Alarm work order processing system, method, device, equipment and medium

Abstract

The invention discloses an alarm work order processing system, method, device and equipment and a medium. The system comprises a security sensing module, a security operation work order module and target large-screen equipment, the security sensing module generates alarm information at regular time through a first timing component, and stores each piece of alarm information and an action mark of each piece of alarm information into a first index table; the security sensing module sends each piece of to-be-pushed alarm information to the security operation work order module at regular time through a second timing component; and the safety perception module determines work order key information of the safety operation work order module at regular time according to the collected work order content and flow circulation information through a third timing component, generates a corresponding display page and sends the display page to the target large-screen equipment for display. According to the embodiment of the invention, repeated alarm information and alarm information which does not need to be allocated to technicians for processing can be filtered out, and each alarm work order can be tracked and recorded.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an alarm work order processing system, method, device, equipment and medium. Background Art

[0002] Attacks targeting enterprise business systems are increasing. During these attacks, anomalies may occur in the network, hardware, or software modules used by the business system. Enterprises typically have security devices installed. These devices can detect anomalies in the network, hardware, or software modules used by the business system. Upon detecting an anomaly, they generate anomaly logs describing the anomaly. During the operation of the business system, alarms are generated based on the anomaly logs to prompt the handling of the anomaly. Alarm tickets are then assigned to technical personnel for processing based on the alarm information. Each alarm message can contain text indicating the handling of an anomaly. Each alarm ticket can also be an alarm message that needs to be assigned to technical personnel for processing.

[0003] In the related art, the commonly used alarm work order processing solution is: for each exception log data that needs to be processed for the described exception, an alarm message corresponding to the exception log data is generated based on the key fields in the exception log data. Each generated alarm message is determined as an alarm work order, and each alarm work order is provided to a technician for processing. The generated alarm information will include duplicate alarm information and alarm information that does not need to be assigned to a technician for processing. The alarm work order processing solution in the related art cannot filter out duplicate alarm information and alarm information that does not need to be assigned to a technician for processing before determining the alarm work order, and cannot track and record each determined alarm work order to ensure that each alarm work order is processed in a timely and effective manner, resulting in low processing efficiency. Summary of the Invention

[0004] The present invention provides an alarm work order processing system, method, device, equipment and medium to solve the problems in related technologies that the alarm work order processing scheme cannot filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order, cannot track and record each determined alarm work order, and ensure that each alarm work order is processed in a timely and effective manner, resulting in low processing efficiency.

[0005] According to one aspect of the present invention, there is provided an alarm work order processing system, comprising: a security perception module, a security operation work order module, and a target large-screen device;

[0006] Among them, the security perception module is used to periodically generate alarm information corresponding to each key abnormal log data within the target time length through a first timing component, detect whether each alarm information is an alarm information to be pushed to the security operation work order module, set an action mark for each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in a first index table; through a second timing component, regularly filter out the pushed alarm information in the first index table according to the action mark in the first index table and the historical pushed alarm information in the second index table, determine each alarm information to be pushed in the first index table, and send each alarm information to be pushed to the security operation work order module; collect the work order content and process flow information of each alarm work order in the security operation work order module, and through a third timing component, regularly determine the work order key information of the security operation work order module according to the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information;

[0007] The security operation work order module is used to determine each received alarm information as an alarm work order, determine the target processing personnel that matches the alarm work order, assign the alarm work order to the matched target processing personnel, and record the analysis and processing information and process flow information of the alarm work order;

[0008] The target large-screen device is used to display the received presentation page.

[0009] According to another aspect of the present invention, a method for processing an alarm work order is provided, which is applied to the security perception module of the alarm work order processing system according to an embodiment of the present invention, comprising:

[0010] Generate alarm information corresponding to each key abnormal log data within the target time period through the first timing component, detect whether each alarm information is an alarm information to be pushed to the security operation work order module, set an action tag for each alarm information according to the detection result, and store each alarm information and the action tag of each alarm information in the first index table;

[0011] Through the second timing component, according to the action mark in the first index table and the historical pushed alarm information in the second index table, the pushed alarm information in the first index table is filtered out, each alarm information to be pushed in the first index table is determined, and each alarm information to be pushed is sent to the security operation work order module;

[0012] Collect the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, determine the work order key information of the security operation work order module based on the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information.

[0013] According to another aspect of the present invention, there is provided an alarm work order processing device, which is configured in the security perception module of the alarm work order processing system according to an embodiment of the present invention, and includes:

[0014] an alarm information generating unit, configured to periodically generate, through a first timing component, alarm information corresponding to each key abnormality log data within a target time period, detect whether each alarm information is an alarm information to be pushed to a security operation work order module, set an action flag for each alarm information according to the detection result, and store each alarm information and the action flag of each alarm information in a first index table;

[0015] An alarm information pushing unit is configured to, through a second timing component, regularly push alarm information according to the action mark in the first index table and the historical push alarm information in the second index table, filter out the pushed alarm information in the first index table, determine each alarm information to be pushed in the first index table, and send each alarm information to be pushed to the security operation work order module;

[0016] The alarm work order monitoring unit is used to collect the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, regularly determine the work order key information of the security operation work order module based on the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information.

[0017] According to another aspect of the present invention, an electronic device is provided, comprising:

[0018] at least one processor;

[0019] and a memory communicatively coupled to the at least one processor;

[0020] The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm work order processing method described in any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm work order processing method described in any embodiment of the present invention when executed.

[0022] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the alarm work order processing method according to any embodiment of the present invention is implemented.

[0023] In the technical solution of the embodiment of the present invention, the security perception module uses a first timing component to regularly generate alarm information corresponding to each key abnormal log data within the target time length, detects whether each alarm information is an alarm information to be pushed to the security operation work order module, sets an action mark for each alarm information according to the detection result, and stores each alarm information and the action mark of each alarm information in the first index table; the security perception module uses a second timing component to regularly push alarm information according to the action mark in the first index table and the history in the second index table, filters out the pushed alarm information in the first index table, determines each alarm information to be pushed in the first index table, and sends each alarm information to be pushed to the security operation work order module, so that the security The full operation work order module identifies each alarm information received as an alarm work order, determines the target processing personnel that matches the alarm work order, assigns the alarm work order to the matched target processing personnel, and records the analysis and processing information and process flow information of the alarm work order; the security perception module collects the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, regularly determines the work order key information of the security operation work order module based on the collected work order content and process flow information, generates a display page corresponding to the work order key information, and sends the display page to the target large-screen device; among them, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information, which solves the related The alarm work order processing solution in the technology cannot filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order, and cannot track and record each determined alarm work order to ensure that each alarm work order is processed in a timely and effective manner. To solve the problem of low processing efficiency, alarm information can be pushed based on action tags and history to filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing, and alarm information that has not been sent repeatedly and needs to be assigned to technical personnel for processing can be sent to the security operation work order module, so as to filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order. This can be done by collecting each alarm work order. The work order content and process flow information are collected regularly through the third timing component to determine the key work order information that can be used to characterize the processing progress of each alarm work order in each link, and each determined alarm work order is tracked and recorded. By visually displaying the key work order information that can be used to characterize the processing progress of each alarm work order in each link, the processing progress of each alarm work order in each link is provided to the technical staff in an intuitive and dynamic manner, helping the technical staff to determine the processing progress of each alarm work order in each link, and promptly processing the alarm work order with timeout phenomenon, so as to ensure that each alarm work order is processed in a timely and effective manner, and improve the processing efficiency and transparency of the processing process.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 A structural diagram of an alarm work order processing system provided in Example 1 of the present invention.

[0027] Figure 2 A schematic diagram of an alarm work order processing process provided in Example 1 of the present invention.

[0028] Figure 3 A schematic diagram of an operation flow executed by a first timing component and a second timing component provided in embodiment 1 of the present invention.

[0029] Figure 4 A schematic diagram of an operation flow executed by a third timing component provided in embodiment 1 of the present invention.

[0030] Figure 5 A schematic diagram of a display page provided in Example 1 of the present invention.

[0031] Figure 6 This is a flowchart of a method for processing an alarm work order provided in Example 2 of the present invention.

[0032] Figure 7 This is a structural diagram of an alarm work order processing device provided in Example 3 of the present invention.

[0033] Figure 8 A schematic diagram of the structure of an electronic device for implementing the alarm work order processing method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "target", "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprise", "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] Example 1

[0037] Figure 1 This is a structural diagram of an alarm work order processing system provided by the first embodiment of the present invention. This embodiment is applicable to the situation where an alarm work order is determined based on alarm information and each determined alarm work order is provided to a technician for processing. Figure 1 As shown, the alarm work order processing system may specifically include: a security perception module 101, a security operation work order module 102 and a target large-screen device 103, and its structure and function are described below.

[0038] Among them, the security perception module 101 is used to periodically generate alarm information corresponding to each key abnormal log data within the target time length through the first timing component, detect whether each alarm information is the alarm information to be pushed to the security operation work order module 102, set the action mark of each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in the first index table; through the second timing component, regularly push alarm information according to the action mark in the first index table and the history in the second index table, filter out the pushed alarm information in the first index table, and determine each alarm information in the first index table. Alarm information to be pushed is sent to the security operation work order module 102; the work order content and process flow information of each alarm work order in the security operation work order module 102 are collected, and the timeout evaluation information of each alarm work order and the work order key information of the security operation work order module 102 are determined according to the collected work order content and process flow information through the third timing component, a display page corresponding to the work order key information is generated, and the display page is sent to the target large-screen device 103; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information.

[0039] The security operation work order module 102 is used to determine each received alarm information as an alarm work order, determine the target processing personnel matching the alarm work order, assign the alarm work order to the matched target processing personnel, and record the analysis and processing information and process flow information of the alarm work order.

[0040] The target large-screen device 103 is used to display the received presentation page.

[0041] Optionally, the business system of an enterprise may be a server set up in the enterprise for processing the business of the enterprise. Business may refer to the process of producing products and providing products to users. Security devices and log source devices are set up in the enterprise. The security device may be an electronic device used to detect whether there are any abnormalities in the network used by the business system, the various hardware modules and the various software modules in the business system, and after detecting that there are any abnormalities in the network used by the business system, the hardware modules or the software modules in the business system, generate abnormality log data describing the abnormality that has occurred. Each abnormality log data may be a text describing an abnormality that has occurred in the network used by the business system, the various hardware modules and the various software modules in the business system. The log source device may be an electronic device used to collect the abnormality log data generated in the security device and send the collected abnormality log data to the security perception module 101.

[0042] For example, an exception may occur when the network traffic used by the business system exceeds a preset traffic threshold. The preset traffic threshold may be a pre-set traffic threshold. After detecting that the network traffic used by the business system exceeds the preset traffic threshold, the security device generates exception log data describing the network traffic exceeding the preset traffic threshold. Another exception may occur when an external device attempts to access a specified hardware module in the business system without authorization. After detecting that an external device attempts to access a specified hardware module in the business system without authorization, the security device generates exception log data describing the external device's unauthorized attempt to access the specified hardware module in the business system. The external device may refer to an electronic device other than the various electronic devices installed in the enterprise. The specified hardware module may be a host in the business system. Another exception may occur when an external device attempts to access a specified software module in the business system without authorization. After detecting that an external device attempts to access a specified software module in the business system without authorization, the security device generates exception log data describing the external device's unauthorized attempt to access the specified software module in the business system. The specified software module may be an application in the business system.

[0043] Optionally, the security awareness module 101 can be a device configured within an enterprise to generate alerts based on the abnormality log data of the enterprise's business systems, prompting the user to handle abnormalities. The generated alerts are sent to the security operations work order module 102, which then determines an alert work order based on the received alerts and assigns the identified alert work order to an electronic device provided for technical personnel to handle. The abnormality log data of an enterprise's business systems refers to the abnormality log data sent by a log source device within the enterprise to the security awareness module 101. Each alert message can be a text message prompting a technical personnel to handle an abnormality. Each alert work order can be an alert message that needs to be assigned to a technical personnel for handling. The security operations work order module 102 can be a device configured within the enterprise to determine an alert work order based on the received alerts and assign the identified alert work order to an electronic device provided for technical personnel to handle. The target large-screen device 103 can be a large-screen device configured to display information related to the handling process of the alert work order determined by the security operations work order module 102. The security perception module 101 is connected to the security operation work order module 102 and the target large-screen device 103 respectively, and can exchange information with the security operation work order module 102 and the target large-screen device 103.

[0044] Optionally, the first timing component may be a component provided in the security perception module 101 for periodically generating alarm information based on the received abnormal log data and storing the alarm information. The target duration may be a pre-set duration. Exemplarily, the target duration is 5 minutes, 10 minutes or 30 minutes. Key abnormal log data may refer to abnormal log data for which the described abnormality needs to be processed. The abnormality that needs to be processed may mean that the abnormality needs to be manually processed by a technician, or it may mean that the abnormality needs to be automatically processed by a business system. Each key abnormal log data within the target duration may refer to each key abnormal log data among the abnormal log data received by the security perception module 101 within the target duration before the current moment.

[0045] Optionally, the alarm information corresponding to the key exception log data may refer to the alarm information generated based on the key exception log data. The alarm information to be pushed to the security operation work order module 102 may refer to the alarm information generated by the key exception log data that requires manual processing by technical personnel based on the described exception, that is, the alarm information that needs to be assigned to technical personnel for processing. The alarm information that does not need to be pushed to the security operation work order module 102 may refer to the alarm information generated by the key exception log data that requires automatic processing by the business system based on the described exception, that is, the alarm information that does not need to be assigned to technical personnel for processing.

[0046] Optionally, the action mark of the alarm information may be information used to characterize whether the alarm information is alarm information to be pushed to the security operation work order module 102 or alarm information that does not need to be pushed to the security operation work order module 102. The action mark of the alarm information is the first mark information or the second mark information. The first mark information may be a string used to characterize that the alarm information is alarm information to be pushed to the security operation work order module 102. The second mark information may be a string used to characterize that the alarm information is alarm information that does not need to be pushed to the security operation work order module 102. If the action mark of the alarm information is the first mark information, it indicates that the alarm information is alarm information to be pushed to the security operation work order module 102. If the action mark of the alarm information is the second mark information, it indicates that the alarm information is alarm information that does not need to be pushed to the security operation work order module 102. Exemplarily, the first mark information is "push_soc". The first index table may be a data table set in the security perception module 101 for storing each generated alarm information and the action mark of each alarm information.

[0047] Optionally, through the first timing component, alarm information corresponding to each key abnormal log data within the target time length is generated periodically, and it is detected whether each alarm information is an alarm information to be pushed to the security operation work order module 102, and the action mark of each alarm information is set according to the detection result, and each alarm information and the action mark of each alarm information are stored in the first index table, including: the following operations are performed periodically through the first timing component: each key abnormal log data in the abnormal log data received within the target time length is filtered out, and alarm information corresponding to each key abnormal log data is generated; whether each alarm information is an alarm information to be pushed to the security operation work order module 102; for each alarm information to be pushed to the security operation work order module 102, the action mark of the alarm information is determined to be the first mark information; for each alarm information that does not need to be pushed to the security operation work order module 102, the action mark of the alarm information is determined to be the second mark information; each alarm information and the action mark of each alarm information is stored in the first index table.

[0048] Optionally, the first timing component can execute an operation to generate alarm information corresponding to each key abnormal log data within the target time period once every target time period, detect whether each alarm information is the alarm information to be pushed to the security operation work order module 102, set the action mark of each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in the first index table. Generate alarm information corresponding to each key abnormal log data within the target time length, detect whether each alarm information is an alarm information to be pushed to the security operation work order module 102, set the action mark of each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in the first index table, including: filtering out each key abnormal log data in the abnormal log data received within the target time length, and generating alarm information corresponding to each key abnormal log data; detecting whether each alarm information is an alarm information to be pushed to the security operation work order module 102; for each alarm information to be pushed to the security operation work order module 102, determine the action mark of the alarm information as the first mark information; for each alarm information that does not need to be pushed to the security operation work order module 102, determine the action mark of the alarm information as the second mark information; store each alarm information and the action mark of each alarm information in the first index table.

[0049] Optionally, the abnormal log data received within the target duration may refer to each abnormal log data received by the security perception module 101 within the target duration before the current moment. Filtering out each key abnormal log data from the abnormal log data received within the target duration includes: filtering out each key abnormal log data from each abnormal log data according to the log type of each abnormal log data received within the target duration.

[0050] Optionally, the log type of the exception log data may refer to the log type contained in the exception log data. The log type may be text used to characterize the type of exception described by the exception log data. The log types that may be contained in the exception log data include, but are not limited to, traffic anomalies, port anomalies, hardware access anomalies, software access anomalies, hardware permission anomalies, software permission anomalies, hardware data anomalies, and software data anomalies. For anomalies related to the traffic of the network used by the business system, such as the traffic volume of the network used by the business system exceeding a preset traffic threshold or the traffic volume of the network used by the business system being zero, the log type contained in the exception log data used to describe the anomaly is typically traffic anomaly. For anomalies related to ports of the network used by the business system, the log type contained in the exception log data used to describe the anomaly is typically port anomaly. For anomalies related to the access process of a hardware module in the business system, the log type contained in the exception log data used to describe the anomaly is typically hardware access anomaly. For anomalies related to the access process of a software module in the business system, the log type contained in the exception log data used to describe the anomaly is typically software access anomaly. For detected anomalies related to the permissions of hardware modules in the business system, the log type included in the exception log data used to describe the anomaly is usually a hardware permission anomaly. For detected anomalies related to the permissions of software modules in the business system, the log type included in the exception log data used to describe the anomaly is usually a software permission anomaly. For detected anomalies related to the data in the hardware modules in the business system, the log type included in the exception log data used to describe the anomaly is usually a hardware data anomaly. For detected anomalies related to the data in the software modules in the business system, the log type included in the exception log data used to describe the anomaly is usually a software data anomaly.

[0051] Optionally, a first log type set is stored in the security perception module 101. The first log type set is composed of multiple log types. Each log type in the first log type set is a log type that will be included in the abnormal log data for the described abnormality that needs to be processed. For any abnormal log data, if there is a log type in the first log type set that is the same as the log type included in the abnormal log data, it can be determined that the abnormal log data is the abnormal log data for the described abnormality that needs to be processed, that is, it is determined that the abnormal log data is the key abnormal log data. If there is no log type in the first log type set that is the same as the log type included in the abnormal log data, it can be determined that the abnormal log data is not the abnormal log data for the described abnormality that needs to be processed, that is, it is determined that the abnormal log data is not the key abnormal log data.

[0052] Optionally, based on the log type of each abnormal log data received within the target duration, each key abnormal log data in each abnormal log data is screened out, including: performing the following operation for each abnormal log data received within the target duration: detecting whether a log type identical to the log type contained in the abnormal log data exists in a first log type set; if a log type identical to the log type contained in the abnormal log data exists in the first log type set, determining that the abnormal log data is key abnormal log data; if a log type identical to the log type contained in the abnormal log data does not exist in the first log type set, determining that the abnormal log data is not key abnormal log data. Thus, based on the log type of each abnormal log data received within the target duration, each key abnormal log data in each abnormal log data is screened out.

[0053] Optionally, the alarm information corresponding to the key exception log data may refer to the alarm information generated based on the key exception log data. Key fields in the exception log data may refer to the event summary information, alarm source information, and log type contained in the exception log data. The event summary information may be text summarizing the process of detecting the exception. The alarm source information may be identification information of the log source device that sent the exception log data. The identification information of the log source device may be a string used to identify the log source device. The log type may be text that characterizes the type of exception described in the exception log data. The alarm information corresponding to the key exception log data may be text generated based on the key exception log data to prompt for handling the exception described in the key exception log data. The alarm content of the alarm information may refer to multiple texts extracted from the key exception log data that constitute the alarm information. Key fields in the exception log data are multiple texts that can be used to constitute the alarm information. The key fields in the exception log data may be extracted and the extracted key fields in the exception log data may be determined as the alarm content of the alarm information corresponding to the key exception log data, thereby obtaining the alarm information corresponding to the key exception log data. The alarm information corresponding to the key exception log data is composed of key fields in the extracted exception log data, and can be used to prompt processing of the exception described by the key exception log data.

[0054] Optionally, generating alarm information corresponding to each key exception log data includes: determining the alarm content of the alarm information corresponding to each key exception log data based on the key fields in each key exception log data, thereby obtaining the alarm information corresponding to each key exception log data. For each key exception log data, extracting the key fields in the exception log data, determining the key fields in the extracted exception log data as the alarm content of the alarm information corresponding to the key exception log data, thereby obtaining the alarm information corresponding to the key exception log data. The alarm information corresponding to the key exception log data is composed of the key fields in the extracted exception log data, and can be used to prompt the handling of the exception described by the key exception log data.

[0055] Optionally, a second log type set is stored in the security perception module 101. The second log type set consists of multiple log types. Each log type in the second log type set is a log type that will be included in the alarm information to be pushed to the security operation work order module 102. For any alarm information, if there is a log type in the second log type set that is the same as the log type included in the alarm information, it can be determined that the alarm information is the alarm information to be pushed to the security operation work order module 102. If there is no log type in the second log type set that is the same as the log type included in the alarm information, it can be determined that the alarm information is not the alarm information to be pushed to the security operation work order module 102, and the alarm information is the alarm information that does not need to be pushed to the security operation work order module 102.

[0056] Optionally, detecting whether each alarm message is an alarm message to be pushed to the security operation work order module 102 includes: performing the following operations for each alarm message: detecting whether there is a log type identical to the log type contained in the alarm message in the second log type set; if there is a log type identical to the log type contained in the alarm message in the second log type set, determining that the alarm message is an alarm message to be pushed to the security operation work order module 102; if there is no log type identical to the log type contained in the alarm message in the second log type set, determining that the alarm message is an alarm message that does not need to be pushed to the security operation work order module 102.

[0057] Optionally, for each alarm message determined to be pushed to the security operation work order module 102, an action tag of the alarm message is determined to be the first tag information. For each alarm message determined not to be pushed to the security operation work order module 102, an action tag of the alarm message is determined to be the second tag information. Each alarm message and its action tag are then stored in the first index table.

[0058] Optionally, the second timing component may be a component provided in the security perception module 101 for periodically sending each to-be-pushed alarm information in the first index table to the security operation work order module 102. The pushed alarm information may refer to the alarm information to be pushed to the security operation work order module 102 that has been sent to the security operation work order module 102 during the alarm information sending process already completed by the second timing component. The to-be-pushed alarm information may refer to the alarm information to be pushed to the security operation work order module 102 that has not been sent to the security operation work order module 102 during the alarm information sending process already completed by the second timing component. The second index table may be a data table provided in the security perception module 101 for storing historical pushed alarm information. The historical pushed alarm information may refer to the alarm information that has been sent to the security operation work order module 102 during the alarm information sending process already completed by the second timing component.

[0059] Optionally, through the second timing component, the pushed alarm information in the first index table is filtered out according to the action mark in the first index table and the historical pushed alarm information in the second index table, and each alarm information to be pushed in the first index table is determined, and each alarm information to be pushed is sent to the security operation work order module 102, including: the second timing component is used to perform the following operations regularly: detect whether each alarm information in the first index table is included in the historical pushed alarm information in the second index table, determine the alarm information included in the historical pushed alarm information in the second index table as the pushed alarm information, and delete the pushed alarm information; mark each action in each remaining alarm information in the first index table as the alarm information of the first marking information as the alarm information to be pushed, and send each alarm information to be pushed to the security operation work order module 102.

[0060] Optionally, the second timing component may perform an operation every first time interval, filtering out the already pushed alarm information in the first index table based on the action tags in the first index table and the historical pushed alarm information in the second index table, determining each alarm information to be pushed in the first index table, and sending each alarm information to be pushed to the security operation work order module 102. The operation of filtering out the already pushed alarm information in the first index table based on the action tags in the first index table and the historical pushed alarm information in the second index table, determining each alarm information to be pushed in the first index table, and sending each alarm information to be pushed to the security operation work order module 102 includes: detecting whether each alarm information in the first index table is included in the historical pushed alarm information in the second index table, determining the alarm information included in the historical pushed alarm information in the second index table as already pushed alarm information, and deleting the already pushed alarm information; determining each alarm information in the remaining alarm information in the first index table with the action marked as the first marking information as an alarm information to be pushed, and sending each alarm information to be pushed to the security operation work order module 102. The first time interval may be a preset time interval. Exemplarily, the first duration is 10 minutes, 30 minutes or 1 hour.

[0061] Optionally, detect whether each alarm information in the first index table is included in the historical pushed alarm information in the second index table, determine the alarm information included in the historical pushed alarm information in the second index table as the pushed alarm information, and delete the pushed alarm information, including: performing the following operations for each alarm information in the first index table: detect whether there is alarm information identical to the alarm information in the historical pushed alarm information in the second index table; if there is alarm information identical to the alarm information in the historical pushed alarm information in the second index table, determine that the alarm information is included in the historical pushed alarm information in the second index table, determine the alarm information as the pushed alarm information, and delete the alarm information; if there is no alarm information identical to the alarm information in the historical pushed alarm information in the second index table, determine that the alarm information is not included in the historical pushed alarm information in the second index table, and retain the alarm information.

[0062] Optionally, each action in each of the remaining alarm information in the first index table is marked as an alarm information of the first marking information, that is, an alarm information to be pushed to the security operation work order module 102 that has not been sent to the security operation work order module 102 during the alarm information sending process that has been completed by the second timing component. Each action in each of the remaining alarm information in the first index table is marked as an alarm information to be pushed. A preset script can be used to read each alarm information to be pushed in the first index table and send each alarm information to be pushed to the security operation work order module 102. The preset script can be a script that, after running, is used to retrieve each alarm information to be pushed in the first index table, send each alarm information to be pushed to the security operation work order module 102, and store a copy of each alarm information to be pushed in the second index table. The copy of the alarm information to be pushed can refer to a copied alarm information to be pushed. The security perception module 101 stores a preset script. A preset script may be run to retrieve each alert information to be pushed from the first index table, send each alert information to be pushed to the security operation work order module 102, and store a copy of each alert information to be pushed in the second index table.

[0063] Optionally, after receiving each alarm message, the security operation work order module 102 will determine the alarm message as an alarm work order, determine the target processing personnel that matches the alarm work order, assign the alarm work order to the matched target processing personnel, and record the analysis and processing information and process flow information of the alarm work order.

[0064] Optionally, determining a target handler matching the alarm work order and assigning the alarm work order to the matched target handler includes: sending the alarm work order to a terminal device of an analysis and judgment personnel; upon receiving the alarm work order number, the work order level of the alarm work order, and the personnel ID of the target handler matching the alarm work order from the analysis and judgment personnel via the terminal device; determining a target handler matching the alarm work order based on the personnel ID of the target handler matching the alarm work order, and sending the alarm work order to the terminal device of the target handler matching the alarm work order. The alarm work order number of the alarm work order can be a string used to identify the alarm work order. The work order level of the alarm work order can be a string used to represent the importance of the alarm work order. The target handler matching the alarm work order is the personnel ID of a technician who can handle the alarm work order. The analysis and judgment personnel can be a technician in the enterprise who is used to determine the alarm work order number, the work order level of the alarm work order, and the personnel ID of the target handler matching the alarm work order. The technician's personnel ID can be a string used to identify the technician. After receiving the alarm work order, the researcher can analyze the alarm work order to determine the alarm work order number, the work order level of the alarm work order, and the personnel ID of the target processing personnel that matches the alarm work order. The researcher can then feedback the alarm work order number, the work order level of the alarm work order, and the personnel ID of the target processing personnel that matches the alarm work order to the security operation work order module 102 via the terminal device. The security operation work order module 102 can determine the target processing personnel that matches the alarm work order based on the personnel ID of the target processing personnel that matches the alarm work order, and send the alarm work order to the terminal device of the target processing personnel that matches the alarm work order.

[0065] Optionally, the analysis and processing information of the alarm work order may refer to the alarm work order number, the work order level of the alarm work order, and the personnel identification of the target processing personnel matching the alarm work order, of the alarm work order fed back by the analysis personnel through the terminal device.

[0066] Optionally, the process flow information may include: the start time and end time of the new status, the personnel ID of the new status, the start time and end time of the assigned status, the personnel ID of the assigned status, the start time and end time of the processing status, the personnel ID of the processing status, the start time and end time of the tracking optimization status, the personnel ID of the tracking optimization status, the start time and end time of the pending confirmation status, the personnel ID of the pending confirmation status, the start time of the closed status, and the personnel ID of the closed status.

[0067] Optionally, the "New" state may refer to a state in which the alarm work order has been determined but has not yet been assigned to the matched target handler. The start time of the "New" state may refer to the time when the security operations work order module 102 determines the alarm work order. The end time of the "New" state may refer to the time when the security operations work order module 102 assigns the alarm work order to the matched target handler, that is, the time when the security operations work order module 102 sends the alarm work order to the terminal device of the matched target handler. The personnel ID of the "New" state may be the personnel ID of the analysis and judgment personnel.

[0068] Optionally, the assigned state may refer to a state in which the target processing personnel has not started processing the alarm work order after the alarm work order is assigned to the matched target processing personnel. The start time of the assigned state may refer to the time when the security operation work order module 102 assigns the alarm work order to the matched target processing personnel, that is, the time when the security operation work order module 102 sends the alarm work order to the terminal device of the target processing personnel matching the alarm work order. The end time of the assigned state may refer to the start processing time of the alarm work order sent to the security operation work order module 102 by the target processing personnel matching the alarm work order. The start processing time of the alarm work order may be the time when the target processing personnel records the start of processing the alarm work order. The personnel ID of the assigned state may be the personnel ID of the target processing personnel matching the alarm work order.

[0069] Optionally, the "in-processing" state may refer to a state in which the target processing personnel has started processing the alarm work order but has not yet completed the processing. The start time of the "in-processing" state may refer to the start time of processing the alarm work order sent to the security operation work order module 102 by the target processing personnel matching the alarm work order. The end time of the "in-processing" state may refer to the end time of processing the alarm work order sent to the security operation work order module 102 by the target processing personnel matching the alarm work order. The end time of processing the alarm work order may refer to the time when the target processing personnel recorded the completion of the processing process of the alarm work order. The personnel ID of the "in-processing" state may be the personnel ID of the target processing personnel matching the alarm work order.

[0070] Optionally, the tracking optimization state may refer to a state in which the target processing personnel is processing an alarm work order and the processing time of the alarm work order exceeds a preset time threshold, and the alarm work order needs to be transferred to a technical management personnel to continue processing the alarm work order, and the processing process of the alarm work order needs to be continuously monitored and optimized. The technical management personnel may be a technical personnel in the enterprise who is responsible for processing alarm work orders that take a long time. An alarm work order that takes a long time may refer to an alarm work order in which the target processing personnel matching the alarm work order is processing the alarm work order and the processing time of the alarm work order exceeds a preset time threshold. The preset time threshold may be a pre-set time threshold. The start time of the tracking optimization state may refer to the start time of the tracking optimization of the alarm work order sent by the technical management personnel to the security operation work order module 102. The start time of the tracking optimization of the alarm work order may refer to the time when the technical management personnel starts processing the alarm work order. The end time of the tracking optimization state may refer to the end time of the tracking optimization of the alarm work order sent by the technical management personnel to the security operation work order module 102. The tracking optimization end time of the alarm work order may refer to the time when the technical management personnel completes the processing of the alarm work order. The personnel ID of the tracking optimization status may be the personnel ID of the technical management personnel.

[0071] Optionally, the pending confirmation status may refer to a status where the processing of the alarm work order is completed and the security manager needs to review and confirm whether the processing of the alarm work order has been successfully completed. The security manager may be a technical person in the enterprise who is responsible for reviewing and confirming whether the processing of the alarm work order has been successfully completed. The start time of the pending confirmation status may be the end processing time of the alarm work order sent to the security operation work order module 102 by the target processing personnel matching the alarm work order or the end time of the tracking optimization of the alarm work order sent to the security operation work order module 102 by the technical manager. The end time of the pending confirmation status may refer to the confirmation end time of the alarm work order sent to the security operation work order module 102 by the security manager. The confirmation end time of the alarm work order may refer to the time recorded by the security manager to complete the review and confirmation process of whether the processing of the alarm work order has been successfully completed. The personnel identifier of the pending confirmation status may be the personnel identifier of the security manager.

[0072] Optionally, the closed state may refer to a state where the processing of the alarm work order has been successfully completed after review and confirmation. The start time of the closed state may be the confirmation end time of the alarm work order sent by the security manager to the security operation work order module 102. The person ID of the closed state may be the person ID of the security manager.

[0073] Optionally, the process flow information may also include: the start time and end time of the emergency handling status, and the personnel identification of the emergency handling status. The emergency handling status may refer to a state in which the researcher and judge cannot determine the alarm ticket number, the work order level of the alarm ticket, and the personnel identification of the target processing personnel that matches the alarm ticket, and needs to wait for the new researcher and judge to determine and feedback the alarm ticket number, the work order level of the alarm ticket, and the personnel identification of the target processing personnel that matches the alarm ticket. The start time of the emergency handling status may be the emergency handling start time of the alarm ticket sent by the researcher and judge to the security operation work order module 102. The emergency handling start time of the alarm ticket may refer to the time recorded by the researcher and judge to forward the alarm ticket to the new researcher and judge for further processing. The end time of the emergency handling status may be the emergency handling end time of the alarm ticket sent by the new researcher and judge to the security operation work order module 102. The emergency handling end time of an alarm work order can refer to the time when the new assessment personnel records the alarm work order number, the work order level, and the personnel ID of the target handling personnel matching the alarm work order. The personnel ID of the emergency handling status can be the personnel ID of the new assessment personnel.

[0074] Optionally, the security perception module 101 may perform an operation of collecting the work order content and process flow information of each alarm work order in the security operation work order module 102 every second time period. The second time period may be a pre-set time period. Exemplarily, the second time period is 1 hour, 3 hours, 6 hours, 12 hours or 24 hours. Collecting the work order content and process flow information of each alarm work order in the security operation work order module 102 may refer to obtaining the work order content and process flow information of each alarm work order stored in the security operation work order module 102. The work order content of the alarm work order may refer to the work order creation time of the alarm work order, the alarm work order number of the alarm work order, the event brief information in the alarm work order, the work order level of the alarm work order, and the alarm source information in the alarm work order.

[0075] Optionally, the third timing component may be a component provided in the security perception module 101 for periodically determining the timeout evaluation information of each alarm work order and the key work order information of the security operation work order module 102 based on the collected work order content and process flow information, generating a display page corresponding to the key work order information, and sending the display page to the target large-screen device 103 for display. The key work order information of the security operation work order module 102 includes work order processing status information, alarm distribution information, and processing timeliness information.

[0076] Optionally, through the third timing component, the key work order information of the security operation work order module 102 is determined based on the collected work order content and process flow information, a display page corresponding to the work order key information is generated, and the display page is sent to the target large-screen device, including: the following operations are performed regularly through the third timing component: based on the latest collected work order content and process flow information, the work order processing status information, alarm distribution information and processing timeliness information of the security operation work order module 102 are determined; the work order processing status information, the alarm distribution information and the processing timeliness information are added to the display page template to obtain a display page corresponding to the work order processing status information, the alarm distribution information and the processing timeliness information, and the display page is sent to the target large-screen device 103.

[0077] Optionally, the third timing component can execute once every third time period to determine the timeout evaluation information of each alarm work order and the key work order information of the security operation work order module 102 based on the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device 103. The third time period can be a preset time period. Exemplarily, the third time period is 1 hour, 3 hours, 6 hours, 12 hours, or 24 hours. According to the collected work order content and process flow information, the timeout evaluation information of each alarm work order and the work order key information of the security operation work order module 102 are determined, a display page corresponding to the work order key information is generated, and the display page is sent to the target large-screen device 103. The operation includes: according to the latest collected work order content and process flow information, the work order processing status information, alarm distribution information and processing timeliness information of the security operation work order module 102 are determined; the work order processing status information, the alarm distribution information and the processing timeliness information are added to the display page template to obtain a display page corresponding to the work order processing status information, the alarm distribution information and the processing timeliness information, and the display page is sent to the target large-screen device 103.

[0078] Optionally, the work order processing status information may refer to the work order content, handling information, and timeout evaluation information of each alarm work order. The handling information of the alarm work order includes the current status of the alarm work order, the time consumed in the current status, and the current handling personnel information. The current status of the alarm work order may refer to the status of the alarm work order at the current moment. The current status of the alarm work order is the newly created status, the assigned status, the processing status, the tracking optimization status, the pending confirmation status, or the closed status. The time consumed in the current status of the alarm work order may refer to the duration of the status of the alarm work order at the current moment. The current handling personnel information of the alarm work order may refer to the personnel identification of the status of the alarm work order at the current moment. The timeout evaluation information of the alarm work order may be information used to characterize whether the alarm work order is taking a long time. The timeout evaluation information of the alarm work order is timed out or not timed out. The timeout evaluation information of the alarm work order is timed out, indicating that the alarm work order is taking a long time. The timeout evaluation information of the alarm work order is not timed out, indicating that the alarm work order does not take a long time.

[0079] Optionally, the alarm distribution information may include the number of work orders, the on-time completion rate of assessment, the on-time completion rate of emergency disposal, and the on-time completion rate of tracking optimization. The number of work orders may refer to the total number of alarm work orders in the security operation work order module 102. The on-time completion rate of assessment may refer to the ratio between the total number of alarm work orders whose duration of the newly created state in each alarm work order is less than the fourth time length and the number of work orders. The on-time completion rate of emergency disposal may refer to the ratio between the total number of alarm work orders whose duration of the emergency disposal state in each alarm work order is less than the fifth time length and the total number of alarm work orders whose start and end times of the emergency disposal state in each alarm work order are not empty. The on-time completion rate of tracking optimization may refer to the ratio between the total number of alarm work orders whose duration of the tracking optimization state in each alarm work order is less than the sixth time length and the total number of alarm work orders whose start and end times of the tracking optimization state in each alarm work order are not empty. The fourth time length, the fifth time length, and the sixth time length may be three pre-set time lengths.

[0080] Optionally, the processing timeliness information includes: a pie chart or trend chart for displaying the changing trend between the number of work orders counted this time and the number of work orders counted in previously completed statistical processes, a pie chart or trend chart for displaying the changing trend between the on-time completion rate of emergency disposal counted this time and the on-time completion rate of emergency disposal counted in previously completed statistical processes, and a pie chart or trend chart for displaying the changing trend between the on-time completion rate of tracking optimization counted this time and the on-time completion rate of tracking optimization counted in previously completed statistical processes.

[0081] Optionally, the latest collected work order content and process flow information refers to the work order content and process flow information of each alarm work order stored in the security operation work order module 102 that is most recently acquired by the security perception module 101 .

[0082] Optionally, the work order processing status information of the security operation work order module 102 is determined based on the latest collected work order content and process flow information, including: determining the handling information and timeout evaluation information of each alarm work order based on the latest collected process flow information of each alarm work order; and determining the work order content, handling information and timeout evaluation information of each alarm work order as the work order processing status information of the security operation work order module 102.

[0083] Optionally, based on the most recent collected process flow information of each alarm work order, determine the handling information and timeout evaluation information of each alarm work order, including: performing the following operations for the most recent collected process flow information of each alarm work order: extracting the start time and end time of the new state, the personnel ID of the new state, the start time and end time of the assigned state, the personnel ID of the assigned state, the start time and end time of the processing state, the personnel ID of the processing state, the start time and end time of the tracking optimization state, the personnel ID of the tracking optimization state, the start time and end time of the pending confirmation state, the personnel ID of the pending confirmation state, the start time of the closed state, and the personnel ID of the closed state in the process flow information; if the extracted start time of the new state is not empty, and the extracted end time of the new state, the start time and end time of the assigned state, the start time and end time of the processing state, the start time and end time of the tracking optimization state, If the start time and end time of the pending confirmation state and the start time of the closed state are both empty, then the current state of the alarm work order to which the process flow information belongs is determined to be the new state, and the difference between the current moment and the extracted start time of the new state is calculated. The difference between the current moment and the extracted start time of the new state is determined as the current state time consumption of the alarm work order to which the process flow information belongs, and the personnel ID of the extracted new state is determined as the current handling personnel information of the alarm work order to which the process flow information belongs; determine whether the difference between the current moment and the extracted start time of the new state is greater than the preset time threshold; if the difference between the current moment and the extracted start time of the new state is greater than the preset time threshold, then the timeout evaluation information of the alarm work order to which the process flow information belongs is determined to be timed out; if the difference between the current moment and the extracted start time of the new state is less than or equal to the preset time threshold, then the timeout evaluation information of the alarm work order to which the process flow information belongs is determined to be not timed out.

[0084] Optionally, if the extracted start time of the assigned state is not empty, and the extracted end time of the assigned state, the start time and end time of the processing state, the start time and end time of the tracking optimization state, the start time and end time of the pending confirmation state, and the start time of the closed state are all empty, then the current state of the alarm work order to which the process flow information belongs is determined to be the assigned state, and the difference between the current moment and the extracted start time of the assigned state is calculated. The difference between the current moment and the extracted start time of the assigned state is determined as the current state time consumption of the alarm work order to which the process flow information belongs, and the extracted The personnel identification is determined as the current handling personnel information of the alarm work order to which the process flow information belongs; the difference between the current moment and the start time of the extracted new state is calculated, and it is determined whether the difference between the current moment and the start time of the extracted new state is greater than the preset time threshold; if the difference between the current moment and the start time of the extracted new state is greater than the preset time threshold, the timeout evaluation information of the alarm work order to which the process flow information belongs is determined to be timed out; if the difference between the current moment and the start time of the extracted new state is less than or equal to the preset time threshold, the timeout evaluation information of the alarm work order to which the process flow information belongs is determined to be not timed out.

[0085] Optionally, if the start time of the extracted in-process state is not empty, and the end time of the extracted in-process state, the start time and end time of the tracking optimization state, the start time and end time of the pending confirmation state, and the start time of the closed state are all empty, then the current state of the alarm work order to which the process flow information belongs is determined to be the in-process state, and the difference between the current moment and the start time of the extracted in-process state is calculated, and the difference between the current moment and the start time of the extracted in-process state is determined as the current state time consumption of the alarm work order to which the process flow information belongs, and the personnel ID of the extracted in-process state is determined as the flow The current handling personnel information of the alarm work order to which the process flow information belongs; calculate the difference between the current moment and the start time of the extracted new state, and determine whether the difference between the current moment and the start time of the extracted new state is greater than the preset time threshold; if the difference between the current moment and the start time of the extracted new state is greater than the preset time threshold, then determine that the timeout evaluation information of the alarm work order to which the process flow information belongs is timed out; if the difference between the current moment and the start time of the extracted new state is less than or equal to the preset time threshold, then determine that the timeout evaluation information of the alarm work order to which the process flow information belongs is not timed out.

[0086] Optionally, if the start time of the extracted tracking optimization state is not empty, and the end time of the extracted tracking optimization state, the start time and end time of the pending confirmation state, and the start time of the closed state are all empty, then the current state of the alarm work order to which the process flow information belongs is determined to be the tracking optimization state, and the difference between the current moment and the start time of the extracted processing state is calculated. The difference between the current moment and the start time of the extracted tracking optimization state is determined as the current state time consumption of the alarm work order to which the process flow information belongs, and the personnel ID of the extracted tracking optimization state is determined as the personnel ID of the process flow information. The current handling personnel information of the alarm work order to which the process flow information belongs; calculate the difference between the current moment and the start time of the extracted new state, and determine whether the difference between the current moment and the start time of the extracted new state is greater than the preset time threshold; if the difference between the current moment and the start time of the extracted new state is greater than the preset time threshold, then determine that the timeout evaluation information of the alarm work order to which the process flow information belongs is timed out; if the difference between the current moment and the start time of the extracted new state is less than or equal to the preset time threshold, then determine that the timeout evaluation information of the alarm work order to which the process flow information belongs is not timed out.

[0087] Optionally, if the start time of the extracted pending confirmation state is not empty, and the end time of the extracted pending confirmation state and the start time of the closed state are both empty, then the current state of the alarm work order to which the process flow information belongs is determined to be the pending confirmation state, and the difference between the current moment and the start time of the extracted pending confirmation state is calculated. The difference between the current moment and the start time of the extracted pending confirmation state is determined as the current state time consumption of the alarm work order to which the process flow information belongs, and the personnel ID of the extracted pending confirmation state is determined as the current state time consumption of the alarm work order to which the process flow information belongs. Set personnel information; calculate the difference between the current moment and the extracted start time of the new state, and determine whether the difference between the current moment and the extracted start time of the new state is greater than the preset time threshold; if the difference between the current moment and the extracted start time of the new state is greater than the preset time threshold, then determine that the timeout evaluation information of the alarm work order to which the process flow information belongs is timed out; if the difference between the current moment and the extracted start time of the new state is less than or equal to the preset time threshold, then determine that the timeout evaluation information of the alarm work order to which the process flow information belongs is not timed out.

[0088] Optionally, if the extracted start time of the closed state is not empty, the current state of the alarm work order to which the process flow information belongs is determined to be the closed state, the difference between the current moment and the extracted start time of the closed state is calculated, the difference between the current moment and the extracted start time of the closed state is determined as the current state time consumption of the alarm work order to which the process flow information belongs, and the personnel identification of the closed state is determined as the current handling personnel information of the alarm work order to which the process flow information belongs; the difference between the extracted start time of the closed state and the extracted start time of the new state is calculated. The difference between the start time of the extracted closed state and the start time of the extracted new state is determined to be greater than the preset time threshold; if the difference between the start time of the extracted closed state and the start time of the extracted new state is greater than the preset time threshold, the timeout evaluation information of the alarm work order to which the process flow information belongs is determined to be timed out; if the difference between the start time of the extracted closed state and the start time of the extracted new state is less than or equal to the preset time threshold, the timeout evaluation information of the alarm work order to which the process flow information belongs is determined to be not timed out.

[0089] Optionally, based on the latest collected work order content and process flow information, determine the alarm distribution information of the security operation work order module 102, including: counting the total number of the latest collected process flow information to obtain the number of work orders; counting the total number of process flow information whose start time and end time of the newly created state contained in the latest collected process flow information is not empty and the difference between the end time of the newly created state and the start time of the newly created state is less than the fourth time period, and obtaining the total number of alarm work orders whose duration of the newly created state in each alarm work order is less than the fourth time period; counting the total number of emergency response states contained in the latest collected process flow information The total number of process flow information whose start time and end time are not empty, and the total number of alarm work orders whose start time and end time of emergency disposal status in each alarm work order are not empty; count the total number of process flow information whose start time and end time of emergency disposal status contained in the latest collected process flow information are not empty and the difference between the end time of emergency disposal status and the start time of emergency disposal status is less than the fifth time period, and the total number of alarm work orders whose duration of emergency disposal status in each alarm work order is less than the fifth time period; count the start time and end time of tracking optimization status contained in the latest collected process flow information Count the total number of process flow information whose start time and end time are not empty, and obtain the total number of alarm work orders whose start time and end time of the tracking optimization state in each alarm work order are not empty; count the total number of process flow information whose start time and end time of the tracking optimization state contained in the latest collected process flow information are not empty and the difference between the end time of the tracking optimization state and the start time of the tracking optimization state is less than the sixth time length, and obtain the total number of alarm work orders whose duration of the tracking optimization state in each alarm work order is less than the sixth time length; calculate the duration of the new state in each alarm work order is less than the fourth time length The ratio between the total number of alarm work orders and the number of work orders is used to obtain the on-time completion rate of the assessment; the ratio between the total number of alarm work orders in which the duration of the emergency disposal status in each alarm work order is less than the fifth duration and the total number of alarm work orders in which the start time and end time of the emergency disposal status in each alarm work order are not empty is calculated to obtain the on-time completion rate of the emergency disposal; the ratio between the total number of alarm work orders in which the duration of the tracking optimization status in each alarm work order is less than the sixth duration and the total number of alarm work orders in which the start time and end time of the tracking optimization status in each alarm work order are not empty is calculated to obtain the on-time completion rate of the tracking optimization.

[0090] Optionally, based on the latest collected work order content and process flow information, the processing timeliness information of the security operation work order module 102 is determined, including: processing the number of work orders counted this time and the number of work orders counted in each previously completed statistical process according to the first chart generation rule, and obtaining a pie chart or trend chart for showing the changing trend between the number of work orders counted this time and the number of work orders counted in each previously completed statistical process; processing the emergency response on-time completion rate counted this time and the emergency response on-time completion rate counted in each previously completed statistical process according to the second chart generation rule, and obtaining a pie chart or trend chart for showing the changing trend between the emergency response on-time completion rate counted this time and the emergency response on-time completion rate counted in each previously completed statistical process; processing the tracking optimization on-time completion rate counted this time and the tracking optimization on-time completion rate counted in each previously completed statistical process according to the third chart generation rule, and obtaining a pie chart or trend chart for showing the changing trend between the tracking optimization on-time completion rate counted this time and the tracking optimization on-time completion rate counted in each previously completed statistical process. The first chart generation rule may be a pre-set rule for processing the number of work orders counted this time and the number of work orders counted in previously completed statistical processes to generate a pie chart or trend chart that shows the changing trend between the number of work orders counted this time and the number of work orders counted in previously completed statistical processes. The second chart generation rule may be a pre-set rule for processing the emergency response on-time completion rate counted this time and the emergency response on-time completion rate counted in previously completed statistical processes to generate a pie chart or trend chart that shows the changing trend between the emergency response on-time completion rate counted this time and the emergency response on-time completion rate counted in previously completed statistical processes. The third chart generation rule may be a pre-set rule for processing the tracking optimization on-time completion rate counted this time and the tracking optimization on-time completion rate counted in previously completed statistical processes to generate a pie chart or trend chart that shows the changing trend between the tracking optimization on-time completion rate counted this time and the tracking optimization on-time completion rate counted in previously completed statistical processes.

[0091] Optionally, the display page corresponding to the work order processing status information, alarm distribution information, and processing timeliness information may be a page for displaying the work order processing status information, alarm distribution information, and processing timeliness information. The security perception module 101 stores a display page template. The display page template may be a display page that does not contain the work order processing status information, alarm distribution information, and processing timeliness information. The display page template includes a location for adding work order processing status information, a location for adding alarm distribution information, and a location for adding processing timeliness information. The location for adding work order processing status information may be a page area for adding work order processing status information. The location for adding alarm distribution information may be a page area for adding alarm distribution information. The location for adding processing timeliness information may be a page area for adding processing timeliness information. The display page corresponding to the work order processing status information, alarm distribution information and processing timeliness information that need to be displayed can be obtained by adding the work order processing status information that needs to be displayed to the work order processing status information adding position in the display page template, adding the alarm distribution information that needs to be displayed to the alarm distribution information adding position in the display page template, and adding the processing timeliness information that needs to be displayed to the processing timeliness information adding position in the display page template.

[0092] Optionally, the display page template can be copied, and the work order processing status information is added to the work order processing status information adding position in the copied display page template, the alarm distribution information is added to the alarm distribution information adding position in the copied display page template, and the processing timeliness information is added to the processing timeliness information adding position in the copied display page template, to obtain a display page corresponding to the work order processing status information, the alarm distribution information, and the processing timeliness information, and then send the display page to the target large-screen device 103. After receiving the display page, the target large-screen device 103 displays the display page, thereby visually displaying the work order processing status information, alarm distribution information, and processing timeliness information that can be used to characterize the processing progress of each alarm work order in each link.

[0093] In the technical solution of the embodiment of the present invention, the security perception module uses a first timing component to regularly generate alarm information corresponding to each key abnormal log data within the target time length, detects whether each alarm information is an alarm information to be pushed to the security operation work order module, sets an action mark for each alarm information according to the detection result, and stores each alarm information and the action mark of each alarm information in the first index table; the security perception module uses a second timing component to regularly push alarm information according to the action mark in the first index table and the history in the second index table, filters out the pushed alarm information in the first index table, determines each alarm information to be pushed in the first index table, and sends each alarm information to be pushed to the security operation work order module, so that the security The full operation work order module identifies each alarm information received as an alarm work order, determines the target processing personnel that matches the alarm work order, assigns the alarm work order to the matched target processing personnel, and records the analysis and processing information and process flow information of the alarm work order; the security perception module collects the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, regularly determines the work order key information of the security operation work order module based on the collected work order content and process flow information, generates a display page corresponding to the work order key information, and sends the display page to the target large-screen device; among them, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information, which solves the related The alarm work order processing solution in the technology cannot filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order, and cannot track and record each determined alarm work order to ensure that each alarm work order is processed in a timely and effective manner. To solve the problem of low processing efficiency, alarm information can be pushed based on action tags and history to filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing, and alarm information that has not been sent repeatedly and needs to be assigned to technical personnel for processing can be sent to the security operation work order module, so as to filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order. This can be done by collecting each alarm work order. The work order content and process flow information are collected regularly through the third timing component to determine the key work order information that can be used to characterize the processing progress of each alarm work order in each link, and each determined alarm work order is tracked and recorded. By visually displaying the key work order information that can be used to characterize the processing progress of each alarm work order in each link, the processing progress of each alarm work order in each link is provided to the technical staff in an intuitive and dynamic manner, helping the technical staff to determine the processing progress of each alarm work order in each link, and promptly processing the alarm work order with timeout phenomenon, so as to ensure that each alarm work order is processed in a timely and effective manner, and improve the processing efficiency and transparency of the processing process.

[0094] In an optional implementation of the embodiment of the present invention, optionally, Figure 2 A schematic diagram of an alarm work order processing process provided in Example 1 of the present invention. A security device detects whether an anomaly occurs in the network used by the business system, or in each hardware module and software module within the business system. Upon detecting an anomaly in the network used by the business system, or in each hardware module or software module within the business system, the security device generates anomaly log data describing the anomaly. A log source device collects the anomaly log data generated by the security device and sends the collected anomaly log data to the security perception module. The security perception module, through a first timing component, periodically generates alarm information corresponding to each key anomaly log data within a target time period, detects whether each alarm information is an alarm information to be pushed to the security operation work order module, sets an action tag for each alarm information based on the detection result, and stores each alarm information and its action tag in a first index table. The security perception module, through a second timing component, periodically filters out the already pushed alarm information in the first index table based on the action tags in the first index table and the historically pushed alarm information in the second index table, determines each alarm information to be pushed in the first index table, and sends each alarm information to be pushed to the security operation work order module. The security operations work order module identifies each received alarm as an alarm work order, determines the target processing personnel that match the alarm work order, assigns the alarm work order to the matched target processing personnel, and records the analysis, processing, and process flow information of the alarm work order. The security perception module collects the work order content and process flow information of each alarm work order in the security operations work order module. Through the third timing component, it regularly determines the timeout evaluation information of each alarm work order and the work order key information of the security operations work order module based on the collected work order content and process flow information, generates a display page corresponding to the work order key information, and sends the display page to the target large-screen device for display. This intuitively and dynamically provides technical personnel with the processing progress of each alarm work order at each stage, helping technical personnel to determine the processing progress of each alarm work order at each stage and promptly manually handle alarm work orders with timeouts, thereby ensuring that each alarm work order is handled promptly and effectively, achieving a manual closed loop in the alarm work order processing process, and improving processing efficiency and transparency.

[0095] In an optional implementation of the embodiment of the present invention, optionally, Figure 3A schematic diagram of the operation process performed by a first timing component and a second timing component provided in the first embodiment of the present invention. The following operations are performed regularly by the first timing component: according to the log type of each abnormal log data received within the target time length, each key abnormal log data in each abnormal log data is screened out; according to the key field in each key abnormal log data, the alarm content of the alarm information corresponding to each key abnormal log data is determined, and the alarm information corresponding to each key abnormal log data is obtained; each alarm information is detected to see whether it is an alarm information to be pushed to the security operation work order module; for each alarm information to be pushed to the security operation work order module, the action mark of the alarm information is determined to be the first mark information; for each alarm information that does not need to be pushed to the security operation work order module, the action mark of the alarm information is determined to be the second mark information; each alarm information and the action mark of each alarm information are stored in the first index table. The second timing component periodically performs the following operations: detecting whether each alarm message in the first index table is included in the historically pushed alarm messages in the second index table, determining the alarm messages included in the historically pushed alarm messages in the second index table as already pushed alarm messages, and deleting the already pushed alarm messages; determining each alarm message with an action marked as first marking information among the remaining alarm messages in the first index table as pending alarm messages, and sending each pending alarm message to the security operation work order module via a preset script. Thus, the second timing component periodically performs the operations of alarm message detection, alarm message filtering, and alarm message sending.

[0096] In an optional implementation of the embodiment of the present invention, optionally, Figure 4 A schematic diagram of the operation process performed by a third timing component provided in Example 1 of the present invention. The following operations are performed regularly by the third timing component: based on the work order content and process flow information of each alarm work order in the latest collected security operation work order module, the work order processing status information, alarm distribution information and processing timeliness information of the security operation work order module are determined; the work order processing status information, the alarm distribution information and the processing timeliness information are added to the display page template, and a display page corresponding to the work order processing status information, the alarm distribution information and the processing timeliness information is obtained, and the display page is sent to the target large-screen device for display.

[0097] In an optional implementation of the embodiment of the present invention, optionally, Figure 5 This is a schematic diagram of a display page provided in Example 1 of the present invention. The display page includes work order processing status information, alarm distribution information, and processing timeliness information.

[0098] Example 2

[0099] Figure 6 This is a flow chart of a method for processing an alarm work order provided by the second embodiment of the present invention. This method can be executed by the security perception module in the alarm work order processing system provided by the above embodiment of the present invention. Figure 6 As shown, the method of this embodiment specifically includes

[0100] Step 201: Through the first timing component, alarm information corresponding to each key abnormal log data within the target time length is generated periodically, and each alarm information is detected to see whether it is the alarm information to be pushed to the security operation work order module. The action mark of each alarm information is set according to the detection result, and each alarm information and the action mark of each alarm information are stored in the first index table.

[0101] Optionally, through the first timing component, alarm information corresponding to each key abnormal log data within the target time length is generated periodically, and it is detected whether each alarm information is an alarm information to be pushed to the security operation work order module, and the action mark of each alarm information is set according to the detection result, and each alarm information and the action mark of each alarm information are stored in the first index table, including: the following operations are performed periodically through the first timing component: each key abnormal log data in the abnormal log data received within the target time length is filtered out, and alarm information corresponding to each key abnormal log data is generated; whether each alarm information is an alarm information to be pushed to the security operation work order module; for each alarm information to be pushed to the security operation work order module, the action mark of the alarm information is determined to be the first mark information; for each alarm information that does not need to be pushed to the security operation work order module, the action mark of the alarm information is determined to be the second mark information; and each alarm information and the action mark of each alarm information are stored in the first index table.

[0102] Optionally, filtering out each key abnormal log data in the abnormal log data received within the target time period includes: filtering out each key abnormal log data in each abnormal log data according to the log type of each abnormal log data received within the target time period.

[0103] Optionally, generating alarm information corresponding to each key abnormality log data includes: determining the alarm content of the alarm information corresponding to each key abnormality log data according to the key fields in each key abnormality log data, and obtaining the alarm information corresponding to each key abnormality log data.

[0104] Step 202: Through the second timing component, based on the action mark in the first index table and the historical pushed alarm information in the second index table, filter out the pushed alarm information in the first index table, determine the various alarm information to be pushed in the first index table, and send the various alarm information to be pushed to the security operation work order module.

[0105] Optionally, through a second timing component, the pushed alarm information in the first index table is filtered out according to the action mark in the first index table and the historical pushed alarm information in the second index table, and each alarm information to be pushed in the first index table is determined, and each alarm information to be pushed is sent to the security operation work order module, including: performing the following operations regularly through the second timing component: detecting whether each alarm information in the first index table is included in the historical pushed alarm information in the second index table, determining the alarm information included in the historical pushed alarm information in the second index table as the pushed alarm information, and deleting the pushed alarm information; determining the alarm information with each action marked as the first marking information in each remaining alarm information in the first index table as the alarm information to be pushed, and sending each alarm information to be pushed to the security operation work order module.

[0106] Step 203: Collect the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, determine the work order key information of the security operation work order module based on the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device.

[0107] The key work order information includes work order processing status information, alarm distribution information, and processing timeliness information.

[0108] Optionally, through a third timing component, the key work order information of the security operation work order module is determined based on the collected work order content and process flow information, a display page corresponding to the key work order information is generated, and the display page is sent to the target large-screen device, including: regularly performing the following operations through the third timing component: determining the work order processing status information, alarm distribution information and processing timeliness information of the security operation work order module based on the latest collected work order content and process flow information; adding the work order processing status information, the alarm distribution information and the processing timeliness information to the display page template, obtaining a display page corresponding to the work order processing status information, the alarm distribution information and the processing timeliness information, and sending the display page to the target large-screen device.

[0109] The technical solution of the embodiment of the present invention is to regularly generate alarm information corresponding to each key abnormal log data within the target time length, detect whether each alarm information is the alarm information to be pushed to the security operation work order module, set the action mark of each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in the first index table; regularly push alarm information according to the action mark in the first index table and the historical push alarm information in the second index table, filter out the pushed alarm information in the first index table, determine each alarm information to be pushed in the first index table, and send each alarm information to be pushed to the security operation work order module, so that the security operation work order module will receive each alarm information The information is determined as an alarm work order, the target processing personnel matching the alarm work order are determined, the alarm work order is assigned to the matched target processing personnel, and the analysis and processing information and process flow information of the alarm work order are recorded; the work order content and process flow information of each alarm work order in the security operation work order module are collected, and the key work order information of the security operation work order module is determined regularly according to the collected work order content and process flow information, a display page corresponding to the key work order information is generated, and the display page is sent to the target large-screen device; among them, the key work order information includes work order processing status information, alarm distribution information and processing timeliness information, which solves the problem that the alarm work order processing solution in the related technology cannot be processed after the alarm work order is determined Filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order. It is impossible to track and record each alarm work order to ensure that each alarm work order is handled in a timely and effective manner. For problems with low processing efficiency, alarm information can be pushed based on action tags and history to filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing. Alarm information that has not been sent repeatedly and needs to be assigned to technical personnel for processing is sent to the security operation work order module, thereby filtering out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order. This can be done by collecting the work order content and process flow information of each alarm work order. Information, through the third timing component, the work order content and process flow information are collected regularly, and the key work order information that can be used to characterize the processing progress of each alarm work order in each link is determined. Each determined alarm work order is tracked and recorded, and the key work order information that can be used to characterize the processing progress of each alarm work order in each link is visualized. The processing progress of each alarm work order in each link is provided to the technical staff in an intuitive and dynamic manner, which helps the technical staff to determine the processing progress of each alarm work order in each link, and promptly handle the alarm work order with timeout phenomenon, so as to ensure that each alarm work order is handled in a timely and effective manner, and improve the processing efficiency and transparency of the processing process.

[0110] Example 3

[0111] Figure 7This is a structural diagram of an alarm work order processing device provided by the third embodiment of the present invention. The device can be configured in a security perception module in an alarm work order processing system. Figure 7 As shown, the device includes: an alarm information generating unit 301, an alarm information pushing unit 302 and an alarm work order monitoring unit 303.

[0112] Among them, the alarm information generation unit 301 is used to periodically generate alarm information corresponding to each key abnormal log data within the target time length through the first timing component, detect whether each alarm information is an alarm information to be pushed to the security operation work order module, set the action mark of each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in the first index table; the alarm information pushing unit 302 is used to periodically push alarm information according to the action mark in the first index table and the history in the second index table through the second timing component, filter out the pushed alarm information in the first index table, and determine Each alarm information to be pushed in the first index table is sent to the security operation work order module; the alarm work order monitoring unit 303 is used to collect the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, regularly determines the work order key information of the security operation work order module according to the collected work order content and process flow information, generates a display page corresponding to the work order key information, and sends the display page to the target large-screen device; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information.

[0113] The technical solution of the embodiment of the present invention is to regularly generate alarm information corresponding to each key abnormal log data within the target time length, detect whether each alarm information is the alarm information to be pushed to the security operation work order module, set the action mark of each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in the first index table; regularly push alarm information according to the action mark in the first index table and the historical push alarm information in the second index table, filter out the pushed alarm information in the first index table, determine each alarm information to be pushed in the first index table, and send each alarm information to be pushed to the security operation work order module, so that the security operation work order module will receive each alarm information The information is determined as an alarm work order, the target processing personnel matching the alarm work order are determined, the alarm work order is assigned to the matched target processing personnel, and the analysis and processing information and process flow information of the alarm work order are recorded; the work order content and process flow information of each alarm work order in the security operation work order module are collected, and the key work order information of the security operation work order module is determined regularly according to the collected work order content and process flow information, a display page corresponding to the key work order information is generated, and the display page is sent to the target large-screen device; among them, the key work order information includes work order processing status information, alarm distribution information and processing timeliness information, which solves the problem that the alarm work order processing solution in the related technology cannot be processed after the alarm work order is determined Filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order. It is impossible to track and record each alarm work order to ensure that each alarm work order is handled in a timely and effective manner. For problems with low processing efficiency, alarm information can be pushed based on action tags and history to filter out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing. Alarm information that has not been sent repeatedly and needs to be assigned to technical personnel for processing is sent to the security operation work order module, thereby filtering out duplicate alarm information and alarm information that does not need to be assigned to technical personnel for processing before determining the alarm work order. This can be done by collecting the work order content and process flow information of each alarm work order. Information, through the third timing component, the work order content and process flow information are collected regularly, and the key work order information that can be used to characterize the processing progress of each alarm work order in each link is determined. Each determined alarm work order is tracked and recorded, and the key work order information that can be used to characterize the processing progress of each alarm work order in each link is visualized. The processing progress of each alarm work order in each link is provided to the technical staff in an intuitive and dynamic manner, which helps the technical staff to determine the processing progress of each alarm work order in each link, and promptly handle the alarm work order with timeout phenomenon, so as to ensure that each alarm work order is handled in a timely and effective manner, and improve the processing efficiency and transparency of the processing process.

[0114] In an optional implementation of an embodiment of the present invention, optionally, the alarm information generation unit 301 is specifically used to: perform the following operations periodically through the first timing component: filter out each key abnormal log data in the abnormal log data received within the target time length, and generate alarm information corresponding to each key abnormal log data; detect whether each alarm information is an alarm information to be pushed to the security operation work order module; for each alarm information to be pushed to the security operation work order module, determine the action mark of the alarm information as the first mark information; for each alarm information that does not need to be pushed to the security operation work order module, determine the action mark of the alarm information as the second mark information; store each alarm information and the action mark of each alarm information in the first index table.

[0115] In an optional implementation of an embodiment of the present invention, optionally, each key abnormal log data in the abnormal log data received within the target time length is filtered out, including: filtering out each key abnormal log data in each abnormal log data according to the log type of each abnormal log data received within the target time length.

[0116] In an optional implementation of an embodiment of the present invention, optionally, alarm information corresponding to each key abnormality log data is generated, including: determining the alarm content of the alarm information corresponding to each key abnormality log data based on the key fields in each key abnormality log data, and obtaining the alarm information corresponding to each key abnormality log data.

[0117] In an optional implementation of an embodiment of the present invention, optionally, the alarm information push unit 302 is specifically used to: perform the following operations at regular intervals through a second timing component: detect whether each alarm information in the first index table is included in the historical pushed alarm information in the second index table, determine the alarm information included in the historical pushed alarm information in the second index table as the pushed alarm information, and delete the pushed alarm information; mark each action in each remaining alarm information in the first index table as the alarm information of the first marking information as the alarm information to be pushed, and send each alarm information to be pushed to the security operation work order module.

[0118] In an optional implementation of an embodiment of the present invention, optionally, the alarm work order monitoring unit 303 is specifically used to: regularly perform the following operations through a third timing component: determine the work order processing status information, alarm distribution information and processing timeliness information of the security operation work order module based on the latest collected work order content and process flow information; add the work order processing status information, the alarm distribution information and the processing timeliness information to the display page template, obtain a display page corresponding to the work order processing status information, the alarm distribution information and the processing timeliness information, and send the display page to the target large-screen device.

[0119] The alarm work order processing device provided in the embodiment of the present invention can execute the alarm work order processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0120] Example 4

[0121] Figure 8 A schematic structural diagram of an electronic device 10 that can be used to implement the alarm work order processing method of an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, electronic devices, blade electronic devices, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0122] like Figure 8 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0123] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0124] The processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any other suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the alarm work order processing method.

[0125] In some embodiments, the alarm work order processing method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on a heterogeneous hardware accelerator via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by a processor, one or more steps of the alarm work order processing method described above can be performed. Alternatively, in other embodiments, the processor can be configured to execute the alarm work order processing method by any other appropriate means (for example, by means of firmware).

[0126] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0127] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or electronic device.

[0128] In the context of the present invention, computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage medium can be a machine-readable signal medium. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0129] To provide interaction with a user, the systems and techniques described herein can be implemented on a heterogeneous hardware accelerator that has: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the heterogeneous hardware accelerator. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0130] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as data electronics), or a computing system that includes middleware components (e.g., application electronics), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0131] A computing system may include a client and an electronic device. The client and electronic device are generally remote from each other and typically interact via a communication network. The client-electronic device relationship is established by computer programs running on the respective computers and establishing a client-electronic device relationship. The electronic device may be a cloud electronic device, also known as a cloud computing electronic device or cloud host, a host product within a cloud computing service ecosystem that addresses the management difficulties and limited business scalability of traditional physical hosts and VPS services.

[0132] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0133] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. An alarm work order processing system, characterized in that: include: Security perception module, security operation work order module, and target large-screen devices; Among them, the security perception module is used to periodically generate alarm information corresponding to each key abnormal log data within the target time length through a first timing component, detect whether each alarm information is an alarm information to be pushed to the security operation work order module, set an action mark for each alarm information according to the detection result, and store each alarm information and the action mark of each alarm information in a first index table; through a second timing component, regularly filter out the pushed alarm information in the first index table according to the action mark in the first index table and the historical pushed alarm information in the second index table, determine each alarm information to be pushed in the first index table, and send each alarm information to be pushed to the security operation work order module; collect the work order content and process flow information of each alarm work order in the security operation work order module, and through a third timing component, regularly determine the work order key information of the security operation work order module according to the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information; The security operation work order module is used to determine each received alarm information as an alarm work order, determine the target processing personnel that matches the alarm work order, assign the alarm work order to the matched target processing personnel, and record the analysis and processing information and process flow information of the alarm work order; The target large-screen device is used to display the received presentation page.

2. A method for processing an alarm work order, applied to the security perception module in the alarm work order processing system according to claim 1, characterized in that: include: Generate alarm information corresponding to each key abnormal log data within the target time period through the first timing component, detect whether each alarm information is an alarm information to be pushed to the security operation work order module, set an action tag for each alarm information according to the detection result, and store each alarm information and the action tag of each alarm information in the first index table; Through the second timing component, according to the action mark in the first index table and the historical pushed alarm information in the second index table, the pushed alarm information in the first index table is filtered out, each alarm information to be pushed in the first index table is determined, and each alarm information to be pushed is sent to the security operation work order module; Collect the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, determine the work order key information of the security operation work order module based on the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information.

3. The alarm work order processing method according to claim 2, characterized in that: The first timing component periodically generates alarm information corresponding to each key abnormal log data within the target time period, detects whether each alarm information is an alarm information to be pushed to the security operation work order module, sets an action tag for each alarm information according to the detection result, and stores each alarm information and the action tag of each alarm information in the first index table, including: The following operations are performed regularly by the first timing component: Filter out each key abnormal log data from the abnormal log data received within the target time period, and generate alarm information corresponding to each key abnormal log data; Check whether each alarm information is the alarm information to be pushed to the security operation work order module; For each alarm information to be pushed to the security operation work order module, determine the action mark of the alarm information as the first mark information; For each alarm message that does not need to be pushed to the security operation work order module, determine the action mark of the alarm message as the second mark information; Each piece of alarm information and the action tag of each piece of alarm information are stored in the first index table.

4. The alarm work order processing method according to claim 3, characterized in that: Filter out key abnormal log data from the abnormal log data received within the target time period, including: According to the log type of each abnormal log data received within the target time period, each key abnormal log data in each abnormal log data is filtered out.

5. The alarm work order processing method according to claim 3, characterized in that: Generates alarm information corresponding to each key abnormal log data, including: According to the key fields in each key abnormality log data, the alarm content of the alarm information corresponding to each key abnormality log data is determined, and the alarm information corresponding to each key abnormality log data is obtained.

6. The alarm work order processing method according to claim 3, characterized in that: By using a second timing component, according to the action mark in the first index table and the historical pushed alarm information in the second index table, the pushed alarm information in the first index table is filtered out, each piece of alarm information to be pushed in the first index table is determined, and each piece of alarm information to be pushed is sent to the security operation work order module, including: The following operations are performed periodically by the second timing component: Detecting whether each alarm information in the first index table is included in the historical pushed alarm information in the second index table, determining the alarm information included in the historical pushed alarm information in the second index table as the pushed alarm information, and deleting the pushed alarm information; Each alarm information whose action is marked as the first marking information in each remaining alarm information in the first index table is determined as the alarm information to be pushed, and each alarm information to be pushed is sent to the security operation work order module.

7. The alarm work order processing method according to claim 2, characterized in that: The method includes: determining key work order information of the security operation work order module based on the collected work order content and process flow information through a third timing component, generating a display page corresponding to the key work order information, and sending the display page to a target large-screen device, including: The following operations are performed periodically by the third timing component: Determine the work order processing status information, alarm distribution information, and processing timeliness information of the security operation work order module based on the latest collected work order content and process flow information; Add the work order processing status information, the alarm distribution information and the processing timeliness information to the display page template, obtain a display page corresponding to the work order processing status information, the alarm distribution information and the processing timeliness information, and send the display page to the target large-screen device.

8. An alarm work order processing device, configured in the security perception module of the alarm work order processing system according to claim 1, characterized in that: include: an alarm information generating unit, configured to periodically generate, through a first timing component, alarm information corresponding to each key abnormality log data within a target time period, detect whether each alarm information is an alarm information to be pushed to a security operation work order module, set an action flag for each alarm information according to the detection result, and store each alarm information and the action flag of each alarm information in a first index table; An alarm information pushing unit is configured to, through a second timing component, regularly push alarm information according to the action mark in the first index table and the historical push alarm information in the second index table, filter out the pushed alarm information in the first index table, determine each alarm information to be pushed in the first index table, and send each alarm information to be pushed to the security operation work order module; The alarm work order monitoring unit is used to collect the work order content and process flow information of each alarm work order in the security operation work order module, and through the third timing component, regularly determine the work order key information of the security operation work order module based on the collected work order content and process flow information, generate a display page corresponding to the work order key information, and send the display page to the target large-screen device; wherein, the work order key information includes work order processing status information, alarm distribution information and processing timeliness information.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm work order processing method according to any one of claims 2 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm work order processing method according to any one of claims 2 to 7 when executed.

Images