A method and system for analyzing false alarms in security incidents

Abstract

This invention discloses a method and system for judging false alarms in security incidents. The method includes: receiving event data and inputting it into a multi-level classifier; calculating the reward value and aging function after performing the classification operation; and constructing a state machine model.<S,S’,C,R,A> The overall reward value for all states in the state machine is calculated based on the set R of reward values ​​and the set A of aging functions. This overall reward value is compared with a preset threshold; if the overall reward value is less than the threshold, the security event is determined to be a false alarm. This achieves accurate identification and efficient filtering of false alarms. The multi-level classifier overcomes the limitations of traditional single-feature analysis, significantly improving the accuracy of false alarm identification. By comparing the overall reward value with a dynamic threshold, it significantly reduces security operation costs.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for judging false alarms of security incidents. Background Technology

[0002] In a cybersecurity protection system, accurate analysis of security incident alerts is a core element in ensuring stable system operation. With the deepening of enterprise digital transformation, the number of alerts generated daily by security devices is growing exponentially. According to a CNCERT 2023 report, large enterprises have exceeded 100,000 alerts per day on average. Existing technologies primarily filter false alarms through event correlation analysis and historical data comparison. However, these methods exhibit significant shortcomings in complex business scenarios: limitations of static rule matching (traditional methods rely on fixed feature libraries, such as regular expressions, for attack identification, failing to dynamically adapt to business changes); insufficient multi-dimensional feature fusion (existing solutions typically only analyze event types or metadata, lacking in-depth mining of payload content and response characteristics; for example, SQL injection attacks and legitimate database queries are difficult to distinguish at the metadata level, but the entropy distribution of the response body differs significantly, and existing methods cannot effectively utilize such features); lack of dynamic adaptability to time factors (periodic business operations repeatedly trigger the same alarms, and traditional static threshold methods cannot distinguish between normal periodic behavior and abnormal attacks, severely consuming operational resources); and low decision-making efficiency in complex scenarios (for composite events matching multiple attack features simultaneously, existing methods struggle to comprehensively assess the confidence level of each feature). Therefore, achieving accurate identification of security event false alarms in complex business scenarios has significant research and development value. Summary of the Invention

[0003] In view of this, the present invention proposes a method and system for judging false alarms of security incidents, which can achieve accurate identification of false alarms of security incidents. The present invention provides the following technical solution:

[0004] A method for identifying false alarms in security incidents, the method comprising:

[0005] Receive security event data and input it into a pre-built multi-level classifier, which is used to perform multiple type classifications of the security events according to a preset dimension;

[0006] Calculate the reward value and aging function of each classifier after performing the classification operation;

[0007] Construct a state machine model corresponding to the multi-level classifier.<S,S’,C,R,A> Where S is the initial state, S' is the target state, C is the set of the multi-level classifiers, R is the set of the reward values, and A is the set of the aging functions;

[0008] The total reward value for all states in the state machine is calculated based on the set R of reward values ​​and the set A of aging functions.

[0009] The total reward value is compared with a preset threshold for judging false alarm events. If the total reward value is less than the threshold, the security event is judged to be a false alarm event.

[0010] Optionally, the multi-level classifier includes a first-level classifier, a second-level classifier, a third-level classifier, a fourth-level classifier, and a fifth-level classifier;

[0011] The primary classifier is used to categorize security incidents according to standards.

[0012] The secondary classifier is used to further subdivide attack types;

[0013] The three-level classifier is used to dynamically divide categories based on metadata;

[0014] The four-level classifier is used to extract the feature layout of the request load;

[0015] The five-level classifier is used to extract the feature layout of the response load.

[0016] Optionally, the reward value is the expected value of the conditional probability distribution of each category within a preset time period, denoted as:

[0017] r i =E(P(x|f ij ), where x is the security event to be analyzed, and f ij Let i be the classification function, i be the classifier level, and j be the classifier function number at the current classifier level.

[0018] Optionally, the aging function is a negative exponential function, denoted as a. i =e -t , where t represents the time difference between the current time and the time when the security event occurred.

[0019] Optionally, the formula for calculating the total reward value of all states in the state machine based on the set R of reward values ​​and the set A of aging functions is as follows: Where n is the number of classifiers.

[0020] Optionally, the formula for setting the threshold is: Where C i Let be the set of classifiers at level i, n be the number of classifiers, and α be the threshold adjustment coefficient.

[0021] This invention further discloses a system for analyzing false alarms in security incidents, comprising:

[0022] The classification module is used to receive event data and input it into a pre-built multi-level classifier. The multi-level classifier is used to perform multiple type classifications of the security event according to a preset dimension; and to calculate the reward value and aging function of each level of classifier after performing the classification operation.

[0023] The model building module is used to build state machine models.<S,S’,C,R,A> Where S is the initial state, S' is the target state, C is the set of the multi-level classifiers, R is the set of the reward values, and A is the set of the aging functions;

[0024] The calculation module is used to calculate the total reward value of all states in the state machine based on the set R of reward values ​​and the set A of aging functions;

[0025] The judgment module is used to compare the total reward value with a preset judgment threshold for false alarm events. If the total reward value is less than the threshold, the security event is judged to be a false alarm event.

[0026] The present invention further discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0027] The present invention further discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method.

[0028] According to the technical solution of this invention, by constructing a multi-level classifier reinforcement learning model and combining it with a time-sensitive dynamic evaluation mechanism, accurate identification and efficient filtering of security event characteristics are achieved. The multi-level classifier overcomes the limitations of traditional single-feature analysis, significantly improving the accuracy of characteristic identification. It effectively quantifies the confidence level when matching multiple features based on the reward value calculated using conditional probability expectation, resolving the ambiguity problem in decision-making for complex events. Combined with a negative exponential aging function, it achieves exponential decay of historical data, suppressing periodic false alarm rates. Finally, by comparing the overall reward value with a threshold, the characteristic is determined. This not only significantly reduces security operation costs but also uses false alarm data to guide system vulnerability repair, forming a closed-loop security management system and providing an innovative solution for network security protection in complex business scenarios. Attached Figure Description

[0029] For illustrative and not limiting purposes, the present invention will now be described in conjunction with embodiments and accompanying drawings, wherein:

[0030] Figure 1 This is a flowchart illustrating the method for judging false alarms of security events in an embodiment of the present invention;

[0031] Figure 2This is a schematic diagram of the structure of the security incident false alarm judgment system in an embodiment of the present invention;

[0032] Figure 3 This is a schematic diagram of the structure of the electronic device in an embodiment of the present invention;

[0033] Figure 4 This is a schematic diagram of the workflow of the state machine model in the embodiments of the present invention. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application.

[0035] It should be noted that, where there is no conflict, the embodiments and features of the embodiments in this application can be combined with each other. The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0036] refer to Figure 1 This embodiment discloses a method for judging false alarms of security incidents, which includes the following steps:

[0037] S100: Receive event data and input it into a pre-built multi-level classifier. In this embodiment, the event is a security event, and the multi-level classifier is used to perform multiple type classifications of the security event based on preset dimensions. Specifically, a classifier set Φ = {C} is established. i}, where i = 1, 2, 3, 4, 5, ..., n. This implementation constructs 5 classifiers, specifically including a first-level classifier, a second-level classifier, a third-level classifier, a fourth-level classifier, and a fifth-level classifier.

[0038] The primary classifier is used to classify security incidents into major categories according to standards. This primary classifier is denoted as C1. Specifically, the security incident receiving, detection and analysis platform will use the primary classifier to classify the incidents according to the alarms of relevant security devices. The classification is based on the national standard GB / T20986-2023.

[0039] The secondary classifier is used to further subdivide attack types to represent the nature of security events. This secondary classifier is denoted as C2. For example, for network attack-vulnerability exploitation events, subdivisions such as SQL injection, command injection, cross-site request forgery, server request forgery, and deserialization are added to further subdivide the family of malicious programs and increase the accuracy of the classifier.

[0040] A three-level classifier is used to dynamically classify based on metadata. This three-level classifier is denoted as C3. Through this three-level classifier, each type of security event with different metadata can be dynamically classified. Therefore, the number of classifiers under this three-level classifier is also different. For example, it can be used to capture the characteristics of different network communication directions for classification.

[0041] A four-level classifier, denoted as C4, is used to extract the feature layout of request loads, specifically the load within requests for each type of security event. It extracts security features using keywords, regular expressions, and Backsnow normal form analysis to execute various rules. For example, against SQL injection attacks, it extracts security features using the regular expression ` / select.*? from.*? where.*? / i;`. Furthermore, during classification, the four-level classifier retains only a few invariants from the feature layout of the request load, removing variables. For instance, in command injection attacks, the execution command parameters can be ignored, and only the command portion is retained, ensuring the classifier doesn't expand indefinitely due to an excessively large parameter space. Ultimately, this identifies seemingly malicious but actually legitimate business features within the request load.

[0042] A five-level classifier, denoted as C5, is used to extract the feature layout of the response load. The number of classifiers is dynamically adjusted, and the feature extraction method depends on the response code, fixed page information, or execution return results. This implementation takes SQL injection alerts as an example, where the return results consist of a large amount of query content. In this case, it relies on extracting response features, including response header layout, response body layout, response body length, response body entropy value, response body character distribution, response body word distribution, HTML tag distribution, and other success or failure message words. Ultimately, it aims to determine whether an attack was successful or whether the business is abnormal based on the server response features.

[0043] In summary, this implementation constructs five hierarchical classifiers, each containing a fixed or non-fixed classification function, using f ij Let represent , where i is the classifier level and j is the number of the classifier function at the current classifier level.

[0044] S200: Calculate the reward value and aging function of each classifier after performing the classification operation.

[0045] The reward value is the expected value of the conditional probability distribution of each category within a preset time period, i.e., the mean distribution of each category in different time periods, denoted as r. i =E(P(x|f ij In this context, x represents the security event to be assessed. The reward value reflects the long-term average ability of the j-th classification function in the i-th layer classifier to distinguish security events. Furthermore, when the same classification function returns multiple matching results, calculating the reward value to integrate all possibilities can effectively avoid misjudgments based on a single high-probability feature. The conditional probability P(x|f) is... ij ) represents the classification function f of event x. ij The probability of identifying it as a certain type of attack. For example, in conjunction with step S100, if f 41 This is the regular expression matching rule for SQL injection, P(x|f 41 This refers to the probability of the rule matching event x. This implementation further uses the expected value E to statistically average the conditional probabilities of the classification function in historical data to eliminate the influence of random fluctuations. The calculation formula is: Where, x k Let n be the number of historical event samples. Furthermore, a negative exponential function, denoted as a0, is used as the aging function. i =e -t Where t represents the time difference between the current time and the time the security event occurred, which can be, for example, minutes, hours, days, etc., and is dynamically adjusted according to the event type without restriction. This is to ensure that recent rewards have a greater impact on the overall effect than historical rewards.

[0046] S300: Building a State Machine Model<S,S’,C,R,A> ,refer to Figure 4 Where S is the initial state, S' is the target state, C is the set of multi-level classifiers, R is the set of reward values, and A is the set of aging functions. In the task processing flow of the state machine model, S0 (initial state): Receives the original security event and triggers the first-level classifier (C1); S1: Completes event category classification and triggers the second-level classifier (C2); S2: Completes attack type subdivision and triggers the third-level classifier (C3); S3: Completes metadata association and triggers the fourth-level classifier (C4); S4: Completes request load analysis and triggers the fifth-level classifier (C5); S5 (target state): Outputs the classification result and calculates the overall reward value. Specifically, each state maintains the current classification result and the intermediate reward value, where the intermediate reward value is r. i *a i For example, in a four-level classifier, if the probability that a certain request load characteristic matches a historical SQL injection pattern is 80%, then r iIf the value is 0.8, and the current event occurred 3 hours ago, then t in the aging function is 3. Further, a queue structure is used to implement state progression, employing a parallel matching mode where all classification functions are executed simultaneously, and the function matching results are merged according to rules.

[0047] S400: Calculate the total reward value for all states in the state machine based on the set R of reward values ​​and the set A of aging functions. As shown in step S200, the formula for calculating the reward value is r. i =E(P(x|f ij The formula for calculating the aging function is a. i =e -t The formula for calculating the overall reward value is: Where n is the number of classifiers. For example, in a four-level classifier, the probability of the request load feature matching the historical SQL injection pattern is 80%, the current event occurred 3 hours ago, the operation interval of each classifier is 1 hour, and there are a total of five classifiers, then the total reward value is 1.881.

[0048] S500: Compare the total reward value with a preset threshold for judging false alarm events. If the total reward value is less than the threshold, the security event is determined to be a false alarm. In other words, compare the total reward value with a preset threshold for judging false security events. If the total reward value is less than the threshold, the security event is determined to be a false alarm. The formula for setting the threshold is: Where C i Let be the set of classifiers at level i, n be the number of classifiers, and α be the threshold adjustment coefficient. For example, the total number of classifiers is: ∑|C i |=20+15+30+25+10=100, the threshold adjustment coefficient is 0.3, then the final threshold is r th =0.3 / 100 = 0.003. Therefore, taking the total reward value in step S400 as an example, 1.881 > 0.003. Thus, the alarm is retained and is not a false alarm; otherwise, it would be a false alarm. It should be noted that the above calculation data are exemplary. The actual situation in different scenarios is different and will affect the final calculation result.

[0049] In summary, the security incident false alarm assessment method disclosed in this embodiment achieves accurate identification and intelligent filtering of security incident false alarms in complex business scenarios by constructing a multi-classifier reinforcement learning model. Specifically, the technical solution of this embodiment overcomes the limitations of traditional single-scenario solutions through a multi-level classifier system and general adaptability. Simultaneously, based on reinforcement learning and time-sensitive decision-making mechanisms, it quantifies the classifier confidence using conditional probability expectation and combines it with a negative exponential aging function to achieve dynamic forgetting of historical data. Furthermore, a dynamic threshold formula based on the number of classifiers and risk coefficients can adaptively adjust the false alarm filtering strategy. This solution, through the synergistic effect of multi-feature fusion, time-sensitive decision-making, and dynamic threshold mechanisms, achieves significant results in reducing false alarm rates, improving response efficiency, and optimizing resource utilization, providing an intelligent solution for enterprise-level security operations that combines versatility and accuracy.

[0050] refer to Figure 2 This embodiment further discloses a system for analyzing false alarms in security incidents, including:

[0051] The classifier module 21 receives event data and inputs it into a pre-built multi-level classifier. The multi-level classifier performs multiple type classifications of the security events based on preset dimensions. The multi-level classifier includes a first-level classifier, a second-level classifier, a third-level classifier, a fourth-level classifier, and a fifth-level classifier. Specifically, the first-level classifier classifies security events into broad categories according to standards; the second-level classifier subdivides attack types; the third-level classifier dynamically classifies categories based on metadata; the fourth-level classifier extracts the feature layout of request loads; and the fifth-level classifier extracts the feature layout of response loads. The module also calculates the reward value and aging function of each classifier after performing the classification operation. The reward value is the expected value of the conditional probability distribution of each classification within a preset time period, denoted as r. i =E(P(x|f ij ), where x is the security event to be analyzed, and f ij Let be the classification function, i be the classifier level, and j be the classifier function number at the current classifier level; the aging function is a negative exponential function, denoted as a. i =e -t , where t represents the time difference between the current time and the time when the security event occurred.

[0052] Model building module 22 is used to build state machine models.<S,S’,C,R,A> Where S is the initial state, S' is the target state, C is the set of the multi-level classifiers, R is the set of the reward values, and A is the set of the aging functions;

[0053] Calculation module 23 is used to calculate the total reward value of all states in the state machine based on the set R of reward values ​​and the set A of aging functions. The formula for calculating the total reward value is: Where n is the number of classifiers;

[0054] The judgment module 24 is used to compare the total reward value with a preset judgment threshold for false alarm events. The formula for setting the threshold is: Where C i Let be the set of classifiers at level i, n be the number of classifiers, and α be the threshold adjustment coefficient. If the total reward value is less than the threshold, then the security event is determined to be a false alarm event.

[0055] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as... Figure 3 As shown, the electronic device 50 includes: a processor 501, a memory 502, and a bus 503;

[0056] The processor 501 and the memory 502 communicate with each other via the bus 503; the processor 501 is used to call the program instructions in the memory 502 to execute the methods provided in the above-described embodiments.

[0057] This embodiment provides a non-transitory computer-readable storage medium that stores computer instructions that cause a computer to execute the methods provided in the above-described embodiments.

[0058] Those skilled in the art will understand that all or part of the steps of the above-described method implementation can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above-described method implementation. The aforementioned storage medium includes various storage media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.

[0059] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0060] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of each embodiment or some parts of the embodiments.

[0061] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for analyzing false alarms in security incidents, characterized in that, The method includes: Receive security event data and input it into a pre-built multi-level classifier, which is used to perform multiple type classifications of the security events according to a preset dimension; Calculate the reward value and aging function of each classifier after performing the classification operation. The reward value is the expected value of the conditional probability distribution of each classification within a preset time period, denoted as: ,in, This is a security incident pending assessment. For classification functions, At the classifier level, This is the classifier function number at the current classifier level; the aging function is a negative exponential function, denoted as . ,in This indicates the time difference between the current time and the time the security incident occurred; Construct a state machine model corresponding to the multi-level classifier. <S,S’,C,R,A> ,in, S This is the initial state. S’ For the target state, C The set of the multi-level classifiers, R The set of reward values, A This is the set of the aging functions; According to the set of reward values R and the set of aging functions A Calculate the total reward value for all states in the state machine. The formula for calculating the total reward value is as follows: ,in, n The number of classifiers; The total reward value is compared with a preset threshold for judging false alarm events. If the total reward value is less than the threshold, the security event is judged to be a false alarm event.

2. The method for judging false alarms of security incidents according to claim 1, characterized in that, The multi-level classifier includes a first-level classifier, a second-level classifier, a third-level classifier, a fourth-level classifier, and a fifth-level classifier; The primary classifier is used to categorize security incidents according to standards. The secondary classifier is used to further subdivide attack types; The three-level classifier is used to dynamically divide categories based on metadata; The four-level classifier is used to extract the feature layout of the request load; The five-level classifier is used to extract the feature layout of the response load.

3. The method for judging false alarms of security incidents according to claim 1, characterized in that, The formula for setting the threshold is: ,in For the first i A set of classifiers, n The number of classifiers, This is the threshold adjustment coefficient.

4. A system for analyzing false alarms in security incidents, characterized in that, include: The classification module is used to receive security event data and input it into a pre-built multi-level classifier, which is used to perform multiple type classifications of the security events according to preset dimensions. Calculate the reward value and aging function of each classifier after performing the classification operation. The reward value is the expected value of the conditional probability distribution of each classification within a preset time period, denoted as: ,in, This is a security incident pending assessment. For classification functions, At the classifier level, This is the classifier function number at the current classifier level; the aging function is a negative exponential function, denoted as . ,in This indicates the time difference between the current time and the time the security incident occurred; The model building module is used to build state machine models. <S,S’,C,R,A> ,in, S This is the initial state. S’ For the target state, C The set of the multi-level classifiers, R The set of reward values, A This is the set of the aging functions; The calculation module is used to calculate based on the set of reward values. R and the set of aging functions A Calculate the total reward value for all states in the state machine. The formula for calculating the total reward value is as follows: ,in, n The number of classifiers; The judgment module is used to compare the total reward value with a preset judgment threshold for false alarm events. If the total reward value is less than the threshold, the security event is judged to be a false alarm event.

5. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1-3.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method of any one of claims 1-3.

Images