Security event determination method and apparatus, computer device, and storage medium

Abstract

The application provides a security event determination method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining alarm data; calculating the deviation degree of the alarm data and normal alarm data to obtain an abnormal score; the normal alarm data refers to alarm data generated by an alarm system in a normal operation state and within a normal range; calculating a prediction probability of the alarm data being real threat data according to a feature vector of the alarm data and a prediction model; the prediction model is obtained by training in a training process by assigning a first weight to majority class samples and a second weight to minority class samples; the minority class samples refer to alarm data marked as real threats; and determining whether an event indicated by the alarm data is a security event according to the abnormal score and the prediction probability. The application can effectively alleviate the imbalance of alarm categories, thereby improving the recognition accuracy of security events.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a security event determination method and device, a computer device, and a storage medium. BACKGROUND

[0002] In the current network security field, there is a problem of mismatch between alarm categories and security facts, that is, the number of alarms does not match the amount of security events confirmed by forensics. For example, in an implementation scenario of an industrial network, 133.77 million alarm events are recorded in the network log, but only 593 of them are confirmed by manual verification to be events with security facts, and the remaining alarm events are false positives or irrelevant alarm events. To solve the problem of mismatch between alarm categories and security facts, the current method can be to down-sample negative samples to relatively balance the proportion of positive and negative samples.

[0003] However, even after down-sampling in the current mainstream model training process, the number of negative samples may still be much larger than that of positive samples, and the model may still be biased towards the majority class during training, resulting in problems such as insufficient accuracy of recognition, a large number of false positive events in the recognized events, and insufficient recognition ability for real security events. SUMMARY

[0004] Therefore, the present application proposes a security event determination method and device, a computer device, and a storage medium to solve the problem of inaccurate recognition of security events caused by unbalanced alarm categories in related technologies.

[0005] The first aspect of the present application proposes a security event determination method, which comprises:

[0006] obtaining alarm data;

[0007] calculating the deviation degree of the alarm data and normal alarm data to obtain an anomaly score; the normal alarm data refers to alarm data generated by an alarm system in a normal operating state within a normal range;

[0008] calculating a prediction probability that the alarm data is real threat data according to a feature vector of the alarm data and a prediction model; the prediction model is obtained by training in a training process by assigning a first weight to majority class samples and a second weight to minority class samples; the first weight is less than the second weight; the minority class samples refer to alarm data marked as real threats, and the majority class samples refer to all alarm data except the minority class samples;

[0009] determining whether the event indicated by the alarm data is a security event according to the anomaly score and the prediction probability.

[0010] The abnormal score is obtained by calculating the deviation degree of the alarm data and normal alarm data, accurate detection of unknown threats can be realized, the prediction probability of the alarm data being real threat data is calculated by the prediction model, accurate identification of known threats can be realized, the alarm range is gradually reduced through two-stage filtering, and therefore the identification accuracy of security events in the alarm data is greatly improved.

[0011] In the embodiment of the application, after obtaining the alarm data, the method further comprises:

[0012] extracting a plurality of feature information from the alarm data, the plurality of feature information comprising original feature information and derived feature information; wherein the original feature information comprises at least one of alarm time, protocol type, port number and attack feature code; and the derived feature information comprises combined occurrence frequency and IP reputation score;

[0013] For any feature information, the feature information is converted into numerical feature information, and a plurality of numerical feature information corresponding to the plurality of feature information is combined to obtain the feature vector.

[0014] In the embodiment of the application, the deviation degree of the alarm data and normal alarm data is calculated to obtain an abnormal score, comprising:

[0015] For any binary tree in the plurality of binary trees, the path length of the feature vector of the alarm data in the binary tree is calculated; each binary tree is constructed by randomly selecting a fixed number of normal alarm data;

[0016] According to a plurality of path lengths corresponding to the plurality of binary trees, an average path length is calculated;

[0017] The average path length is normalized to obtain an abnormal score.

[0018] In the embodiment of the application, the majority class sample is a negative sample, and the minority class sample is a positive sample; the prediction model is obtained by model training through the following steps, comprising:

[0019] obtaining training data, the training data comprising the negative sample and the positive sample; the sample quantity of the negative sample is several times the sample quantity of the positive sample;

[0020] An initial model is obtained by model training of an original model through the training data; the prediction probability of the initial model for the negative sample is higher than a preset threshold, and the prediction probability of the initial model for the positive sample is lower than the preset threshold;

[0021] The initial model is trained by a preset loss function to obtain the prediction model; the preset loss function is used to reduce the weight of the negative sample, so as to improve the prediction probability of the initial model for the positive sample.

[0022] In the embodiments of the present application, determining whether the event indicated by the alarm data is a security event according to the anomaly score and the prediction probability comprises:

[0023] According to the anomaly score, a third weight corresponding to the anomaly score, the prediction probability, and a fourth weight corresponding to the prediction probability, a priority score of the alarm data is calculated; the sum of the third weight and the fourth weight is 1;

[0024] According to the priority score, determining whether the event indicated by the alarm data is a security event.

[0025] In the embodiments of the present application, determining whether the event indicated by the alarm data is a security event according to the priority score comprises:

[0026] Determining the size relationship between the priority score and a score threshold;

[0027] If the priority score is greater than the score threshold, the event indicated by the alarm data is determined as the security event;

[0028] If the priority score is less than or equal to the score threshold, the event indicated by the alarm data is determined as a non-security event.

[0029] In the embodiments of the present application, the method further comprises:

[0030] Filtering at least one target alarm data from all alarm data; the priority score of the target alarm data is greater than the score threshold;

[0031] Sending the at least one target alarm data to a user terminal;

[0032] In response to feedback data of the user terminal, using artificial labeling information in the feedback data as model optimization data;

[0033] Model optimizing the prediction model by using the model optimization data.

[0034] Embodiments of the second aspect of the present application provide a security alarm priority determination device, comprising:

[0035] A data acquisition module is configured to acquire alarm data;

[0036] An anomaly score calculation module is configured to calculate a degree of deviation of the alarm data from normal alarm data to obtain an anomaly score. The normal alarm data refers to alarm data generated by an alarm system in a normal operation state and within a normal range.

[0037] A prediction probability calculation module is configured to calculate a prediction probability of the alarm data being real threat data according to a feature vector of the alarm data and a prediction model. The prediction model is obtained by training in a training process by assigning a first weight to majority class samples and a second weight to minority class samples. The first weight is less than the second weight. The minority class samples refer to alarm data marked as real threats, and the majority class samples refer to alarm data other than the minority class samples in all alarm data.

[0038] An event determination module is configured to determine whether an event indicated by the alarm data is a security event according to the anomaly score and the prediction probability.

[0039] An embodiment of the third aspect of the present application provides a computer device, which comprises a memory and a processor, the memory and the processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the security event determination method of the first aspect.

[0040] An embodiment of the fourth aspect of the present application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the security event determination method of the first aspect.

[0041] Additional aspects and advantages of the present application will be made apparent by the following description of the preferred embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0042] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are intended to illustrate preferred embodiments of the present application, and should not be considered limiting of the present application. Indeed, the drawings can illustrate only one preferred embodiment of the present application and therefore should not be considered to narrow the scope of the present application. Like reference numerals are used to refer to like parts throughout the several views of the drawings.

[0043] Figure 1 FIG. 1 shows a flowchart of a security event determination method according to an embodiment of the present application;

[0044] Figure 2 FIG. 3 shows a tree structure diagram of a binary tree according to an embodiment of the present application;

[0045] Figure 3A structural schematic diagram of a security alarm priority determination apparatus provided by an embodiment of the present application is shown.

[0046] Figure 4 A structural schematic diagram of a computer device provided by an embodiment of the present application is shown.

[0047] Figure 5 A structural schematic diagram of a computer device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0048] Exemplary embodiments of the present application will be described herein below with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thoroughly and completely understood, and will fully convey the scope of the application to those skilled in the art.

[0049] It should be noted that, unless otherwise specified, technical terms or scientific terms used in the present application should be understood as their common meanings to those skilled in the art to which the present application pertains.

[0050] The technical scenario related to the embodiments of the present application is described below.

[0051] To solve the problem of unbalanced alarm categories, the current main method is to down-sample negative samples, that is, a part of a large number of negative samples (false alarms or irrelevant alarms) are randomly selected for model training, so as to reduce the number of negative samples and make the proportion of positive samples (real security events) and negative samples relatively balanced. However, random sampling may lose representative negative sample features, affecting the overall learning effect of the model on negative samples; in addition, even after down-sampling, the number of negative samples may still be much larger than that of positive samples, and the model may still be biased towards the majority class during the training process, resulting in insufficient recognition ability for real security events.

[0052] Based on this, the embodiments of the present application provide a security event determination method, which gradually narrows down the alarm range through multi-level detection, that is, calculating the anomaly score of the alarm data and calculating the prediction probability of the alarm data being real threat data, and taking into account the dual effects of unknown threat detection and known threat identification, which can still maintain low false alarm and high recall under extremely unbalanced data.

[0053] According to the embodiments of the present application, a security event determination method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0054] In the embodiment, a security event determination method is provided, Figure 1 is a flowchart of the security event determination method according to the embodiment of the application, as Figure 1 shown, the flow includes the following steps:

[0055] Step S101, obtaining alarm data.

[0056] Specifically, the alarm data can be original alarm data of various security devices, wherein the security devices include but are not limited to: IDS (Intrusion Detection System), IPS (Intrusion Prevention System), firewall and endpoint monitoring system.

[0057] In some specific embodiments, after obtaining the alarm data, the method further includes:

[0058] cleaning and analyzing the obtained alarm data: including outlier filtering, missing field completion, field mapping, etc., and parsing the original alarm data of various security devices into standard JSON objects. Here, data unification is performed to ensure that the subsequent processing uses a unified structure.

[0059] Among them, the main fields in the standard JSON object are as shown in Table 1:

[0060] Table 1

[0061]

[0062] In some specific embodiments, after cleaning and analyzing the obtained alarm data, the method further includes:

[0063] Step a1, extracting a plurality of feature information from the alarm data.

[0064] Specifically, the plurality of feature information includes original feature information and derived feature information; wherein the original feature information includes at least one of alarm time, protocol type, port number and attack feature code; the derived feature information includes combined occurrence frequency and IP reputation score.

[0065] Step a2, for any feature information, converting the feature information into numerical feature information, and combining a plurality of numerical feature information corresponding to the plurality of feature information to obtain the feature vector.

[0066] Specifically, after extracting the feature information as shown in Table 1, it can be converted into corresponding numerical feature information, wherein the numerical feature information is as shown in Table 2:

[0067] Table 2

[0068]

[0069] Step S102, calculate the deviation of the alarm data from the normal alarm data to obtain an anomaly score.

[0070] Specifically, the normal alarm data refers to the alarm data generated by the alarm system in the normal operation state within the normal range. The anomaly score can be calculated according to the path length of the feature vector of the alarm data in the plurality of binary trees.

[0071] In some embodiments, the above step S102 includes steps S1021-S1023:

[0072] Step S1021, for any binary tree in the plurality of randomly generated binary trees, calculate the path length of the feature vector of the alarm data in the binary tree.

[0073] Specifically, each binary tree is randomly generated based on a plurality of normal alarm data, and the dimension of each feature vector corresponds to an attribute or decision node in the binary tree; each node in the binary tree stores a dimension index of a feature vector and a corresponding threshold value for determining the direction of the feature vector.

[0074] The above step S1021 is illustrated by an example: assuming that the feature vector of the alarm data is v=[1,0,1,1]; the structure of the randomly generated binary tree is as shown in Figure 2

[0075] Node 1: dimension index 0, threshold value 0.5

[0076] Node 2: dimension index 1, threshold value 0.5

[0077] Node 3: dimension index 2, threshold value 0.5

[0078] Node 4: dimension index 3, threshold value 0.5

[0079] Node 5: dimension index 2, threshold value 0.5

[0080] Node 6: dimension index 3, threshold value 0.5

[0081] Node 7: dimension index 1, threshold value 0.5

[0082] Starting from the root node, the direction is determined according to the value of the feature vector and the threshold value of the node, and the path length is calculated.

[0083] Root node (node 1): dimension index 0, threshold value 0.5. The 0th dimension of the feature vector is 1, which is greater than 0.5, and goes to the right subtree.​

[0084] Node 3: Dimension index is 2, threshold is 0.5. The second dimension of the feature vector is 1, which is greater than 0.5, so proceed to the right subtree.

[0085] Node 6: Dimension index is 3, threshold is 0.5. The third dimension of the feature vector is 1, which is greater than 0.5, there is no right subtree, and the path ends.

[0086] The path is: 1 → 3 → 6, and the path length is 3.

[0087] Step S1022: Calculate the average path length based on the multiple path lengths that correspond one-to-one with the multiple binary trees.

[0088] Specifically, the average path length can be calculated based on multiple path lengths and the number of binary trees.

[0089] Step S1023: Normalize the average path length to obtain an anomaly score.

[0090] Specifically, the average path length can be normalized using the following formula:

[0091]

[0092] in It is the number of samples. The normalization constant for the average path length. When the path length is short ( (smaller) A value close to 1 indicates that the sample is more likely to be isolated and has a higher tendency to be anomalous; when the path length is very long, A score close to 0 indicates a normal sample. This score maps to the (0,1) interval, with larger values ​​indicating stronger anomalies.

[0093] In this embodiment, the Isolation Forest algorithm is used to detect anomalies in feature vectors, specifically by calculating an anomaly score for each feature vector. Specifically, a normal alarm pattern is modeled using randomly generated binary trees, and the degree to which the alarm data deviates from the normal pattern is determined by calculating the path length of the feature vector in each binary tree. For each alarm data point, an anomaly score is output, indicating the significance of the difference between the alarm data and normal behavior. Alarm data with high anomaly scores (such as exceeding a set threshold or being at the top percentile of the score distribution) are marked as suspicious and may potentially cover unknown or novel attack behaviors. Conversely, alarms with very low scores are considered consistent with the normal pattern and are initially regarded as low-risk.

[0094] Step S103: Calculate the predicted probability that the alarm data is real threat data based on the feature vector of the alarm data and the prediction model.

[0095] Specifically, the prediction model is trained by assigning a first weight to majority class samples and a second weight to minority class samples during the training process; the first weight is less than the second weight; the minority class samples refer to the alarm data marked as real threats, and the majority class samples refer to all alarm data except the minority class samples.

[0096] In some embodiments, the above step S103 includes steps S1031-S1033:

[0097] Step S1031, obtaining training data.

[0098] Specifically, the training data includes the negative samples and the positive samples; the number of negative samples is several times the number of positive samples, for example: when the training data includes 133.77 million alarm data, but only 593 positive samples (i.e. alarm data marked as real threats, which can also be understood as alarm data confirmed by human to belong to real security events), the rest are all negative samples (i.e. false alarm data or irrelevant alarm data). In other words, the number of negative samples is much larger than the number of positive samples.

[0099] Step S1031, obtaining training data.

[0100] Specifically, the original model can be understood as a supervised machine learning model. The prediction probability of the initial model for the negative samples is higher than a preset threshold, and the prediction probability of the initial model for the positive samples is lower than the preset threshold. The preset threshold can be set by human according to actual conditions, which is not limited here, for example, 50%.

[0101] Step S1032, obtaining the prediction model by model training of the initial model through a preset loss function; the preset loss function is used to reduce the weight of the negative samples to improve the prediction probability of the initial model for the positive samples.

[0102] Specifically, the specific definition of the preset loss function is:

[0103]

[0104] wherein, is the probability of model prediction as a positive sample, is a balance factor, is an adjustment factor, is a logarithmic loss.

[0105] More specifically, the balance factor The weights of positive and negative samples in the loss function can be adjusted to alleviate the class imbalance problem. For example, if there are fewer positive samples, a larger value can be set to make the model pay more attention to positive samples. The adjustment factor can control the weight decay rate of easy-to-classify samples. When > 0, the loss of easy-to-classify samples, i.e. negative samples, with a model prediction probability close to 1 will be significantly reduced, so that the model pays more attention to those difficult-to-classify samples, i.e. positive samples. The logarithmic loss can be used to measure the difference between the predicted probability and the true label. When the loss is small when the predicted probability is close to the true label; otherwise, the loss is large.

[0106] In the embodiments of the present application, the loss function enhances the attention to difficult-to-classify samples of the minority class (i.e. positive samples: high-risk alarm data) by weighting easy-to-classify samples (i.e. negative samples), thereby improving the model's recognition rate of important alarms. The output is the classification probability or score of each alarm, such as the probability of the "high-risk" category.

[0107] In the embodiments of the present application, a supervised machine learning model is used to determine the threat level of alarm data. Based on the existing alarm history data (part of which is labeled as real threat or false alarm by security experts), an offline prediction model is trained to predict whether new alarm data is a real security event. To address the problem of unbalanced positive and negative samples in the data set, the strategy of enhancing the minority class samples is adopted in the training process, so that the model pays more attention to the minority high-risk samples. The prediction model can output a prediction probability for the input alarm data. The higher the prediction probability score, the more likely the model considers the alarm data to correspond to a real security event, and the lower the score, the more likely the model judges that the alarm data belongs to low-risk data, no-risk data or false alarm data. Through the prediction model, known types of attack alarm data can be accurately identified, and most of the no-risk alarm data can be filtered out.

[0108] Step S104, determining whether the event indicated by the alarm data is a security event according to the anomaly score and the prediction probability.

[0109] In some specific embodiments, the above step S104 further includes steps S1041-S1042:

[0110] Step S1041, calculating a priority score of the alarm data according to the anomaly score, a third weight corresponding to the anomaly score, the prediction probability, and a fourth weight corresponding to the prediction probability.

[0111] Specifically, the sum of the weights of the third weight and the fourth weight is 1. The third weight and the fourth weight can be set according to the actual situation, and no specific limitation is made here.

[0112] More specifically, the priority score can be calculated using the following formula:

[0113]

[0114] in, Rate the priority. The third weight ( ), As the fourth weight, For abnormal scoring, This is a prediction probability. The fusion formula combines the anomaly score reflected by the binary tree constructed from the isolated forest with the predicted probability of high-risk alarm data output by the prediction model to obtain a single score index. Depending on the system design, other fusion functions (such as polynomial combinations) can also be used to combine the scores. The output composite score reflects the overall risk or priority tendency of the alarm.

[0115] Step S1042: Determine whether the event indicated by the alarm data is a security event based on the priority score.

[0116] Specifically, the magnitude of the priority score can be used to determine whether the alarm data contains a security event. For example, priority scores can be mapped to discrete priority labels based on a set threshold or sorting strategy. For instance, a threshold can be set. :when When marked as "high risk", Alarms are marked as "medium risk" otherwise. Furthermore, all alarms can be sorted based on their scores, and the top few can be selected as high-priority alarms.

[0117] In some specific embodiments, step S1042 above includes steps b1-b3:

[0118] Step b1: Determine the relationship between the priority score and the score threshold.

[0119] Specifically, the scoring threshold can be set according to the actual situation, and no specific limit is made here. For example, the scoring threshold can be set to 66%.

[0120] Step b2: If the priority score is greater than the score threshold, then the event indicated by the alarm data is determined as the security event.

[0121] Step b3: If the priority score is less than or equal to the score threshold, the event indicated by the alarm data is determined to be a non-security event.

[0122] In the embodiments of the present application, when the priority score is greater than the score threshold, the event indicated by the alarm data is determined as a security event, which can also be understood as high-risk data; on the contrary, when the priority score is less than or equal to the score threshold, the event indicated by the alarm data is determined as a non-security event, which can also be understood as low-risk data.

[0123] In some specific embodiments, the score threshold includes but is not limited to a first score threshold and a second score threshold, wherein the second score threshold is greater than the first score threshold; when the priority score is greater than the second score threshold, the alarm data can be determined as high-risk data; when the priority score is less than the second score threshold and the priority score is greater than the first score threshold, the alarm data is determined as medium-risk data; when the priority score is less than or equal to the first score threshold, the alarm data is determined as low-risk data.

[0124] In the embodiments of the present application, by weighted fusion, the sensitivity of unknown threats by anomaly detection (i.e. calculating anomaly score) and the accuracy of known threats by supervised model (i.e. calculating prediction probability) can be utilized at the same time, and the detection effect is maximized. After fusion evaluation, each alarm is assigned a priority label (such as high, medium and low three categories) or a specific risk score. According to the set threshold, alarms below a certain score can be filtered out, and only high-priority alarms are submitted to security personnel for disposal, thereby greatly reducing the number of alarms that need to be manually focused on. More specifically, multiple alarms with correlation (such as multiple high-risk alarms with the same source IP and occurring within a short period of time can be regarded as an event) can be merged, and alarms are output in the unit of events to improve processing efficiency.

[0125] In some specific embodiments, the method further comprises:

[0126] Step c1, filtering at least one target alarm data from all alarm data; the priority score of the target alarm data is greater than the score threshold.

[0127] Step c2, sending the at least one target alarm data to the user end.

[0128] Step c3, in response to the feedback data of the user end, taking the manual annotation information in the feedback data as model optimization data.

[0129] Step c4, performing model optimization on the prediction model through the model optimization data.

[0130] In the embodiments of the present application, the high-risk alarm data is sent to the user terminal, and a security analyst manually labels the high-risk alarm data to filter out false alarm data; the false alarm data is stored in a training data pool, and a model updating process is triggered regularly (e.g., daily or weekly): the latest labeled data accumulated is used to retrain or incrementally train the prediction model. The model updating process is as automated as possible, and does not require a large amount of manual intervention. When the new model is deployed after updating, the system will perform better in subsequent alarm filtering, achieving a virtuous cycle of self-improvement.

[0131] In some specific embodiments, after determining that the alarm data is target alarm data, the method further comprises:

[0132] When it is determined that the alarm data is target alarm data, relevant information corresponding to the feature vector of the alarm data is filtered in the pre-constructed security knowledge base, and an explanation description is generated according to the relevant information. For example, the alarm data is judged as high risk because its source IP has never accessed the server at night, the behavior is abnormal (high abnormal score), and the triggered attack features are consistent with known brute force behavior.

[0133] In some specific embodiments, the alarm data can be arranged according to priority and visualized, and can be filtered and aggregated according to time line, attack source, target asset, etc. to help analysts grasp the security situation in a macroscopic way. For alarms with high correlation, a correlation graph view can be provided to show the relationship between related alarm data. The embodiments of the present application improve the understandability of AI filtering results, so that analysts can clearly understand the origin and development of each alarm data.

[0134] The embodiments of the present application have the following technical effects:

[0135] 1. Higher detection accuracy and recall rate: through the joint action of calculating the abnormal score and calculating the prediction probability, the truly high-risk alarms can be found with a recall rate close to 100%, while maintaining high precision to exclude most false alarms. While ensuring that no key security events are missed, the probability of false positives is greatly reduced.

[0136] 2. False positives are significantly reduced, and the alarm load is reduced: the comprehensive filtering strategy greatly reduces the number of alarms presented to security personnel. Most irrelevant or low-risk alarms are filtered out in the automatic analysis stage, and it is estimated that more than 90% of alarms need to be manually reviewed. This reduces the burden on analysts, allowing them to focus on a small number of important alarms and speed up response.

[0137] Corresponding to the implementation of the above safety event determination method, the embodiments of the present application also provide a safety alarm priority determination device for executing the safety event determination method described in the above embodiments. As shown in Figure 3 the safety alarm priority determination device includes:

[0138] a data acquisition module for acquiring alarm data;

[0139] an anomaly score calculation module for calculating the deviation degree of the alarm data from normal alarm data to obtain an anomaly score; the normal alarm data refers to alarm data generated by an alarm system in a normal operating state within a normal range;

[0140] a prediction probability calculation module for calculating a prediction probability that the alarm data is real threat data according to a feature vector of the alarm data and a prediction model; the prediction model is obtained by training in a training process by assigning a first weight to majority class samples and a second weight to minority class samples; the first weight is less than the second weight; the minority class samples refer to alarm data marked as real threats, and the majority class samples refer to alarm data other than the minority class samples among all alarm data;

[0141] an event determination module for determining whether an event indicated by the alarm data is a safety event according to the anomaly score and the prediction probability.

[0142] Optionally, the device further includes a feature extraction module for extracting a plurality of feature information from the alarm data, the plurality of feature information including original feature information and derived feature information; wherein the original feature information includes at least one of alarm time, protocol type, port number and attack feature code; the derived feature information includes combined occurrence frequency and IP reputation score; for any feature information, the feature information is converted into numerical feature information, and a plurality of numerical feature information corresponding one-to-one to the plurality of feature information is combined to obtain the feature vector.

[0143] Optionally, the anomaly score calculation module is further configured to calculate, for any binary tree in a plurality of randomly generated binary trees, a path length of the feature vector of the alarm data in the binary tree; each binary tree is constructed by randomly selecting a fixed number of normal alarm data; calculate an average path length according to a plurality of path lengths corresponding one-to-one to the plurality of binary trees; and normalize the average path length to obtain the anomaly score.

[0144] Optionally, the model training is performed to obtain the prediction model through the following steps: obtaining training data, wherein the training data comprises the negative samples and the positive samples; the number of the negative samples is several times of the number of the positive samples; performing model training on an original model to obtain an initial model through the training data; the prediction probability of the initial model for the negative samples is higher than a preset threshold, and the prediction probability of the initial model for the positive samples is lower than the preset threshold; performing model training on the initial model through the preset loss function to obtain the prediction model; and the preset loss function is used to reduce the weight of the negative samples to improve the prediction probability of the initial model for the positive samples.

[0145] Optionally, the event determination module is further configured to calculate a priority score of the alarm data according to the anomaly score, a third weight corresponding to the anomaly score, the prediction probability, and a fourth weight corresponding to the prediction probability; a sum of the third weight and the fourth weight is 1; and determine whether the event indicated by the alarm data is a security event according to the priority score.

[0146] Optionally, the event determination module is further configured to determine a size relationship between the priority score and a score threshold; if the priority score is greater than the score threshold, determine the event indicated by the alarm data as the security event; and if the priority score is less than or equal to the score threshold, determine the event indicated by the alarm data as a non-security event.

[0147] Optionally, the apparatus further comprises a model optimization module configured to: filter at least one target alarm data from all alarm data; the priority score of the target alarm data is greater than the score threshold; send the at least one target alarm data to a user terminal; in response to feedback data of the user terminal, take artificial annotation information in the feedback data as model optimization data; and perform model optimization on the prediction model through the model optimization data.

[0148] The security alarm priority determination apparatus provided by the above embodiments of the present application and the security event determination method provided by the embodiments of the present application have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0149] The embodiments of the present application further provide a computer device for executing the above security event determination method. Please refer to Figure 4 which shows a schematic diagram of a computer device provided by some embodiments of the present application. As shown in FIG. 1, the computer device comprises a processor 10, a memory 20 and a communication interface 30. Figure 4As shown, the computer device 4 comprises a processor 400, a memory 401, a bus 402 and a communication interface 403, the processor 400, the communication interface 403 and the memory 401 are connected through the bus 402; the memory 401 stores a computer program which can run on the processor 400, and the processor 400 runs the computer program to execute the safety event determination method provided by any one of the preceding embodiments.

[0150] The memory 401 can include a high-speed Random Access Memory (RAM), and can also include a non-volatile memory such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 403 (which can be wired or wireless), and the Internet, a wide area network, a local area network, a metropolitan area network, etc. can be used.

[0151] The bus 402 can be an ISA bus, a PCI bus, an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 401 is used to store programs, and the processor 400 executes the programs after receiving execution instructions. The safety event determination method disclosed in any one of the preceding embodiments can be applied to the processor 400 or realized by the processor 400.

[0152] The processor 400 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by integrated logic circuits or instructions in the form of software in the processor 400. The processor 400 described above can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), a ready-to-program gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Each method, step and logic block disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is in the memory 401, and the processor 400 reads the information in the memory 401 and combines the hardware to complete the steps of the above method.

[0153] The computer device provided by the embodiments of the present application and the security event determination method provided by the embodiments of the present application are based on the same inventive concept, and have the same beneficial effects as the method adopted, run or implemented by the computer device.

[0154] The embodiments of the present application also provide a computer readable storage medium corresponding to the security event determination method provided by the preceding embodiments. Please refer to Figure 5 The computer readable storage medium shown in the figure is an optical disc 30, and a computer program (i.e. program product) is stored on the optical disc 30. When the computer program is run by a processor, the security event determination method provided by any of the preceding embodiments is executed.

[0155] It should be noted that examples of the computer readable storage medium can also include, but are not limited to, a phase change memory (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), other types of random access memory (RAM), a read only memory (ROM), an electrically erasable programmable read only memory (EEPROM), a flash memory or other optical, magnetic storage medium, which will not be described one by one here.

[0156] The computer readable storage medium provided by the above embodiments of the present application and the security event determination method provided by the embodiments of the present application are based on the same inventive concept, and have the same beneficial effects as the method adopted, run or implemented by the application program stored in the computer readable storage medium.

[0157] It should be noted that:

[0158] In the specification provided herein, a large number of specific details are described. However, it can be understood that the embodiments of the present application can be practiced without these specific details. In some examples, well-known structures and technologies are not described in detail in order not to obscure the understanding of the present specification.

[0159] Similarly, it should be understood that, in order to simplify the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, various features of the present application are sometimes grouped together in a single embodiment, figure or description thereof. However, this disclosure method should not be interpreted as reflecting the following schematic diagram: the claimed present application requires more features than the features explicitly recorded in each claim. More precisely, as reflected in the following claims, the inventive aspects are less than all the features of the preceding single embodiment. Therefore, the claims following the specific embodiments are hereby expressly incorporated into the specific embodiments, wherein each claim itself is a separate embodiment of the present application.

[0160] Furthermore, those skilled in the art will recognize that, in the following claims, the singular form "a" and "the" include plural references unless the context clearly dictates otherwise. As such, the claims following depend from claim 1 should be interpreted as including the plural forms as well.

[0161] The above description is only preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any changes or replacements within the technical scope disclosed by the present application can be easily thought by any person skilled in the art, and should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for determining a security incident, characterized in that, The method includes: Acquire alarm data; alarm data consists of raw alarm data from various security devices; The degree of deviation between the alarm data and normal alarm data is calculated to obtain an anomaly score; the normal alarm data refers to alarm data generated by the alarm system under normal operating conditions that falls within the normal range; The predicted probability that the alarm data is a real threat is calculated based on the feature vector of the alarm data and the prediction model. The prediction model is trained by assigning a first weight to the majority class samples and a second weight to the minority class samples during the training process. The first weight is less than the second weight. The minority class samples refer to alarm data marked as real threats, and the majority class samples refer to alarm data other than the minority class samples. The feature vector of the alarm data is generated from multiple feature information in the alarm data. The multiple feature information includes original feature information and derived feature information. The original feature information includes at least one of alarm time, protocol type, port number, and attack signature. The derived feature information includes combination occurrence frequency and IP reputation score. The anomaly score and the predicted probability are used to determine whether the event indicated by the alarm data is a security event.

2. The method according to claim 1, characterized in that, After acquiring the alarm data, the method further includes: Extract multiple feature information from the alarm data; For any given feature information, the feature information is transformed into numerical feature information, and multiple numerical feature information corresponding one-to-one with the multiple feature information are combined to obtain the feature vector.

3. The method according to claim 1 or 2, characterized in that, The degree of deviation between the alarm data and normal alarm data is calculated to obtain an anomaly score, including: For any binary tree among multiple binary trees, calculate the path length of the feature vector of the alarm data in the binary tree; each binary tree is constructed by randomly selecting a fixed number of normal alarm data. Calculate the average path length based on the multiple path lengths that correspond one-to-one with the multiple binary trees; The anomaly score is obtained by normalizing the average path length.

4. The method according to claim 1 or 2, characterized in that, The majority class samples are negative samples, and the minority class samples are positive samples; The prediction model is obtained by training the model through the following steps: Acquire training data, which includes the negative samples and the positive samples; the number of negative samples is a multiple of the number of positive samples. An initial model is obtained by training the original model using the training data; the initial model's prediction probability for the negative sample is higher than a preset threshold, and the initial model's prediction probability for the positive sample is lower than the preset threshold. The prediction model is obtained by training the initial model using a preset loss function; the preset loss function is used to reduce the weight of the negative samples in order to improve the prediction probability of the positive samples by the initial model.

5. The method according to claim 1 or 2, characterized in that, Determining whether the event indicated by the alarm data is a security event based on the anomaly score and the predicted probability includes: The priority score of the alarm data is calculated based on the anomaly score, the third weight corresponding to the anomaly score, the prediction probability, and the fourth weight corresponding to the prediction probability; the sum of the weights of the third weight and the fourth weight is 1. The priority score determines whether the event indicated by the alarm data is a security event.

6. The method according to claim 5, characterized in that, Determining whether the event indicated by the alarm data is a security event based on the priority score includes: Determine the relationship between the priority score and the score threshold; If the priority score is greater than the score threshold, the event indicated by the alarm data is identified as the security event. If the priority score is less than or equal to the score threshold, the event indicated by the alarm data is determined to be a non-security event.

7. The method according to claim 6, characterized in that, The method further includes: At least one target alarm data point is selected from all alarm data; the priority score of the target alarm data point is greater than the score threshold. Send the at least one target alarm data to the user terminal; In response to the feedback data from the user terminal, the manually labeled information in the feedback data is used as model optimization data; The prediction model is optimized using the model optimization data.

8. A security alarm priority determination device, characterized in that, The device includes: The data acquisition module is used to acquire alarm data; the alarm data is the raw alarm data of various security devices. The anomaly score calculation module is used to calculate the degree of deviation between the alarm data and the normal alarm data to obtain an anomaly score; the normal alarm data refers to the alarm data generated by the alarm system under normal operating conditions that conforms to the normal range; The prediction probability calculation module is used to calculate the predicted probability that the alarm data is real threat data based on the feature vector of the alarm data and the prediction model. The prediction model is trained by assigning a first weight to the majority class samples and a second weight to the minority class samples during the training process. The first weight is less than the second weight. The minority class samples refer to alarm data marked as real threats, and the majority class samples refer to alarm data other than the minority class samples among all alarm data. The feature vector of the alarm data is generated from multiple feature information in the alarm data. The multiple feature information includes original feature information and derived feature information. The original feature information includes at least one of alarm time, protocol type, port number, and attack signature. The derived feature information includes combination occurrence frequency and IP reputation score. The event determination module is used to determine whether the event indicated by the alarm data is a security event based on the anomaly score and the predicted probability.

9. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory storing computer instructions, and the processor executing the computer instructions to perform the security event determination method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the security event determination method according to any one of claims 1 to 7.

Images