A system and method combining intelligent alarm research and judgment with a safe operation system

Abstract

The present invention discloses a system and method combining intelligent alarm analysis and judgment with a security operation system. The system includes an alarm classification device for receiving alarm information and original logs from a security information and event management system and classifying alarms into Class A, Class B, and Class C. A small model analysis and judgment module is used to process Class A alarms and calculate the probability of false alarms through local endogenous intelligence matching and a naive Bayesian algorithm. A large model analysis and judgment module is used to process Class B alarms and generate analysis and judgment results based on extracted alarm vulnerability information and preset question templates. A manual analysis and judgment module is used to process Class C alarms and alarms that cannot be analyzed by the small model or the large model. An alarm storage device is used to store the analysis and judgment results and tag information of all alarms. The present invention reduces the workload of security analysts, improves the average alarm response time, and reduces the number of manually processed alarms without significantly increasing the false alarm rate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a system and method combining intelligent alarm research and judgment with a security operation system. BACKGROUND

[0002] In the network security operation system, daily alarms are an important basis for discovering and handling network security threats. However, with the continuous expansion of network size and the increasing complexity of business, the number of alarms has exploded, resulting in problems such as untimely alarm handling, excessive false positives, and low processing efficiency. These problems not only increase the workload of operation and maintenance personnel, but also may cause real security threats to be ignored, seriously affecting the quality and efficiency of network security operations.

[0003] In recent years, with the emergence of large models (large language models), some security operation platforms have also used intelligent research and judgment solutions based on large models. Since the current research and judgment capabilities of large models are not sufficient to completely replace human analysts, in many research and judgment solutions, large models only play an auxiliary role, and the results of intelligent research and judgment are only used as reference information for human research and judgment, which has limited effect on improving operation quality.

[0004] Therefore, there is a need for a solution that maximizes the role of large models in the security operation system, reduces false positives to the maximum extent without increasing the false negative rate, and reduces the workload of analysts. SUMMARY

[0005] Therefore, the present application provides a system combining intelligent alarm research and judgment with a security operation system, comprising,

[0006] An alarm classification device for receiving alarm information and original logs from a security information and event management system and classifying alarms into A, B, and C categories;

[0007] A small model research and judgment module for processing A-class alarms and calculating false positive probabilities through local endogenous intelligence matching and Naive Bayes algorithm;

[0008] A large model research and judgment module for processing B-class alarms and generating research and judgment results based on extracted alarm vulnerability information and a preset question template;

[0009] A human research and judgment module for processing C-class alarms and alarms that cannot be processed by the small model research and judgment or the large model research and judgment;

[0010] An alarm storage device for storing research and judgment results and marking information of all alarms.

[0011] Further, the alarm classification device classifies alarms as follows:

[0012] The A-class alarm is a logical simple alarm type, including denial of service, weak password, brute force attack, port scanning, intelligence alarm, and alarm that is not good at being judged by a large model;

[0013] The B-class alarm is an alarm type suitable for large model judgment and with an accuracy higher than a preset threshold, including a Web attack alarm;

[0014] The C-class alarm is an important alarm type, including C2, WebShell high-risk alarm, honeypot alarm, illegal software use, and user-defined key business alarm.

[0015] Further, the small model judgment module processing method specifically includes,

[0016] If the alarm matches the local endogenous intelligence successfully, it is directly marked as a true report;

[0017] If there is no match, the false positive probability is calculated based on the Naive Bayes algorithm, and when the false positive probability exceeds a preset threshold H, it is marked as a false report, otherwise it is marked as a true report;

[0018] If the data amount in the alarm storage is insufficient or the false positive probability cannot be calculated, the alarm is marked as being unable to be judged.

[0019] Further, the formula for calculating the false positive probability of the Naive Bayes algorithm is:

[0020] ;

[0021] Among them,

[0022] P(Y|X) is the probability of false positives under the premise that the current alarm has occurred;

[0023] P(Y) is the probability of the current alarm occurring;

[0024] P(X) is the probability of false positives occurring;

[0025] P(X|Y) is the probability of the current alarm occurring among alarms that have been marked as false positives.

[0026] Further, the preset threshold H has a value range of 0.5 to 1.0.

[0027] Further, the large model judgment module processing method specifically includes,

[0028] Extracting vulnerability information of the alarm, the vulnerability information including occurrence time and original log content;

[0029] Combining the vulnerability information into a structured question template to input the large model, and requiring it to output the judgment result in a specified format;

[0030] The large model output is analyzed by keywords to determine whether the alarm is a true alarm or a false alarm.

[0031] Further, the artificial judgment module processing method specifically comprises,

[0032] The C-class alarms and the alarms that cannot be judged are pushed to an analyst workstation for artificial judgment by an analyst;

[0033] The judgment result of the analyst is fed back to the alarm storage for updating the training data of the small model and the large model.

[0034] Further, the data updating rule of the alarm storage is:

[0035] All the judgment results are recorded to the alarm storage; the judgment results include true alarms, false alarms and artificial labels;

[0036] The stored data are used for optimizing the naive Bayes algorithm parameters of the small model and the question templates of the large model.

[0037] On the other hand, the application further provides a method combining intelligent alarm judgment and safe operation system, comprising the following steps:

[0038] The system generates an alarm and delivers it to an alarm classification device;

[0039] The alarm classification device classifies the alarm into A-class, B-class and C-class, which are respectively processed by a small model judgment module, a large model judgment module and an artificial judgment module;

[0040] The judgment results of the modules are pushed to an alarm storage, and the priority of subsequent alarm processing is adjusted based on the results.

[0041] Further, the method further comprises a false alarm rate control mechanism:

[0042] The threshold H in the small model judgment module and the question templates of the large model are adjusted to balance the false alarm rate and the false alarm rate;

[0043] The data of the alarm storage are regularly counted to optimize the shunting strategy and model parameters of the classification device.

[0044] The application has the following beneficial effects:

[0045] The application combines the large model and the small model to judge the alarm, and the alarm is classified into three categories during preprocessing: the alarm suitable for the large model judgment is judged by the large model, the alarm suitable for the small model judgment is judged by the small model, and the alarm unsuitable for automatic judgment is processed by the artificial. Compared with the traditional technology, the workload of the security analyst is reduced, the average alarm response time is improved, and the number of artificial alarm processing is reduced without significantly increasing the false alarm rate. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 System structure diagram of the present application;

[0047] Figure 2 Classification diagram of the alarm of the present application;

[0048] Figure 3 Flow chart of the large model processing alarm of the present application. DETAILED DESCRIPTION

[0049] In order to make the objects, advantages and features of the present application more apparent, the following detailed description further describes the present application.

[0050] The steps and structural components of the present application are shown in Figure 1 :

[0051] 1. SIEM generates an alarm and delivers the alarm information and the corresponding original log to the alarm classification device.

[0052] 2. As shown in Figure 2 , the alarm classification device divides the alarm transmitted by SIEM into three categories:

[0053] Class A alarm, alarm not suitable for large model research and judgment, and other simple logic alarms, such as denial of service, weak password, port detection, intelligence alarm.

[0054] Class B alarm, alarm suitable for large model research and judgment. Before dividing the class B alarm, the large model should be tested to distinguish which class alarm the large model has high research and judgment accuracy rate. The alarm with high accuracy rate is divided into class B alarm, and the alarm with low accuracy rate is divided into class A. For this model, it is good at processing Web attack class alarm, so Web attack belongs to class B.

[0055] Class C alarm, important alarm, once this kind of alarm is accurate, the consequence is very serious. It includes C2, WebShell, honeypot class alarm, because for C2 and WebShell, the test environment and the actual combat environment have large difference, in the actual combat environment, hackers will try to confuse, encrypt communication tears, and try to disguise as traffic, which causes certain difficulty to the detection of large model. In addition, it also includes the alarm customized by the customer according to the business scene, such as using illegal software, access control, availability alarm, etc.

[0056] 3. Small model research and judgment module is used to process class A alarm. First, use local endogenous intelligence to match, if matched, the alarm is regarded as a positive report; if not matched, use naive Bayes model to classify the alarm. According to the naive Bayes formula, the probability that the current alarm is a false alarm is:

[0057] ;

[0058] P(Y|X): Given that the current alarm has occurred, what is the probability that it is a false alarm? This is the probability that this algorithm calculates.

[0059] P(Y): The probability of the current alarm occurring. This value is calculated by taking the name of the current alarm, or the alarm name and victim IP address, and searching the alarm memory. The number of detected entries is used as the numerator. The denominator is the total number of alarms.

[0060] P(X): The probability of a false alarm. Search the alarm memory, the numerator is the number of false alarms, and the denominator is the total number of alarms.

[0061] P(X|Y): The probability of the current alarm appearing among the alarms already marked as false alarms. This value is calculated by taking the name of the current alarm (or the alarm name and victim IP address) as condition one, and marking it as a false alarm as condition two. Conditions one and two are ANDed together. The alarm memory is searched, the number of detected alarms as the numerator, and the number of false alarms as the denominator.

[0062] The threshold H ranges from 0.5 to 1.0, with a recommended value of 0.9 or higher. When P(Y|X) exceeds the threshold H, the alarm is considered a false positive; otherwise, it is considered a true positive. Therefore, a higher value for H reduces the small model's false negative rate and increases the false positive rate.

[0063] Before using the Naive Bayes algorithm, check for two unexpected conditions: the first is when the P(X) value is 0, and the second is when the number of flagged alarms in the alarm memory is too small. In both cases, the amount of data in the alarm memory is insufficient to generate statistical value, so the Bayesian algorithm should not be used. All input alarms should be classified as unreliable.

[0064] 4. If Figure 3 As shown in the figure, the large model analysis module analyzes Class B alarms. It first extracts vulnerability information, including the alarm occurrence time and original log content. This information is then combined into a question template, asking the large model whether the alarm is a false positive and requesting that the model output the information in the format you specify.

[0065] Analyze the content of the large model's response. If the large model outputs according to the format requirements, the output results can be analyzed using keywords to classify the alarm as a true positive or a false positive.

[0066] 5. Class C alarms are directly classified as unable to be analyzed.

[0067] 6、Positive report type alarm, as a high-precision alarm, is pushed to the analyst workstation, and the analyst is required to handle it in priority. The analyst will make a secondary research and judgment on the alarm. If the research and judgment result is still positive report, emergency response is carried out and the positive report is marked and written into the alarm storage. If it is a false alarm, it is marked as a false alarm and written into the alarm storage.

[0068] 7、Unable to judge type alarm, pushed to the analyst workstation, handled by the analyst manually in normal order. The analyst will make a research and judgment on the alarm. If the result is positive report, emergency response is carried out and the positive report is marked and written into the alarm storage. If it is a false alarm, it is marked as a false alarm and written into the alarm storage.

[0069] 8、False alarm type alarm, marked as a false alarm and written into the alarm storage.

[0070] The above embodiments have described the technical solutions of the present application in detail. Apparently, the present application is not limited to the described embodiments. Based on the embodiments in the present application, those skilled in the art can make various changes, but any change equivalent or similar to the present application belongs to the protection scope of the present application.

[0071] The contents not described in detail in the specification belong to the prior art known to those skilled in the art.

Claims

1. A system combining intelligent alarm analysis and judgment with a security operation system, characterized by: include, An alarm classification device is used to receive alarm information and original logs from the security information and event management system and classify the alarms into Class A, Class B and Class C; A small model analysis module is used to process the Class A alarm and calculate the false alarm probability through local endogenous intelligence matching and naive Bayes algorithm; A large model analysis module is used to process the Class B alarm and generate an analysis result based on the extracted alarm vulnerability information and a preset question template; A manual analysis module is used to process the Class C alarms and alarms that cannot be analyzed by the small model or the large model; Alarm memory, used to store all alarm analysis results and marking information; The alarm classification device classifies the alarms as follows: Class A alarms are logically simple alarm types, including denial of service, weak passwords, brute force attacks, port scans, intelligence alarms, and alarms that large models are not good at analyzing. Class B alarms are suitable for large-scale model analysis and have a large-scale model test accuracy higher than the preset threshold, including Web attack alarms. Class C alerts are important alert types, including C2, WebShell high-risk alerts, honeypot alerts, illegal software usage, and user-defined critical business alerts.

2. The system combining intelligent alarm analysis and judgment with a security operation system according to claim 1, characterized in that: The small model analysis module processing method specifically includes: If the alarm successfully matches the local endogenous intelligence, it will be directly marked as a positive alarm; If there is no match, the false alarm probability is calculated based on the Naive Bayes algorithm. When the false alarm probability exceeds the preset threshold H, it is marked as a false alarm, otherwise it is marked as a positive alarm; If the amount of data in the alarm memory is insufficient or the false alarm probability cannot be calculated, the alarm will be marked as unreliable.

3. The system combining intelligent alarm analysis and judgment with a security operation system as claimed in claim 2, characterized in that: The formula for calculating the false alarm probability using the Naive Bayes algorithm is: ； in, P(Y|X) is the probability of a false alarm given that the current alarm has occurred; P(Y) is the probability of the current alarm occurring; P(X) is the probability of a false alarm; P(X|Y) is the probability of the current alarm occurring among the alarms that have been marked as false alarms.

4. The system combining intelligent alarm analysis and judgment with a security operation system as claimed in claim 3, characterized in that: The preset threshold H ranges from 0.5 to 1.

0.

5. The system combining intelligent alarm analysis and judgment with a security operation system as claimed in claim 4, characterized in that: The large model analysis module processing method specifically includes: Extracting vulnerability information from the alert, including the occurrence time and original log content; Combine vulnerability information into a structured question template and input it into the large model, requiring it to output the analysis and judgment results in the specified format; Analyze the output of the large model through keywords to determine whether the alarm is a true alarm or a false alarm.

6. The system combining intelligent alarm analysis and judgment with a security operation system as claimed in claim 5, characterized in that: The manual analysis module processing method specifically includes: Push Class C alarms and alarms that cannot be analyzed to the analyst workstation; The analyst's analysis results are fed back to the alarm storage and used to update the training data of the small model and the large model.

7. The system combining intelligent alarm analysis and judgment with a security operation system as claimed in claim 6, characterized in that: The data update rule of the alarm memory is: All analysis and judgment results are recorded in the alarm memory; the analysis and judgment results include true alarms, false alarms, and manual markings; The stored data is used to optimize the Naive Bayes algorithm parameters of the small model and the question template of the large model.

8. A method combining intelligent alarm analysis and judgment with a security operation system, characterized in that: The following steps are involved: The system generates alarms and transmits them to the alarm classification device; The alarm classification device classifies the alarms into Class A, Class B, and Class C, which are respectively processed by the small model analysis module, the large model analysis module, and the manual analysis module; The analysis and judgment results of each module are pushed to the alarm storage, and the priority of subsequent alarm processing is adjusted based on the results; The alarm classification device classifies the alarms as follows: Class A alarms are logically simple alarm types, including denial of service, weak passwords, brute force attacks, port scans, intelligence alarms, and alarms that large models are not good at analyzing. Class B alarms are suitable for large-scale model analysis and have a large-scale model test accuracy higher than the preset threshold, including Web attack alarms. Class C alerts are important alert types, including C2, WebShell high-risk alerts, honeypot alerts, illegal software usage, and user-defined critical business alerts.

9. The method of combining intelligent alarm analysis and judgment with a security operation system according to claim 8, characterized in that: The method also includes a false alarm rate control mechanism: By adjusting the threshold H in the small model judgment module and the question template of the large model, the missed alarm rate and false alarm rate are balanced; Regularly collect statistics on the data in the alarm storage and optimize the diversion strategy and model parameters of the classification device.

Images