviors such as reading, writing, modifying, or deleting files, network communication behaviors such as initiating or receiving network connections and transmitting data, user operation behaviors such as logging in, logging out, and permission changes, etc.

[0085] Among them, the target original log is the original log associated with the target alarm information generated by extracting information from the alarm data from the log dimension. The alarm handling suggestion is the structured suggestion information for handling the target alarm information generated by analyzing the alarm data from the alarm handling dimension.

[0086] Specifically, continue to refer to Figure 3 , the electronic device sequentially displays the alarm attack graph, the alarm basis, the associated alarm information, the target behavior information, the target original log, and the alarm handling suggestion from top to bottom in the third display area of the information details page, that is, the middle side area 330. The alarm attack graph shows the information of all parties involved in the alarm event in the form of a picture, further improving the visualization degree of the information. The alarm basis summarizes the basis information for generating the alarm conclusion for the alarm event in the form of a table. For example, if the attack type of brute force cracking is used to attack 12 times, the conclusion of successful brute force cracking is obtained. Refer to Figure 9 , a display table of 6 alarm bases can be generated according to the attack type and the occurrence frequency of network access attacks. The electronic device can select a suitable display table from the 6 alarm bases according to the attack type of the target alarm information and display it in the third display area.

[0087] The associated alarm information is based on the target network resources and displays the associated alarm information corresponding to at least one target network resource affected by the current alarm event. The target behavior information displays the relevant information of at least one sensitive behavior that occurred in the current alarm event in the order of the occurrence time / process sequence. Each target behavior information may include basic information such as the time when the behavior occurred, the execution object of the behavior, the trigger command of the behavior, etc., and may also include the corresponding process tree. This process tree displays the information of at least one process corresponding to the behavior in a tree structure. For example, when the relevant personnel trigger the information viewing control (such as the "expand" button) corresponding to the process tree in Figure 3 a certain target behavior information, the electronic device can display the detailed information of the process tree as shown in Figure 8 .

[0088] Continue to refer to Figure 3 , all the original logs covered by the current alarm event can be displayed in the target original log module, including the original logs that triggered the alarm and those that did not trigger the alarm. The electronic device can provide multiple log filtering methods so that the relevant personnel can filter the logs more efficiently according to their needs. For example, an interactive control of "only view the logs that triggered the alarm" is provided, and the relevant personnel can filter out the logs that triggered the alarm by triggering this control. And, in order to further highlight the logs that triggered the alarm, these logs can be displayed in ways such as overlaying shading and bold text. In addition, a navigation control for log classification can also be provided so that the relevant personnel can filter the logs according to the category.

[0089] Continue to refer to Figure 3 , the alarm handling suggestions can include alarm handling suggestions in multiple dimensions such as handling suggestions and investigation suggestions to enrich the execution basis for alarm handling. And, the alarm handling suggestions in each dimension are displayed in a structured form to further improve the readability of the alarm handling suggestions. For example, when the relevant personnel perform a trigger operation on the information viewing control corresponding to the handling suggestion and / or investigation suggestion, the electronic device can display the detailed handling suggestion as shown in Figure 10 , and directly related parts of the text to the handling suggestion are highlighted (such as shading or checkbox) therein.

[0090] In this way, the detailed alarm analysis with a large content can be displayed in a grouped manner, which not only improves the analysis depth of the alarm data, thus improving the information richness and information content, but also enhances the information visualization degree, thereby further improving the information readability and information acquisition efficiency.

[0091] In some embodiments, before displaying the alarm attack graph, the electronic device can obtain the attack graph adapted to the target alarm information in the following manner: based on the attacker, the attacked party, and the attack type in the alarm data, screen the alarm attack graph from multiple candidate attack graphs.

[0092] Among them, the candidate attack graph is an attack graph pre-generated in advance by using the attack direction icon and the preset icons / patterns corresponding to various resources according to the attacker, the attacked party, and the attack type in the network access attack. As Figures 11(a) to 11(c) shown, the candidate attack graphs include brute force cracking graph, first port scanning graph, second port scanning graph, reverse shell graph, web backdoor script (Web Shell) disk drop graph, malicious file disk drop graph, remote code execution graph, account hijacking graph (also known as account abuse graph), malicious address access graph, container escape graph, process injection graph (also known as process extraction graph), system file tampering graph, self-start item modification graph, fileless execution graph, hidden file execution graph, process disguise graph, data leakage graph, or cryptocurrency mining hijacking attack graph. These candidate attack graphs can all establish corresponding relationships with the corresponding attacker, attacked party, and attack type.

[0093] Specifically, the electronic device can search for the above corresponding relationship according to the attacker, the attacked party, and the attack type in the target alarm information, and determine the alarm attack graph from each candidate attack graph. In this way, various scenarios of network access attacks can be displayed in the form of a visual graph, further improving the degree of information visualization.

[0094] In some embodiments, displaying the associated alarm information in the third display area includes: generating the associated alarm information corresponding to the target network resource based on at least one target network resource hit by the target alarm information; in the third display area, displaying the resource type label and resource identifier of the associated alarm information based on the target network resource, and displaying an information viewing control and a log search control.

[0095] Specifically, referring to Figure 3 continuously, the electronic device takes the target network resource hit by the target alarm information as a reference, retrieves multiple other alarm information related to the target network resource within a certain time range from a large amount of alarm data as the associated alarm information. Then, the electronic device can display these associated alarm information based on the target network resource (which can also be understood as aggregating each associated alarm information based on the target network resource). To save display space, the electronic device can first display the brief information of the associated alarm information, that is, the label of the resource type to which the target network resource belongs, the resource identifier of the target network resource (such as resource name or abbreviation or code, etc.), and the information viewing control for viewing detailed information.

[0096] For example, if the target alert information contains sensitive behaviors related to the file hash of a certain file, then the file hash can be used as the target network resource. Then, the electronic device uses the file hash as an index to check whether the sensitive behaviors related to the file hash are also included in each alert information (referred to as other alert information for short) other than the target alert information, and determines the other alert information containing the file hash as the associated alert information of the target alert information. After that, in the third display area, the electronic device can display an information viewing control, a resource type label of "file hash", and the file name "**********" corresponding to the "file hash" based on the file hash.

[0097] It should be noted that the display of the associated alert information is not limited to the resource type and quantity. For example, for at least two resource types of risk IP addresses, malicious domain names, and file hashes, the summary information of the associated alert information corresponding to multiple resource types can be displayed in the third display area. If a certain resource type corresponds to n (≥2) hit target network resources, then the summary information of n associated alert information of this resource type can be displayed in the third display area.

[0098] In addition, a log search control can be additionally displayed at the corresponding position of the summary information for searching the original log corresponding to the associated alert information (i.e., the associated original log).

[0099] In some embodiments, after displaying the resource type label, resource identifier, and log search control in the associated alert information in the third display area, the method further includes: in response to a trigger operation on the log search control, displaying a log page and displaying the associated original log corresponding to the associated alert information on the log page.

[0100] Specifically, referring to Figure 3 further, relevant personnel can perform a trigger operation on the log search control corresponding to the summary information of any target network resource (such as file hash). In response to this trigger operation, the electronic device can display a log page and display the associated original log covered by the associated alert information on this log page. This can improve the convenience and efficiency of obtaining the associated original log, and thus further improve the efficiency of obtaining information related to alerts.

[0101] In some embodiments, after displaying the resource type label, resource identifier, and log search control in the associated alarm information in the third display area, the method further includes: in response to a trigger operation on the information viewing control, displaying an alarm information distribution map corresponding to each associated alarm information within a preset duration, the total number of associated alarms, the alarm time of the first alarm within the preset duration and the first information entry control, and the alarm time of the last alarm within the preset duration and the second information entry control in the surrounding area of the information viewing control.

[0102] Wherein, the preset duration is a preset time period, for example, it can be 2 hours before the moment of the last triggered alarm. The alarm information distribution map is a two-dimensional coordinate system map including a horizontal axis and a vertical axis. The horizontal axis is in units of a first duration, and the value range is the preset duration. The first duration is a preset statistical unit on the horizontal axis, for example, it can be 1 hour. The vertical axis is in units of a second duration, and the value range is the first duration. The second duration is a preset statistical unit on the vertical axis, for example, it can be 10 minutes. The alarm data points distributed in the alarm data distribution map are represented by preset icons, and the icon attributes of the preset icons are determined based on the number of associated alarms generated within the time range corresponding to the alarm data points. Here, the icon attributes are attributes related to the display style of the preset icons, for example, they can be size, color, shape, transparency, etc. The more the number of alarms, the more prominent the display effect of the preset icon, such as larger size, darker color, more complex shape, lower transparency, etc. The first information entry control is an interactive control for viewing the details of the associated alarm information of the first alarm, for example, it can be an alarm title displayed in the form of a text hyperlink, that is, the alarm title links to the detailed page address of the associated alarm information, or it can be a combination of the alarm title and the information viewing control. The second information entry control is an interactive control for viewing the details of the associated alarm information of the last alarm, and its manifestation form can be the same as that of the first information entry control.

[0103] Specifically, continue to refer to Figure 3 , relevant personnel can perform a trigger operation on the information viewing control corresponding to the brief information of any target network resource (such as file hash). In response to this trigger operation, the electronic device can display the visual distribution of multiple associated alarm information of the target network resource in the surrounding area of the information viewing control (such as the immediately adjacent lower area, or a pop-up window area, or a floating layer area, etc.).

[0104] For example, refer to Figure 12 , the electronic device can display an alarm information distribution map 1210, the total number of associated alarms 1220, the alarm time of the first alarm within the preset duration and the first information entry control 1230, and the alarm time of the last alarm within the preset duration and the second information entry control 1240 in the lower area of the brief information of the triggered target network resource.

[0105] The above warning information distribution diagram 1210 is a two-dimensional coordinate system diagram. Its horizontal axis is in units of 1 hour with a time span of 24 hours, representing the time range of a day; the vertical axis is in units of 10 minutes with a time span of 1 hour, representing the time subdivision within each hour. Each associated warning information related to the target network resource is statistically analyzed based on its occurrence time to determine the associated warning information generated within each 10 minutes of each hour, and according to the number of warnings in the associated warning information, the icon attribute of a preset icon at the corresponding data point is determined. Then, the preset icon is displayed at the corresponding data point according to the icon attribute. Taking the icon size as an example, for one associated warning information, the icon size is the minimum size; for two associated warning information, the icon size is the middle size; for three or more associated warning information, the icon size is the maximum size. According to this process description, the warning information distribution diagram 1210 can be obtained. At the same time, relevant identifiers of the first warning and the last warning can be marked therein.

[0106] By displaying the above visualization distribution situation, the distribution situation of multiple associated warning information aggregated according to the target network resource can be presented with a higher degree of visualization, enabling relevant personnel to more intuitively understand the occurrence frequency of warning intelligence within a preset time period, thereby providing more effective data support for relevant personnel regarding the risk crisis degree, warning handling, and formulation of protection strategies for the target network resource.

[0107] In some embodiments, based on the above warning information distribution diagram, the method further includes: in response to a trigger operation on a warning data point, displaying the warning time and a third information entry control of each associated warning information corresponding to the triggered warning data point in the surrounding area of the triggered warning data point.

[0108] Among them, the third information entry control is an interactive control for viewing the details of another associated warning information, and its manifestation form can be the same as that of the first information entry control.

[0109] Specifically, in order to further improve the convenience of viewing associated warning information, the electronic device can set each data point in the warning information distribution diagram in the form of an interactive control that links to the corresponding associated warning information. In this way, when relevant personnel perform a trigger operation (such as clicking or mouse hovering) on any warning data point, the electronic device can respond to the trigger operation and display the warning time of each associated warning information corresponding to it and the third information entry control 1250 including the warning title in the surrounding area (such as a pop-up window area or a floating layer area, etc.) of the triggered warning data point.

[0110] It should be noted that if there are multiple associated warning information corresponding to the triggered warning data point, then the first associated warning that occurs within this time period can be marked in the above surrounding area (such asFigure 12 Add the "first time" label).

[0111] In some embodiments, based on the above-mentioned display of the warning information distribution map and / or the display of the third information entry control 1250, the method further includes: in response to a trigger operation on a target information entry control, displaying an information details page of the associated warning information corresponding to the target information entry control.

[0112] Wherein, the target information entry control includes a first information entry control, a second information entry control or a third information entry control.

[0113] Specifically, continue to refer to Figure 12 , relevant personnel can perform a trigger operation on the first information entry control, the second information entry control or the third information entry control. The electronic device can respond to the trigger operation and jump to a new information details page similar to Figure 3 as shown, and display the details of the associated warning information corresponding to the triggered target information entry control therein. In this way, the process of viewing the details of the associated warning information can be realized, avoiding the relatively cumbersome information viewing process of exiting the information details page of the target warning information - filtering the associated warning information - viewing the information details page of the associated warning information, simplifying the operation path of information viewing, and thus further improving the viewing convenience and viewing efficiency of the details of the associated warning information.

[0114] The following is an embodiment of the warning information display device provided by the embodiments of the present invention. This device and the warning information display methods of the above embodiments belong to the same inventive concept. For the details not described in detail in the embodiment of the warning information display device, reference can be made to the embodiments of the above warning information display method.

[0115] Figure 13 shows a schematic structural diagram of a warning information display device provided by an embodiment of the present disclosure. As Figure 13 shown, the warning information display device 1300 may include:

[0116] A page display module 1310, configured to display an information details page of target warning information in response to a warning information viewing operation;

[0117] The alarm detail display module 1320 is configured to display alarm overview information, alarm brief information, alarm analysis details, and each analysis dimension identifier in the alarm analysis details presented in a catalog form in the first display area, the second display area, the third display area, and the fourth display area of the information detail page respectively; wherein, the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date, and the last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions.

[0118] The alarm information display device provided by the embodiments of the present disclosure can, in response to an alarm information viewing operation, display an information detail page of the target alarm information; display alarm overview information, alarm brief information, alarm analysis details, and each analysis dimension identifier in the alarm analysis details presented in a catalog form in the first display area, the second display area, the third display area, and the fourth display area of the information detail page respectively; the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date, and the last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions; on the one hand, the information detail page is divided into four display areas to display each part of the content with logical relationships in the target alarm information, optimizing the display layout structure of the alarm information, so that the user can quickly determine the display area of the information they want to know, and through the catalog form, the user can quickly locate the display position of the information they need from the rich alarm analysis details, improving the readability of the alarm information and the information search efficiency; on the other hand, rich alarm analysis details can be displayed through multiple preset analysis dimensions, improving its information content and the analysis depth of the alarm data, so as to provide sufficient data support for relevant personnel to handle alarms; on the other hand, by increasing the information dimension and its value of the alarm overview information, the alarm overview content can be enriched, and the readability of the overview information can be further improved, enabling the user to quickly understand the basic situation of the alarm information as a whole through the alarm overview information, and further improving the efficiency of the user to obtain the information they need.

[0119] In some embodiments, the alarm information display device 1300 further includes an alarm category label editing module, configured to:

[0120] When the alarm overview information includes a label setting control, in response to a triggering operation on the label setting control, display a label editing interface in the peripheral area of the label setting control, and display multiple candidate category labels in the label editing interface;

[0121] In response to a configuration operation on a candidate category label, the configured candidate category label is determined as an alarm category label, and the alarm category label is displayed in the first display area.

[0122] In some embodiments, the alarm details display module 1320 is further configured to:

[0123] A processing status change control is further displayed in the first display area;

[0124] Correspondingly, the alarm information display device 1300 further includes a processing status icon change module for:

[0125] In response to a trigger operation on the processing status change control, a processing status change interface is displayed in the peripheral area of the processing status change control, and a plurality of candidate processing status information is displayed in the processing status change interface;

[0126] In response to a selection operation on the candidate processing status information, the processing status icon is changed based on the selected candidate processing status information.

[0127] In some embodiments, the alarm details display module 1320 is further configured to:

[0128] An alarm handling control is further displayed in the first display area;

[0129] Correspondingly, the alarm information display device 1300 further includes an alarm information handling module for:

[0130] In response to a trigger operation on the alarm handling control, an alarm handling interface is displayed in the peripheral area of the alarm handling control, and a plurality of candidate alarm handling methods are displayed in the alarm handling interface;

[0131] In response to a selection operation on the candidate alarm handling method, the target alarm information is handled based on the selected candidate handling method.

[0132] In some embodiments, the alarm details display module 1320 is specifically configured to:

[0133] In the second display area of the information details page, the alarm summary, the alarm basic information in the alarm profile information, and the target resource identifier corresponding to the target alarm information are sequentially displayed;

[0134] Among them, the alarm summary is obtained by generating a summary of the alarm data; the alarm basic information includes at least one of the network protection isolation policy hit by the target alarm information, the attack type, the risk level identifier, the key alarm identifier, and the alarm identifier editing control.

[0135] In some embodiments, the alarm information display device 1300 further includes at least one of the following modules:

[0136] A resource details viewing module, which is used to sequentially display an alarm summary, alarm basic information, and a target resource identifier corresponding to target alarm information in a second display area of an information details page, and then, in response to a trigger operation on the target resource identifier, display the resource details of the target resource corresponding to the target resource identifier;

[0137] A policy details viewing module, which is used to sequentially display an alarm summary, alarm basic information, and a target resource identifier corresponding to target alarm information in a second display area of an information details page, and then, in response to a trigger operation on a network protection isolation policy, display the policy details of the network protection isolation policy;

[0138] A risk level adjustment module, which is used to sequentially display an alarm summary, alarm basic information, and a target resource identifier corresponding to target alarm information in a second display area of an information details page, and then, in response to a trigger operation on a risk level identifier, display a risk level adjustment interface, and in response to an adjustment operation on the risk level adjustment interface, change the risk level identifier to an adjusted risk level identifier and a level adjustment identifier; wherein, the level adjustment identifier is used to represent the adjustment direction and adjustment step of the risk level;

[0139] An alarm identifier editing module, which is used to sequentially display an alarm summary, alarm basic information, and a target resource identifier corresponding to target alarm information in a second display area of an information details page, and then, in response to a trigger operation on an alarm identifier editing control, display an alarm identifier editing interface, and in response to an editing operation on the alarm identifier editing interface, change a key alarm identifier to an adjusted alarm identifier.

[0140] In some embodiments, the alarm details display module 1320 is further specifically configured to:

[0141] Sequentially display an alarm attack graph in alarm analysis details, an alarm basis corresponding to the alarm attack graph, associated alarm information, target behavior information, target original logs, and alarm handling suggestions in a third display area of the information details page;

[0142] Among them, the alarm attack graph is a visual relationship graph of the attack process and attack results generated by analyzing alarm data from the relationship dimension of network attacks; the alarm basis is the source information of the attack results generated by analyzing alarm data from the causal relationship dimension; the associated alarm information is other alarm information associated with the target alarm information generated by analyzing alarm data from the target network resource dimension; the target behavior information is the behavior-related information generated by analyzing alarm data from the alarm trigger behavior dimension; the target original log is the original log associated with the target alarm information generated by extracting alarm data from the log dimension; the alarm handling suggestion is the structured suggestion information for handling the target alarm information generated by analyzing alarm data from the alarm handling dimension.

[0143] Further, the alarm detail display module 1320 is specifically configured to:

[0144] Generate associated alarm information corresponding to the target network resource based on at least one target network resource hit by the target alarm information;

[0145] In the third display area, display the resource type label and resource identifier in the associated alarm information based on the target network resource, and display the information viewing control and the log search control.

[0146] In some embodiments, the alarm information display device 1300 further includes an alarm distribution information display module for:

[0147] After displaying the resource type label, resource identifier, and log search control in the associated alarm information in the third display area, in response to a trigger operation on the information viewing control, display an alarm information distribution map corresponding to each associated alarm information within a preset duration, the total number of associated alarms, the alarm time of the first alarm within the preset duration and the first information entry control, and the alarm time of the last alarm within the preset duration and the second information entry control in the peripheral area of the information viewing control;

[0148] Among them, the alarm information distribution map is a two-dimensional coordinate system map including a horizontal axis and a vertical axis; the horizontal axis is in units of a first duration, and the value range is the preset duration; the vertical axis is in units of a second duration, and the value range is the first duration; the alarm data points distributed in the alarm data distribution map are represented by preset icons, and the icon attributes of the preset icons are determined based on the number of alarms in the associated alarms generated within the time range corresponding to the alarm data points.

[0149] In some embodiments, the alarm information display device 1300 further includes an alarm data point trigger module for:

[0150] In response to a triggering operation on an alarm data point, display the alarm time and the third information entry control of each associated alarm information corresponding to the triggered alarm data point in the surrounding area of the triggered alarm data point.

[0151] In some embodiments, the alarm information display device 1300 further includes an associated alarm details display module for:

[0152] In response to a triggering operation on a target information entry control, display an information details page of the associated alarm information corresponding to the target information entry control; wherein the target information entry control includes a first information entry control, a second information entry control, or a third information entry control.

[0153] In some embodiments, the alarm information display device 1300 further includes an associated original log display module for:

[0154] After displaying the resource type label, resource identifier, and log search control in the associated alarm information in the third display area, in response to a triggering operation on the log search control, display a log page and display the associated original log corresponding to the associated alarm information in the log page.

[0155] In some embodiments, the alarm attack graph includes an attacker icon, an attacked party icon, an attack direction icon, an attack type, and other information; the other information includes an attack result and / or the number of attacks.

[0156] In some embodiments, the alarm information display device 1300 further includes an alarm attack graph screening module for:

[0157] Before sequentially displaying the alarm attack graph, the alarm basis corresponding to the alarm attack graph, the associated alarm information, the target behavior information, the target original log, and the alarm handling suggestion in the alarm analysis details in the third display area of the information details page, screen the alarm attack graph from multiple candidate attack graphs based on the attacker, the attacked party, and the attack type in the alarm data; wherein the candidate attack graphs include a brute force cracking graph, a first port scanning graph, a second port scanning graph, a reverse shell graph, a web backdoor script disk drop graph, a malicious file disk drop graph, a remote code execution graph, an account hijacking graph, a malicious address access graph, a container escape graph, a process injection graph, a system file tampering graph, a self-starting item modification graph, a fileless execution graph, a hidden file execution graph, a process spoofing graph, a data exfiltration graph, or an encryption hijacking attack graph.

[0158] In some embodiments, the target alarm information includes alarm information generated for network security monitoring of cloud resources.

[0159] The alarm information display device provided by an embodiment of the present invention can execute the alarm information display method provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution of the method.

[0160] It should be noted that in the above embodiments of the alarm information display device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be realized; in addition, the specific names of the functional units are only for the convenience of mutual distinction and are not used to limit the protection scope of the present disclosure.

[0161] An embodiment of the present disclosure further provides an electronic device, which may include a processor and a memory, and the memory may be used to store executable instructions. Among them, the processor may be used to read the executable instructions from the memory and execute the executable instructions to implement the alarm information display method in the above embodiments.

[0162] Figure 14 The structural schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown.

[0163] As Figure 14 shown, the electronic device 1400 may include a processing device 1401 (such as a central processing unit, a graphics processing unit, etc.), which may perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1402 or a program loaded from a storage device 1408 into a random access memory (RAM) 1403. In the RAM 1403, various programs and data required for the operation of the electronic device 1400 are also stored. The processing device 1401, the ROM 1402, and the RAM 1403 are connected to each other through a bus 1404. An input / output interface (I / O interface) 1405 is also connected to the bus 1404.

[0164] Generally, the following devices may be connected to the I / O interface 1405: an input device 1406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1408 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1409. The communication device 1409 may allow the electronic device 1400 to communicate with other devices wirelessly or wiredly to exchange data.

[0165] It should be noted that Figure 14 the electronic device 1400 shown is only an example and should not bring any limitations to the functions and usage scope of the embodiments of the present disclosure. That is, althoughFigure 14 An electronic device 1400 is shown with various devices, but it should be understood that it is not required to implement or have all the shown devices. More or fewer devices may alternatively be implemented or had.

[0166] In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, an embodiment of the present disclosure includes a computer program product that includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes program code for performing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network via the communication device 1409, or installed from the storage device 1408, or installed from the ROM 1402. When the computer program is executed by the processing device 1401, the above functions defined in the network isolation policy management method of any embodiment of the present disclosure are performed.

[0167] An embodiment of the present disclosure also provides a computer-readable storage medium that stores a computer program, and when the computer program is executed by a processor, the processor is caused to implement the network isolation policy management method in any embodiment of the present disclosure.

[0168] It should be noted that the computer-readable medium described above in this disclosure can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of a computer-readable storage medium can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this disclosure, a computer-readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus, or device. And in this disclosure, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium can be transmitted using any appropriate medium, including but not limited to: wires, optical cables, radio frequency (RF), etc., or any suitable combination of the above.

[0169] In some embodiments, the client and the server can communicate using any currently known or future-developed network protocol such as the Hypertext Transfer Protocol (HTTP), and can be interconnected with digital data communication in any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet (e.g., the Internet), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed network.

[0170] The above computer-readable medium can be included in the above electronic device; or it can exist separately without being assembled into the electronic device.

[0171] The above computer-readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to perform the network isolation policy management method described in any embodiment of the present disclosure.

[0172] In embodiments of the present disclosure, computer program code for performing the operations of the present disclosure may be written in one or more programming languages or combinations thereof. The programming languages include, but are not limited to, object-oriented programming languages such as Java, Smalltalk, and C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0173] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of devices, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a portion of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks may occur in a different order than noted in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system that performs the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0174] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, without limitation, the exemplary types of hardware logic components that can be used include: Field Programmable Gate Array (FPGA), Application Specific Integrated Circuit (ASIC), Application Specific Standard Parts (ASSP), System on Chip (SOC), Complex Programmable Logic Device (CPLD), and so on.

[0175] The above description is only a preferred embodiment of the present disclosure and an explanation of the applied technical principles. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above technical features. At the same time, it should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosure concept. For example, the technical solutions formed by mutually replacing the above features with the (but not limited to) technical features with similar functions disclosed in the present disclosure.

[0176] In addition, although the operations are depicted in a particular order, this should not be construed as requiring that the operations be performed in the particular order shown or in sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although a number of specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments can also be implemented combinatorially in a single embodiment. Conversely, the various features described in the context of a single embodiment can also be implemented separately or in any suitable sub-combination in multiple embodiments.

[0177] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. On the contrary, the specific features and acts described above are merely example forms for implementing the claims.

Claims

1. An alarm information display method, characterized in that, Including: In response to an alarm information viewing operation, display an information details page of the target alarm information; In the first display area, second display area, third display area, and fourth display area of the information details page, display alarm overview information, alarm brief information, alarm analysis details, and each analysis dimension identifier in the alarm analysis details presented in a catalog form; wherein, the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date, and the last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions.

2. The method according to claim 1, characterized in that, In the case where the alarm overview information includes the label setting control, the method further includes: In response to a trigger operation on the label setting control, display a label editing interface in the surrounding area of the label setting control, and display multiple candidate category labels in the label editing interface; In response to a configuration operation on the candidate category label, determine the configured candidate category label as the alarm category label, and display the alarm category label in the first display area.

3. The method according to claim 1, wherein A processing status change control is also displayed in the first display area; The method further includes: In response to a trigger operation on the processing status change control, display a processing status change interface in the surrounding area of the processing status change control, and display multiple candidate processing status information in the processing status change interface; In response to a selection operation on the candidate processing status information, change the processing status icon based on the selected candidate processing status information.

4. The method according to claim 1, characterized in that An alarm handling control is also displayed in the first display area; The method further includes: In response to a trigger operation on the alarm handling control, display an alarm handling interface in the surrounding area of the alarm handling control, and display multiple candidate alarm handling methods in the alarm handling interface; In response to a selection operation on the candidate alarm handling method, handle the target alarm information based on the selected candidate handling method.

5. The method according to claim 1, characterized in that The alarm brief information is displayed in the second display area of the information details page, including: In the second display area of the information details page, sequentially display the alarm summary, alarm basic information, and the target resource identifier corresponding to the target alarm information in the alarm brief information; Wherein, the alarm summary is obtained by generating a summary of the alarm data; the alarm basic information includes at least one of the network protection isolation policy hit by the target alarm information, the attack type, the risk level identifier, the key alarm identifier, and the alarm identifier editing control.

6. The method according to claim 5, characterized in that, After sequentially displaying the alarm summary, alarm basic information, and the target resource identifier corresponding to the target alarm information in the second display area of the information details page, the method further includes at least one of the following: In response to a trigger operation on the target resource identifier, display the resource details of the target resource corresponding to the target resource identifier; In response to a trigger operation on the network protection isolation policy, display the policy details of the network protection isolation policy; In response to a triggering operation on the risk level identifier, a risk level adjustment interface is displayed, and in response to an adjustment operation on the risk level adjustment interface, the risk level identifier is changed to the adjusted risk level identifier and a level adjustment identifier; wherein, the level adjustment identifier is used to characterize the adjustment direction and adjustment step of the risk level. In response to a triggering operation on the alarm identifier editing control, an alarm identifier editing interface is displayed, and in response to an editing operation on the alarm identifier editing interface, the key alarm identifier is changed to the adjusted alarm identifier.

7. The method according to claim 1, characterized in that, The alarm analysis details are displayed in the third display area of the information details page, including: In the third display area of the information details page, the alarm attack graph, the alarm basis corresponding to the alarm attack graph, associated alarm information, target behavior information, target original log, and alarm handling suggestions in the alarm analysis details are sequentially displayed. Among them, the alarm attack graph is a visual relationship graph of the attack process and attack result generated by analyzing the alarm data from the relationship dimension of network attacks; the alarm basis is the source information of the attack result generated by analyzing the alarm data from the causal relationship dimension; the associated alarm information is other alarm information associated with the target alarm information generated by analyzing the alarm data from the target network resource dimension; the target behavior information is behavior-related information generated by analyzing the alarm data from the alarm triggering behavior dimension; the target original log is the original log associated with the target alarm information generated by extracting the alarm data from the log dimension; the alarm handling suggestion is structured suggestion information for handling the target alarm information generated by analyzing the alarm data from the alarm handling dimension.

8. The method according to claim 7, wherein The associated alarm information is displayed in the third display area, including: Based on at least one target network resource hit by the target alarm information, the associated alarm information corresponding to the target network resource is generated. In the third display area, the resource type label and resource identifier in the associated alarm information are displayed based on the target network resource, and an information viewing control and a log search control are displayed.

9. The method according to claim 8, wherein After the resource type label, resource identifier, and log search control in the associated alarm information are displayed in the third display area, the method further includes: In response to a triggering operation on the information viewing control, an alarm information distribution map corresponding to each of the associated alarm information within a preset duration, the total number of associated alarms, the alarm time of the first alarm within the preset duration and a first information entry control, and the alarm time of the last alarm within the preset duration and a second information entry control are displayed in the peripheral area of the information viewing control. Among them, the alarm information distribution map is a two-dimensional coordinate system map including a horizontal axis and a vertical axis; the horizontal axis is in units of a first time period, and the value range is the preset time period; the vertical axis is in units of a second time period, and the value range is the first time period; the alarm data points distributed in the alarm data distribution map are represented by preset icons, and the icon attributes of the preset icons are determined based on the number of associated alarms generated within the time range corresponding to the alarm data points.

10. The method according to claim 9, wherein The method further includes: In response to a trigger operation on the alarm data point, display the alarm time and a third information entry control of each of the associated alarm information corresponding to the triggered alarm data point in the surrounding area of the triggered alarm data point.

11. The method according to claim 10, wherein The method further includes: In response to a trigger operation on a target information entry control, display an information details page of the associated alarm information corresponding to the target information entry control; wherein, the target information entry control includes the first information entry control, the second information entry control or the third information entry control.

12. The method according to claim 8, characterized in that After displaying the resource type label, resource identifier and log search control in the associated alarm information in the third display area, the method further includes: In response to a trigger operation on the log search control, display a log page and display the associated original log corresponding to the associated alarm information in the log page.

13. The method according to claim 7, wherein The alarm attack graph includes an attacker icon, a victim icon, an attack direction icon, an attack type and other information; the other information includes the attack result and / or the number of attacks.

14. The method according to claim 13, wherein Before sequentially displaying the alarm attack graph, the alarm basis corresponding to the alarm attack graph, associated alarm information, target behavior information, target original log and alarm handling suggestions in the alarm analysis details in the third display area of the information details page, the method further includes: Based on the attacker, victim and attack type in the alarm data, screen the alarm attack graph from multiple candidate attack graphs; wherein, the candidate attack graphs include brute force cracking graph, first port scanning graph, second port scanning graph, reverse shell graph, web backdoor script disk dropping graph, malicious file disk dropping graph, remote code execution graph, account hijacking graph, malicious address access graph, container escape graph, process injection graph, system file tampering graph, self-start item modification graph, fileless execution graph, hidden file execution graph, process disguise graph, data exfiltration graph or cryptocurrency hijacking attack graph.

15. The method according to claim 1, wherein The target alarm information includes alarm information generated for network security monitoring of cloud resources.

16. An alarm information display device, characterized in that Including: A page display module, configured to display an information details page of target alarm information in response to an alarm information viewing operation; An alarm details display module, configured to respectively display alarm overview information, alarm brief introduction information, alarm analysis details, and each analysis dimension identifier in the alarm analysis details presented in a catalog form in a first display area, a second display area, a third display area, and a fourth display area on the information details page; wherein, the alarm overview information includes at least one of a processing status icon, an alarm category label, a label setting control, the number of alarms, the first alarm date, and the last alarm date; the alarm analysis details are analysis results generated by analyzing alarm data from multiple preset analysis dimensions.

17. An electronic device, characterized in that, Comprising: A processor; A memory for storing executable instructions; Wherein, the processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the alarm information display method according to any one of claims 1-15 above.

18. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which when executed by a processor causes the processor to implement the alarm information display method according to any one of claims 1-15 above.

19. A computer program product, characterized in that, The computer program product is used to implement the alarm information display method according to any one of claims 1-15 above.

Images