Automatic alarm disposal method, system and related device based on threat mode recommendation

Abstract

The invention provides an alarm automatic processing method and system based on threat mode recommendation, and a related device. The method comprises the following steps: step 1, constructing an alarm association diagram by using obtained alarm data; 2, performing community detection on the alarm association graph by adopting a graph division algorithm to obtain a plurality of security events; 3, matching the obtained multiple security events with a pre-constructed mode knowledge base to obtain a risk level and disposal information corresponding to the alarm data, and completing alarm automatic disposal; according to the method, the alarm association efficiency, the threat identification accuracy and the automatic disposal capability are remarkably improved, the problems of weak alarm association, rigid disposal strategy and high manual intervention cost in a traditional method are effectively solved, and the method is suitable for enterprise-level network security operation scenes.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to an automatic alarm handling method, system and related devices based on threat pattern recommendation. Background Art

[0002] As cyberattacks become more diverse and complex, the number of alerts generated by traditional network security systems is growing exponentially. For example, a large enterprise generates tens of thousands of alerts daily, but a large number of these alerts are repetitive or low-risk events, leading to severe "alert fatigue" for security operations personnel. Existing alert correlation methods often rely on rule engines or simple statistical analysis, which struggle to effectively capture the topological characteristics of complex attack chains and lack adaptability to unknown threats. Furthermore, existing automated response solutions often rely on predefined policies and lack a deep understanding of alert semantics, resulting in insufficient interpretability and accuracy of response strategies.

[0003] Therefore, the existing technology mainly has the following deficiencies: Current network security operations urgently need an automated handling method that can combine statistical analysis and deep learning technology to achieve security incident threat pattern modeling and dynamic matching, so as to reduce the cost of manual intervention and improve the efficiency of threat identification and handling. Summary of the Invention

[0004] The purpose of the present invention is to provide a method, system and related devices for automatic alarm handling based on threat pattern recommendation to address the above-mentioned deficiencies in the prior art. The present invention realizes intelligent association, threat identification and automatic handling of alarms by constructing a threat pattern knowledge base of security events, thereby improving the efficiency and accuracy of security operations.

[0005] In order to achieve the above object, the technical solution adopted in the present invention is: In a first aspect, the present invention provides an automated alarm handling method based on threat pattern recommendation, comprising the following steps: Step 1: Use the acquired alarm data to construct an alarm correlation graph; Step 2: Use a graph partitioning algorithm to perform community detection on the alarm association graph to obtain multiple security events; Step 3: Match the multiple security events obtained with the pre-built pattern knowledge base respectively to obtain the risk level and handling information corresponding to the alarm data, and complete the automatic alarm handling.

[0006] Preferably, in step 1, the alarm association graph is constructed using the acquired alarm data, and the specific method is: Perform sub-segment standardization on the obtained alarm data to obtain unified sub-segment data information; Perform semantic merging on the obtained unified sub-segment data information to obtain merged data information; The merged data information is used to construct an alarm correlation diagram.

[0007] Preferably, in step 4, the method for constructing the pre-built pattern knowledge base is: S41, constructing an alarm correlation graph using the acquired historical original alarm data; S42, using a graph partitioning algorithm to perform community detection on the alarm association graph to obtain multiple security events; S43, using statistical methods and graph neural networks to extract threat patterns for each security incident and generate corresponding basic patterns and detailed patterns; S44, generates pattern clusters based on basic patterns and detailed patterns, and obtains a pre-constructed pattern knowledge base through manual analysis method.

[0008] Preferably, in S43, the basic model includes the number of central nodes, central node asset types, non-central node asset types and anomaly category set.

[0009] Preferably, in S44, a pattern cluster is generated based on the basic pattern and the detail pattern, and the specific method is: Divide security events according to their basic patterns to obtain multiple security event subsets; Deleting a security event subset whose number of security events is less than a preset threshold from the multiple security event subsets to obtain a remaining security event subset; Cluster the detail patterns corresponding to the security events in each remaining security event subset to generate pattern clusters.

[0010] Preferably, in step 3, the obtained multiple security events are matched with the pre-built pattern knowledge base respectively to obtain the risk level and handling information corresponding to the alarm data. The specific method is: The obtained multiple security events are incrementally clustered with the pattern clusters in the pre-built pattern knowledge base to match the known pattern clusters, where: If the match is successful, the risk level and handling information corresponding to the alarm data are obtained; If the matching is unsuccessful, the multiple security events obtained are processed using a manual analysis method to obtain the risk level and handling information corresponding to the alarm data.

[0011] In a second aspect, the present invention provides an automatic alarm handling system based on threat pattern recommendation, comprising: A correlation diagram acquisition unit, configured to construct an alarm correlation diagram using the acquired alarm data; A security event acquisition unit is used to perform community detection on the alarm association graph using a graph partitioning algorithm to obtain multiple security events; The automatic alarm handling unit is used to match the multiple security events obtained with the pre-built pattern knowledge base, obtain the risk level and handling information corresponding to the alarm data, and complete the automatic alarm handling.

[0012] In a third aspect, the present invention provides an electronic device comprising a processor and a memory, wherein the memory stores computer instructions, and when the computer instructions are executed by the processor, the electronic device executes the described method.

[0013] In a fourth aspect, the present invention provides a computer program product, which includes computer-executable instructions, and the computer-executable instructions implement the method when executed.

[0014] In a fifth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions implement the described method when executed by a processor.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides an automatic alarm handling method based on threat pattern recommendation. By constructing an alarm association graph and applying a community detection algorithm, it can capture the topological characteristics of the attack chain; compared with traditional rule engines, it improves the complex attack association discovery rate by more than 60% (experimental data) and can identify multi-stage associated behaviors in APT attacks; the collaborative application of graph neural networks (GNN) and community detection makes the attack scenario restoration accuracy reach 89.7%; at the same time, the threat pattern of security incidents is divided into basic patterns and detailed patterns, and combined with statistical analysis and graph neural network (GNN) technology, a threat pattern vector with semantic information is generated, and automatic alarm handling is achieved through pattern matching. The present invention significantly improves the alarm association efficiency, threat identification accuracy and automatic handling capabilities, effectively solving the problems of weak alarm association, rigid handling strategies and high manual intervention costs in traditional methods, and is suitable for enterprise-level network security operation scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a flow chart of an embodiment of the present invention; Figure 2 Schematic diagram of 13 three-node subgraphs; Figure 3 A method framework for generating detailed patterns based on GNN; Figure 4 A framework for GNN training strategies. DETAILED DESCRIPTION

[0017] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0018] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0019] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0020] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0021] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0022] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0023] Example 1 The core idea of ​​this application is to divide the threat patterns of security incidents into basic patterns and detailed patterns, combine statistical analysis with graph neural network (GNN) technology to generate threat pattern vectors with semantic information, and realize automatic handling of alarms through pattern matching. The specific technical solution includes the following steps: Step 1: Preprocess the historical raw alarm data, model the hosts corresponding to the IP addresses as graph nodes, model the merged raw alarm data as directed edges with attributes, and construct an alarm association graph; Step 2: Use a graph partitioning algorithm to perform community detection on the alarm association graph and identify each subcommunity as a security incident; Step 3: Extract the threat pattern of each security incident using statistical methods and graph neural networks (GNNs) to generate corresponding basic and detailed patterns. Step 4: Generate pattern clusters based on threat patterns, build a pattern knowledge base through the manual analysis phase, and match new security events to the pattern knowledge base in the automatic handling phase to recommend handling strategies and realize automated alarm handling.

[0024] Example 2 Based on Example 1, this embodiment provides an automatic alarm handling method based on threat pattern recommendation. In step 1, alarm preprocessing includes the following steps: Field standardization: extract the timestamp, source IP address, destination IP address, destination port, protocol, exception category, priority, and the number of merged alarms (warn_num) from the original alarm as unified fields; Semantic merging: Merges alarms with identical source IP, destination IP, destination port, protocol, rule ID, exception category, and priority within the same time window.

[0025] In step 2, the graph partitioning algorithm includes the following steps: Based on the topological structure and node / edge attributes of the alarm correlation graph, the alarm correlation graph is divided into multiple sub-communities through a graph partitioning algorithm, and each sub-community corresponds to a security event.

[0026] In step 3, the threat pattern of each security event is extracted through statistical methods. The specific process of generating the basic pattern includes the following steps: The basic model includes the number of central nodes, the set of central node asset types, the set of non-central node asset types, the topology type, and the set of anomaly categories, where: Number of central nodes: count each security event The number of nodes that meet the condition high_degree_label = 1. Among them, high_degree_label represents the central node set, and the central node set is obtained as follows: First, each security incident The degrees of all nodes in the are arranged in descending order; Accumulate the degrees of the nodes in the arrangement one by one until the sum of the accumulated degrees reaches or exceeds 50% of the sum of the degrees of all nodes in the graph; The nodes that meet the conditions are grouped into a central node set high_degree_label, and the number of nodes in the central node set is determined.

[0027] Central node asset type collection: collects each security event The ip_label of all nodes with high_degree_label=1 (such as DNS servers, file servers, etc.).

[0028] Non-central node asset type collection: collects every security event The ip_label of all nodes with high_degree_label=0.

[0029] Topology type (topo_type): If (i.e. the security event only contains two nodes), then define topo_type as "simple"; if , then each security event is calculated based on the FANMOD algorithm The proportion distribution of 13 three-node subgraphs (motifs) in the graph, and whether the proportion exceeds the preset threshold Determine the topology type. The proportion of three-node subgraphs of type 1 to type 5> When , they correspond to "divergent type", "convergent type", "weak divergent type", "weak convergent type" and "bidirectional type" respectively, and other cases are defined as "other types". Anomaly category collection (category): collects each security event The category (abnormal category) of all alarms in the group. If the cardinality of the set is greater than 3, it is marked as "multi-category".

[0030] In step 3, the threat pattern of each security event is extracted through the graph neural network. The specific method of generating the detailed pattern includes the following steps: Graph Neural Network Architecture: This uses the GraphGPS framework to fuse edge features with node position encoding and generate embedding vectors for security events through a global attention mechanism. Position encoding: Generate node position encoding based on random walk and project it into node feature space through feedforward neural network; Message propagation: The improved GINE module and graph transformer module are used to aggregate multi-hop neighbor features to alleviate the over-smoothing problem. Graph-level readout: Node features are aggregated through a global attention mechanism, and graph-level features are concatenated to generate the final embedding vector.

[0031] In step 4, the specific method of generating the pattern cluster includes the following steps: Basic pattern grouping: preliminary grouping of security events according to basic patterns, eliminating groups with event numbers below the set threshold; Detail pattern clustering: The DBSCAN density clustering algorithm is used to generate pattern clusters for the detail pattern embedding vectors of each group of events; Construction of pattern knowledge base: Through the manual analysis phase, the pattern cluster is calibrated with risk levels (such as low risk, medium risk, and high risk) and treatment strategies are marked (such as filtering false positives, isolating hosts, and triggering defense rules).

[0032] The manual analysis phase in Step 4 includes the following steps: Sampling and calibration: N security events (N ≥ 3) are randomly sampled from each pattern cluster, and security analysts evaluate their risk levels and handling strategies. Consistency check: If there is a conflict in the risk level or handling strategy of the sampling event, the entire pattern cluster will be marked for manual review; Knowledge base update: The calibration results are stored in the pattern knowledge base, and the calibration timestamp and analyst ID are recorded.

[0033] The automatic disposal phase in step 4 includes the following steps: Pattern matching: Matches the threat pattern of a new security event with pattern clusters in the pattern knowledge base.

[0034] Disposal strategy recommendation: If a match is successful, the disposal strategy for the corresponding pattern cluster will be recommended; if no match is found, the event will be marked as an unknown threat and pushed to the manual analysis queue.

[0035] Example 2 Figure 1 The automatic alarm handling method based on threat pattern recommendation and the overall system flow chart proposed in this application demonstrate the basic framework of this method for alarm data correlation analysis in the industrial Internet scenario.

[0036] Step 1: Alarm preprocessing and graph construction.

[0037] The alarm data fields generated by different security devices are heterogeneous and diverse, and there are many semantically duplicated alarms (for example, multiple password attempts triggering multiple "brute force cracking" alarms). Therefore, the alarm data format is unified and semantically duplicated alarms are merged.

[0038] Table 1. Examples of the main fields of Snort 3.1.18 alarms. The bold fields are the alarm fields used in this invention.

[0039] First, we standardized the data fields of all alerts, referring to the alert fields of mainstream open-source network intrusion detection systems (such as Snort and Suricata). For example, an alert generated by Snort 3.1.18 contains 44 fields in JSON format. The main data fields are shown in Table 1. The semantic information contained in these data fields can be divided into three categories: 1) Information about network activity, including timestamp, source IP address (src_addr), destination IP address (dst_addr), and protocol (proto); 2) Information about active traffic, including packet length (pkt_len), packet number (pkt_num), TCP sequence number (tcp_seq), and TCP window size (tcp_win); 3) The exception information for which the IDS generates an alert includes the matching rule ID (rule), exception category (category), exception message (message), etc.

[0040] This application selects a subset of Snort 3.1.18 data fields (i.e., the fields highlighted in Table 1) to unify the data format of all alerts. The information contained in this subset is essential for alert analysis and is already provided in most security devices.

[0041] Secondly, for timestamps in the same time window If all the alarm fields (src_addr, dst_addr, dst_port, proto, rule, category, priority) have the same value, they are merged to reduce duplicate alarms. The number of merged alarms is represented by warn_num. Ultimately, the data fields of all alarms are unified into (timestamp, src_addr, dst_addr, dst_port, proto, rule, category, priority, warn_num).

[0042] The IP addresses involved in the alarm are interconnected and naturally form a network. In order to deeply explore the correlation between alarms, the alarms are modeled and an alarm correlation graph is generated. Specifically, the alarms in the same time window are modeled as a directed attribute graph. , called the alarm correlation diagram.

[0043] Definition 1 (Alarm Association Diagram ): The alarm correlation diagram is a time window The directed attribute graph formed by the alarms in .node It is a unique IP address during this period, indicating that there is a suspected attacker or potential victim in the network. Indicates the source IP address (src_addr) to the destination IP address Because the destination ports, anomaly categories, and other characteristics may be different, there may be multiple edges between two nodes, each representing a specific type of network activity. and denote the node and edge feature matrices respectively, Represents graph-level features.

[0044] Step 2: Security event reconstruction based on graph partitioning.

[0045] In a time window Alerts within a security incident often contain multiple unrelated security events, meaning the alarm correlation graph incorporates multiple security events. Alerts belonging to the same security incident are closely connected, while alerts from other incidents are loosely connected. This creates a clear community structure on the alarm correlation graph. We use a graph partitioning algorithm to group alerts belonging to the same security incident into a community, enabling decoupling and recovery of security incidents.

[0046] Definition 2 (Security Incident ): Security incident In the alarm correlation diagram The subgraph (community) generated by the graph partitioning algorithm above contains the contextual information of a single security incident and is the meta-unit for subsequent analysis.

[0047] Step 3: Generate security event threat patterns based on multi-dimensional representation.

[0048] In order to fully characterize the key information of security incidents, the security incident model is constructed from two dimensions. On the one hand, from the perspective of security incidents The basic pattern is generated by extracting statistical features from the topological structure and node / edge features of the network. For example, topological features such as degree distribution can reflect key hosts (such as nodes with high degrees) and the complexity of attacks (such as single-source attacks or multi-source attacks). After classification and discretization, these statistical features intuitively describe the key information of security events and serve as the basic pattern of security events. On the other hand, the embedding vector of security events is generated through graph neural networks. , to capture complex contextual features that cannot be extracted by statistics. Ultimately, the pattern of security events is generated by concatenating basic patterns and detailed patterns, and its specific definition is as follows: Definition 3 (Threat Model of Security Incidents ): The threat pattern of a security incident is a vector with semantic information, representing the key information of the security incident, and is defined as: .

[0049] Step 3-1: Basic pattern generation based on statistical methods Security incidents It is a subgraph composed of alarms, whose main features are directly derived from the alarm attributes or their statistical information, as shown in Table 2. The basic pattern is obtained by transforming these features and provides information about security events. The edge-level features come directly from the alarm attributes, and only the node-level and graph-level features are explained here. Features include and ,in Represents The asset type of the corresponding host, Characterization In security incidents Does it have a significant degree of proportion? , it means It is a highly ranked node. Security incident All Nodes are also called central nodes, which play a vital role in network connectivity and information dissemination. At the graph level, features include the number of central nodes And the distribution of the 13 three-section sub-graphs in the figure Motifs are specific connection patterns in complex graphs. Motifs can reveal the topological and connection characteristics of graphs. We use the FANMOD algorithm to mine 13 three-node subgraphs (such as Figure 2 and calculated their The percentage in If the proportion of subgraphs from type 1 to type 5 is greater than , then the security event is defined as the corresponding topology type, otherwise it is defined as other types. "Divergence" and "convergence" are the weakened (or generalized) forms of divergence and convergence respectively.

[0050] Table 2 Security incidents characteristics.

[0051]

[0052] Security incidents The basic model of comes from the discretization and classification of the above features, which is specifically defined as: .in, express The number of central nodes, and These central nodes correspond to A collection of . Corresponding to non-central nodes A collection of . Describes the security incident The topology type. If There are only two nodes, namely , then the topology type is defined as simple. , it is determined according to the distribution ratio of the three-node subgraph. Figure 2 As shown, if the proportion of three-node subgraphs from type 1 to type 5 is greater than the threshold , They correspond to "divergent", "convergent", "weakly divergent", "weakly convergent" and "bidirectional". Otherwise Meaning other types. yes The set of all alarm exception categories in the . If the cardinality of this set exceeds 3, it is defined as multi-category. The basic pattern roughly describes the security event The topological structure (such as the number of central nodes, attack direction, etc.) and important attributes (such as the asset type involved in the incident, attack type, etc.) provide basic information on security incidents.

[0053] Step 3-2: Detailed pattern generation based on graph neural network Since deep learning methods have the advantage of being able to recognize complex and subtle pattern information, we embed security events based on graph neural networks. , which aims to generate detailed patterns of security events. Figure 3 As shown, security incidents The embedding process mainly includes three sub-steps: input, GraphGPS layer message propagation and graph-level readout based on the attention mechanism.

[0054] Security incidents Include node features , edge features and graph-level features , as the input of GNN. In addition, since the designed GNN contains a transformer module, in order to enable it to perceive the positional relationship between nodes, the position encoding of the nodes is generated based on random walks. Then, the position encoding Projected into the node feature space and combined with the node feature Concatenation, merges position information into node features.

[0055]

[0056] in, are learnable parameters implemented via a feedforward neural network, Represents the concatenation operation of two vectors, It represents the node features after combining position encoding, which is the input of subsequent GNN.

[0057] Then, the security incident The input is a GNN convolutional layer designed based on the GraphGPS framework, which performs message propagation and node update, integrating the node neighborhood topology and feature information into the new node state. Most traditional GNNs (such as GCN and GAT) are designed for node-centric tasks. They only consider node features during message propagation and ignore edge features. However, in security incidents, In the case of edge-based models, edges contain important alarm attribute information (such as destination port and anomaly category) that cannot be ignored. Furthermore, traditional GNNs suffer from a serious over-smoothing problem, which prevents deep stacking of GNN convolutional layers and limits the model's capacity and capabilities. Therefore, a convolutional layer based on the GraphGPS framework was designed. This layer combines the edge-sensitive GINE module with the graph transformer module, which mitigates the over-smoothing problem. Specifically, the computational process of this GNN convolutional layer is as follows:

[0058] in, For nodes go through The state of the layer GraphGPS after convolution operation, . is a node The set of first-order neighbor nodes. and Both are learnable parameters, which are achieved by constructing two independent feedforward neural networks.

[0059] Finally, after After the GraphGPS convolution operation of the layer, the global attention mechanism is used to aggregate the information of all nodes in the graph, and the embedding vector of the security event is generated by combining the graph level features. The security events generated from the alarm correlation graph are not always perfect. Some may include irrelevant nodes, and the impact of different nodes in the security event is inconsistent. Therefore, an attention mechanism is used to assign weights to different nodes to measure their impact, and irrelevant nodes are filtered out in the readout phase. Specifically, the calculation process in the readout phase is as follows:

[0060] in, They correspond to the query vector, key vector, and value vector in the attention mechanism respectively. Specifically, and is a learnable parameter. Used to calculate the attention coefficient, measure the relevance of the node to the current task, and filter out irrelevant information. The last layer node state Project to a suitable feature space to read out better embedding vectors. Represents the Hadamard product, and the softmax function normalizes the attention coefficient. Through node update and global aggregation, It contains node features, edge features, and graph structure information of security events, but still lacks graph-level features. Therefore, the graph-level features Project to The feature space is concatenated to generate the final security event embedding vector :

[0061] in, is a learnable parameter implemented through a feedforward neural network.

[0062] In the security field, obtaining high-quality labeled samples is not easy. To reduce the dependence on a large number of labeled samples, this paper adopts a pre-training and fine-tuning (P&F) strategy to train GNN. In the pre-training stage, we use the contrastive learning paradigm to perform self-supervised training on the GNN model. The learning goal of contrastive learning is to maximize the positive sample pair The consistency of the negative sample is minimized In the fine-tuning stage, the pre-trained parameters are used as the initial parameters of GNN, and then the supervised learning task is used to fine-tune the model. The overall strategy framework is as follows: Figure 4 shown.

[0063] Step 4: Automatically handle alerts based on threat pattern recommendations.

[0064] Many security incidents triggered by the same cause don't just occur once, but often recur in a fixed pattern. Therefore, the present invention aggregates security incidents with the same pattern for batch processing. In reality, even security incidents triggered by the same cause may have subtle differences in their patterns, such as "Attacker A launched 10 port scans on Target B" versus "Attacker A launched 11 port scans on Target B." Therefore, we broaden the definition of "having the same pattern" to "same basic pattern, similar detailed patterns."

[0065] Definition 4 (Pattern Cluster ): Mode Cluster It is a collection of security events, each pattern cluster The incidents in share the same threat pattern.

[0066] Step 4-1: Generate pattern clusters.

[0067] In the specific implementation process, firstly, the events are divided according to the basic pattern of security events, and the events with the same basic pattern are grouped together. In order to exclude patterns with low frequency and insufficient statistical significance, a threshold is set to include events with less than 100 security events. Then, within each group, the detailed patterns of security events are analyzed. Perform clustering to generate pattern clusters To achieve fine-grained clustering, the present invention adopts a density clustering algorithm, DBSCAN (Density-Based Spatial Clustering of Applications with Noise). The DBSCAN algorithm sets the radius parameter and the minimum number of samples ( ), density evaluation of sample points is performed in the security event embedding space, high-density areas are divided into clusters, and noise data is effectively identified to ensure that the security events in the clustering results share similar pattern features.

[0068] After generating pattern clusters, the alarm handling process is further divided into two stages: manual analysis and automatic handling. In the manual analysis stage, a small number of representative security events in each pattern cluster are sampled and calibrated to build a pattern knowledge base and introduce prior knowledge. In the automatic handling stage, newly arrived alarms are reconstructed as security events, and based on the matching results with known patterns in the pattern knowledge base, corresponding event descriptions and handling strategies are automatically recommended, thereby achieving explainable and automated handling of alarms.

[0069] Step 4-2: Manual analysis phase: In this phase, we incorporate a small amount of expert knowledge to calibrate pattern clusters To build the initial pattern knowledge base, we need to collect risk level and treatment information from each Specifically, security analysts sample multiple security events from each Sampling without replacement The system analyzes each security incident. If their patterns are identical, the entire cluster is directly calibrated, including pattern descriptions and corresponding remediation methods. If security incidents of varying risk levels are discovered during the sampling process, all security incidents within that pattern cluster are handed over to security analysts for processing. The results of manual analysis are stored in a pattern knowledge base, providing a foundation for the subsequent automated remediation phase.

[0070] Step 4-3: Automatic disposal phase: During this phase, the initial pattern knowledge base built during the manual analysis phase is used to automatically recommend risk levels and action information for security incidents. Specifically, newly received alerts are reconstructed into security incidents and then incrementally clustered against known pattern clusters in the pattern knowledge base to match them. If a match is found, the corresponding risk level and action information are automatically retrieved, and response actions are executed based on the recommended action strategy, such as filtering false positives, reporting high-risk hosts, or triggering other predefined defensive measures. If a match is not found with a known pattern cluster, the security incident is temporarily stored and awaits the arrival of subsequent alerts to form new pattern clusters. During this process, security analysts can configure a maximum waiting time, which can be adjusted to balance response speed and pattern learning accuracy. If no match is found with an existing pattern cluster within the set waiting time, and no new pattern cluster is formed, the security incident is treated as an unknown emergency incident and prioritized for human operators. This process ensures accuracy and timeliness while reducing false positives and effectively responding to new and unknown threat patterns.

[0071] Example 3 The automatic alarm handling system based on threat pattern recommendation provided in this embodiment includes: A correlation diagram acquisition unit, configured to construct an alarm correlation diagram using the acquired alarm data; A security event acquisition unit is used to perform community detection on the alarm association graph using a graph partitioning algorithm to obtain multiple security events; The automatic alarm handling unit is used to match the multiple security events obtained with the pre-built pattern knowledge base, obtain the risk level and handling information corresponding to the alarm data, and complete the automatic alarm handling.

[0072] Example 4 This embodiment also provides a computing device. The computing device includes a bus, a processor, a memory, and a communication interface. The processor, the memory, and the communication interface communicate with each other via the bus. The computing device can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device.

[0073] A bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, control buses, and so on. For ease of presentation, a bus can include the pathways that transmit information between various components of a computing device (e.g., memory, processor, and communication interfaces).

[0074] The processor may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a tensor processing unit (TPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a microprocessor (MP), or a digital signal processor (DSP).

[0075] The memory may include volatile memory, such as random access memory (RAM). The processor may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0076] The memory stores executable program code, which the processor executes to implement the functions of the first generation module, the second generation module, and the adjustment module, respectively, thereby implementing, for example, the method. That is, the memory may store instructions for the methods and functions of the computing device described in any of the above embodiments.

[0077] The communication interface uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device and other devices or a communication network.

[0078] Example 5 This embodiment further provides a computer-readable storage medium having computer instructions stored thereon. When a processor executes the instructions, the processor executes the methods and functions related to the computing device in any of the above embodiments.

[0079] In general, various embodiments of the present disclosure may be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other pictorial representation, it should be understood that the blocks, devices, systems, techniques, or methods described herein may be implemented as, by way of non-limiting example, hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or a controller or other computing device, or some combination thereof.

[0080] Example 6 The present embodiment provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which are executed in a device on a real or virtual processor of a target to perform the process / method described above with reference to the accompanying drawings. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or divided between program modules as needed. The machine-executable instructions for the program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0081] The computer program code for implementing the disclosed method can be written in one or more programming languages. These computer program codes can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device so that the program code, when executed by the computer or other programmable data processing device, causes the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on a computer, partially on a computer, as an independent software package, partially on a computer and partially on a remote computer or entirely on a remote computer or server.

[0082] In the context of the present disclosure, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like. Examples of signals may include electrical, optical, radio, acoustic, or other forms of propagated signals, such as carrier waves, infrared signals, and the like.

[0083] A computer-readable medium may be any tangible medium containing or storing a program for or relating to an instruction execution system, apparatus, or device, or a data storage device such as a data center containing one or more available media. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of computer-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0084] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. The automatic alarm handling method based on threat pattern recommendation is characterized by: The following steps are involved: Step 1: Use the acquired alarm data to construct an alarm correlation graph; Step 2: Use a graph partitioning algorithm to perform community detection on the alarm association graph to obtain multiple security events; Step 3: Match the multiple security events obtained with the pre-built pattern knowledge base respectively to obtain the risk level and handling information corresponding to the alarm data, and complete the automatic alarm handling.

2. The method for automatically handling alarms based on threat pattern recommendation according to claim 1, characterized in that: In step 1, the alarm correlation diagram is constructed using the acquired alarm data. The specific method is: Perform sub-segment standardization on the obtained alarm data to obtain unified sub-segment data information; Perform semantic merging on the obtained unified sub-segment data information to obtain merged data information; The merged data information is used to construct an alarm correlation diagram.

3. The automatic alarm handling method based on threat pattern recommendation according to claim 1 is characterized in that: In step 4, the pre-built pattern knowledge base is constructed as follows: S41, constructing an alarm correlation graph using the acquired historical original alarm data; S42, using a graph partitioning algorithm to perform community detection on the alarm association graph to obtain multiple security events; S43, using statistical methods and graph neural networks to extract threat patterns for each security incident and generate corresponding basic patterns and detailed patterns; S44, generates pattern clusters based on basic patterns and detailed patterns, and obtains a pre-constructed pattern knowledge base through manual analysis method.

4. The method for automatically handling alarms based on threat pattern recommendation according to claim 3, characterized in that: In S43, the basic model includes the number of central nodes, central node asset types, non-central node asset types and anomaly category set.

5. The method for automatic alarm handling based on threat pattern recommendation according to claim 3 is characterized in that: In S44, a pattern cluster is generated based on the basic pattern and the detail pattern. The specific method is: Divide security events according to their basic patterns to obtain multiple security event subsets; Deleting a security event subset whose number of security events is less than a preset threshold from the multiple security event subsets to obtain a remaining security event subset; Cluster the detail patterns corresponding to the security events in each remaining security event subset to generate pattern clusters.

6. The method for automatic alarm handling based on threat pattern recommendation according to claim 1, characterized in that: In step 3, the obtained multiple security events are matched with the pre-built pattern knowledge base to obtain the risk level and disposal information corresponding to the alarm data. The specific method is: The obtained multiple security events are incrementally clustered with the pattern clusters in the pre-built pattern knowledge base to match the known pattern clusters, where: If the match is successful, the risk level and handling information corresponding to the alarm data are obtained; If the matching is unsuccessful, the multiple security events obtained are processed using a manual analysis method to obtain the risk level and handling information corresponding to the alarm data.

7. The automatic alarm handling system based on threat pattern recommendation is characterized by: include: A correlation diagram acquisition unit, configured to construct an alarm correlation diagram using the acquired alarm data; A security event acquisition unit is used to perform community detection on the alarm association graph using a graph partitioning algorithm to obtain multiple security events; The automatic alarm handling unit is used to match the multiple security events obtained with the pre-built pattern knowledge base, obtain the risk level and handling information corresponding to the alarm data, and complete the automatic alarm handling.

8. An electronic device, characterized in that: The electronic device comprises a processor and a memory, wherein computer instructions are stored in the memory. When the computer instructions are executed by the processor, the electronic device executes the method according to any one of claims 1 to 6.

9. A computer program product, characterized in that The computer program product contains computer-executable instructions, which implement the method according to any one of claims 1 to 6 when executed.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 6.

Images