False alarm detection method and device for network attack alarm, equipment and medium

Abstract

The invention discloses a false alarm detection method and device for network attack alarm, equipment and a medium, and relates to the field of network security, and the method comprises the steps: constructing a target list corresponding to different log types under each preset time sequence analysis granularity in each time period based on to-be-detected alarm log data of a plurality of time periods in historical data; the target list comprises a target attack time and an attack IP; if the log types and / or attacked IPs are different, the log types are different; constructing three time sequences of each target list, and calculating sequence periods respectively corresponding to the three time sequences; the three time sequences are a log quantity time sequence, an attack IP type time sequence and an attack IP information entropy time sequence; and if the periods of the three sequences are consistent and meet a preset reasonable rule and the attack IP type number of the log type corresponding to the target list meets a type number limiting rule, determining that the alarm log of the log type is a false alarm. The accuracy can be ensured while the false alarm detection efficiency is improved and the cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a false alarm detection method, device, equipment and medium for network attack alarms. Background Art

[0002] The false alarm rate is an important indicator for measuring the quality of intrusion detection systems in the field of network security. False alarm network attack alerts not only consume resources and time to process, but also reduce security analysts' sensitivity to attacks, distracting their attention from dealing with real security threats. Effectively reducing the false alarm rate is a hot issue.

[0003] Mainstream false alarm detection methods for network attack alarms mainly include context-based and correlation-based. Feature-based detection schemes distinguish false alarms by learning and modeling characteristic attributes such as alarm time, alarm source, alarm stage, alarm quantity, alarm severity, and attack IP (Internet Protocol) information contained in the alarm log itself. Context-based detection schemes reduce false alarms by incorporating network context information (such as session status) into the original detection. Correlation-based detection schemes conduct comprehensive analysis and processing of security information from multiple sources such as alarm logs, raw traffic logs, vulnerability information, and threat intelligence.

[0004] However, the false alarm detection method for network attack alarms based on features uses a machine learning algorithm model to learn features, thereby distinguishing false alarm information from correct attacks. However, the accuracy of the detection results has high requirements on multiple factors such as model fitness, algorithm parameters, and sample quality. It is difficult to quickly achieve good results in a practical environment and requires multiple rounds of iterative operations such as parameter adjustment and training. Although the false alarm detection method for network attack alarms based on context can integrate network context information during the detection process, different types of alarms require different context information, and different detection engines also have different alarm types, making it difficult to build a comprehensive detection solution. The false alarm detection method for network attack alarms based on correlation can improve the accuracy of detection results by introducing exogenous information, but it also faces the technical difficulties of multi-source heterogeneity of data, significant differences in the degree of correlation between different data sources and false alarm detection judgment, and how to comprehensively correlate multi-source information. In summary, the existing technology requires multiple steps such as complex model construction, parameter learning, and data adaptation, which is not practical and inefficient. The existing technology also requires a lot of time and manpower costs in model construction and data adaptation.

[0005] In summary, how to improve the efficiency of false alarm detection and reduce costs while ensuring accuracy is a problem that needs to be solved urgently. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide a false alarm detection method, device, equipment and medium for network attack alarms, which can improve the efficiency of false alarm detection and reduce costs while ensuring accuracy. The specific scheme is as follows:

[0007] In a first aspect, the present application discloses a false alarm detection method for network attack alarms, comprising:

[0008] Extracting the alarm log data to be detected for several time periods from the historical alarm log data based on several preset data reading windows;

[0009] Based on the alarm log data to be detected, a target list corresponding to different log types at each preset time series analysis granularity within each time period is constructed; the target list includes target attack time and attack IP; the log type and / or attacked IP are different if the log type and / or attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity;

[0010] Constructing three time series corresponding to each target list, and calculating the sequence periods corresponding to the three time series of each target list; the three time series are the log quantity time series, the attack IP type time series, and the attack IP information entropy time series;

[0011] If the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm.

[0012] Optionally, constructing a target list corresponding to different log types at each preset time series analysis granularity within each time period based on the alarm log data to be detected includes:

[0013] Based on the preset key-value attributes, the attributes of the alarm log data to be detected in different time periods are extracted and aggregated to obtain log benchmark data of different log types in different time periods; wherein the key attribute includes the log type and the attacked IP, and the value attribute includes the attack time and the attack IP;

[0014] Based on several preset time series analysis granularities, attack IP aggregation is performed on each log benchmark data respectively to obtain a target list corresponding to different log types at each preset time series analysis granularity in each time period.

[0015] Optionally, before extracting the alarm log data to be detected for a plurality of time periods from the historical alarm log data based on a plurality of preset data reading windows, the method further includes:

[0016] Extracting the preset data reading window, the preset key-value attribute, and the preset time series analysis granularity from preset configuration information;

[0017] Accordingly, the false alarm detection method for network attack alarms further includes:

[0018] Modify the preset configuration information according to actual configuration requirements.

[0019] Optionally, the attack IP aggregation is performed on each log benchmark data based on several preset time series analysis granularities to obtain a target list corresponding to different log types at each preset time series analysis granularity in each time period, including:

[0020] Aggregate the attack IP addresses of each log benchmark data based on the preset time series analysis granularity to obtain a temporary list corresponding to different log types at each preset time series analysis granularity within each time period;

[0021] The temporary list is completed to obtain a target list; wherein the completion method is: determining the target attack time missing from the temporary list, and setting the attack IP corresponding to the missing target attack time in the target list to empty.

[0022] Optionally, calculating the sequence periods corresponding to the three time series of each target list includes:

[0023] The fast Fourier transform algorithm is used to calculate the sequence periods corresponding to the three time series of each target list; wherein the sequence period is the period corresponding to the sine wave frequency with the largest signal amplitude.

[0024] Optionally, extracting the to-be-detected alarm log data of several time periods from the historical alarm log data based on several preset data reading windows includes:

[0025] Extracting original alarm log data of several time periods from historical alarm log data based on several preset data reading windows;

[0026] The log data lacking key attributes in the original alarm log data is filtered to obtain the alarm log data to be detected; the key attributes include the original attack time, attacking IP, log type and attacked IP.

[0027] Optionally, the preset reasonable rule is that the sequence period is less than a predetermined length; the predetermined length is half of the time series corresponding to the sequence period;

[0028] Correspondingly, the category number restriction rule is that the number of attack IP categories of the log category corresponding to the target list is less than a predetermined number.

[0029] In a second aspect, the present application discloses a false alarm detection device for network attack alarms, comprising:

[0030] A data extraction module is used to extract the alarm log data to be detected for several time periods from the historical alarm log data based on several preset data reading windows;

[0031] A list construction module is configured to construct, based on the alarm log data to be detected, a target list corresponding to different log types at each preset time series analysis granularity within each time period; the target list includes a target attack time and an attacking IP address; the log type and / or the attacked IP address are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity;

[0032] A time series construction module is used to construct three time series corresponding to each target list; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series;

[0033] A sequence period calculation module, used to calculate the sequence periods corresponding to the three time series of each target list;

[0034] The false alarm judgment module is used to judge that if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm.

[0035] In a third aspect, the present application discloses an electronic device, comprising:

[0036] Memory, used to store computer programs;

[0037] A processor is used to execute the computer program to implement the aforementioned disclosed method for detecting false alarms of network attack alerts.

[0038] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the false alarm detection method for network attack alarms disclosed above is implemented.

[0039] It can be seen that the present application extracts several time periods of to-be-detected alarm log data from historical alarm log data based on several preset data reading windows; constructs a target list corresponding to different log types under each preset time series analysis granularity in each time period based on the alarm log data to be detected; the target list includes target attack time and attack IP; the log type and / or attacked IP are different, then the log type is different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; constructs three time series corresponding to each target list, and calculates the sequence periods corresponding to the three time series of each target list; the three time series are the log quantity time series, the attack IP type time series and the attack IP information entropy time series; if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type in the time period corresponding to the target list is a false alarm. It can be seen that the present application directly uses the original content of the historical alarm log data to judge false alarms. It does not require a model, nor does it require model training, nor does it require the participation of external data. Therefore, it is beneficial to save costs and simplify the process to improve efficiency. In addition, the present application comprehensively considers the sequence periods of the three time series and the restrictions on the number of attack IP types, and uses multiple features to judge whether it is a false alarm, thereby improving the accuracy of false alarm judgment. In summary, the present application ensures accuracy on the basis of improving efficiency and achieves a balance between timeliness and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0041] Figure 1 This is a flow chart of a false alarm detection method for network attack alarms disclosed in this application;

[0042] Figure 2 A schematic diagram of a false alarm detection process disclosed in this application;

[0043] Figure 3 A schematic diagram of a multi-dimensional time series data construction process disclosed in this application;

[0044] Figure 4 This is a schematic structural diagram of a false alarm detection device for network attack alarms disclosed in this application;

[0045] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] Mainstream false alarm detection methods for network attack alarms mainly include context-based and association-based. The feature-based detection scheme distinguishes false alarms by learning and modeling characteristic attributes such as alarm time, alarm source, alarm stage, alarm quantity, alarm severity, and attack IP information contained in the alarm log itself; the context-based detection scheme reduces false alarms by incorporating network context information (such as session status) into the original detection; the association-based detection scheme conducts comprehensive analysis and processing of security information from multiple sources such as alarm logs, original traffic logs, vulnerability information, and threat intelligence.

[0048] The feature-based false alarm detection method for network attack alerts uses a machine learning algorithm model to learn features, thereby distinguishing false alarm information from correct attacks. However, the accuracy of the detection results has high requirements for multiple factors such as model fitness, algorithm parameters, and sample quality. It is difficult to quickly achieve good results in a real-world environment and requires multiple rounds of iterative operations such as parameter adjustment and training. Although the context-based false alarm detection method for network attack alerts can integrate network context information during the detection process, different types of alerts require different context information, and different detection engines also have different alert types, making it difficult to build a comprehensive detection solution. The correlation-based false alarm detection method for network attack alerts can improve the accuracy of detection results by introducing exogenous information, but it also faces technical difficulties such as multi-source heterogeneity of data, significant differences in the correlation between different data sources and false alarm detection judgments, and how to comprehensively correlate multi-source information. In summary, the existing technology requires multiple steps such as complex model construction, parameter learning, and data adaptation, which is not practical and inefficient. The existing technology also requires a lot of time and manpower costs in model construction and data adaptation.

[0049] To this end, an embodiment of the present application proposes a false alarm detection solution that can improve false alarm detection efficiency and reduce costs while ensuring accuracy.

[0050] The present application discloses a method for detecting false alarms of network attack alarms. Figure 1 As shown, the method includes:

[0051] Step S11: extracting to-be-detected alarm log data of several time periods from historical alarm log data based on several preset data reading windows.

[0052] In this embodiment, the specific process of the false alarm detection method for network attack alarms is as follows: configuration information parsing of time series analysis; reading historical alarm data based on time windows; aggregating original log data based on key attributes; time series data construction of multi-dimensional features of alarm logs; time series periodicity calculation based on Fast Fourier Transformation (FFT); and false alarm determination based on multi-perspective features.

[0053] In this embodiment, the configuration information can be modified according to actual conditions. Specifically, before extracting the alarm log data to be detected for several time periods from the historical alarm log data based on several preset data reading windows, it also includes: extracting the preset data reading window, the preset key value attribute and the preset time series analysis granularity from the preset configuration information; accordingly, the method also includes: changing the preset configuration information according to actual configuration requirements.

[0054] It should be noted that the preset reading window includes windows of various time periods, which may include 1 day, 7 days, 30 days, etc.; the preset key-value attributes include key attributes and value attributes, where the key attributes include log type and attacked IP, and the value attributes include attack time and attack IP; the preset time series analysis granularity may include 1 minute, 30 minutes, 1 day, etc.

[0055] In this embodiment, after using the window to obtain data, it is also necessary to filter out the data that does not meet the requirements. Specifically, the alarm log data to be detected for several time periods is extracted from the historical alarm log data based on several preset data reading windows, including: extracting the original alarm log data for several time periods from the historical alarm log data based on several preset data reading windows; filtering the log data that lacks key attributes in the original alarm log data to obtain the alarm log data to be detected; the key attributes include the original attack time, attack IP, log type and attacked IP.

[0056] In a specific embodiment, the preset reading window includes 1 day and 3 days. Taking 1 day as an example, the alarm log data to be detected includes: 16:22:40 A (IP) attacks B (IP) log type A, 15:40:20 A attacks C log type A, 14:50:10 A attacks B log type B, 18:10:22 A attacks B log type A, 17:22:30 D attacks B log type A, 19:22:30 D attacks B log type A.

[0057] Step S12: Based on the alarm log data to be detected, a target list corresponding to different log types at each preset time series analysis granularity within each time period is constructed; the target list includes target attack time and attack IP; the log type is different if the log type and / or attacked IP is different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity.

[0058] In this embodiment, the target list corresponding to different log types at each preset time series analysis granularity in each time period is constructed based on the alarm log data to be detected, including: extracting and aggregating the attributes of the alarm log data to be detected in different time periods based on preset key-value attributes to obtain log benchmark data of different log types in different time periods; wherein the key attribute includes the log type and the attacked IP, and the value attribute includes the attack time and the attack IP; based on several preset time series analysis granularities, each log benchmark data is aggregated with the attack IP to obtain a target list corresponding to different log types at each preset time series analysis granularity in each time period.

[0059] It should be noted that the display mode of log baseline data is as follows: (log type, attacked IP) -> [(original attack time, attacking IP), (original attack time, attacking IP), ...].

[0060] In a specific embodiment, taking one day as an example, the log benchmark data obtained after processing based on the preset key-value attributes includes: 1. (A, B) -> [(16:22:40, A), (17:22:30, D), (18:10:22, A), (19:22:30, D)]; 2. (B, B) -> [(14:50:10, A)]; 3. (A, C) -> [(15:40:20, A)].

[0061] In this embodiment, after obtaining data based on the preset time series analysis granularity, there may be idle space that needs to be filled. Specifically, the attack IP aggregation is performed on each of the log baseline data based on several of the preset time series analysis granularities to obtain a target list corresponding to different log types under each preset time series analysis granularity in each time period, including: based on several of the preset time series analysis granularities, the attack IP aggregation is performed on each of the log baseline data to obtain a temporary list corresponding to different log types under each preset time series analysis granularity in each time period; the temporary list is filled to obtain a target list; wherein the filling method is: determining the target attack time that is missing in the temporary list, and setting the attack IP corresponding to the missing target attack time in the target list to empty.

[0062] It should be pointed out that the aggregated temporary list is the list information of all attacking IP addresses at each time granularity. Due to the data requirements of time series analysis, all missing time granularities in the current data are filled in, and the filled-in data is an empty list of attacking IP addresses to obtain the benchmark data for time series analysis, that is, the target list.

[0063] In a specific embodiment, taking one day as an example, the preset time series analysis granularity is 30 minutes as an example, and the display mode of the temporary list is: [(target attack time, [attack IP, attack IP...])]; the temporary list is as follows: 1. When (A, B), the temporary list is [(16:00, [A]), (17:00, [D]), (18:00, [A]), (19:00, [D])]; 2. When (B, B), the temporary list is [(14:30, [A])]; 3. When (A, C), the temporary list is [(15:30, [A])].

[0064] In a specific embodiment, taking one day as an example, the preset time series analysis granularity is 30 minutes as an example, and the display model of the completed content is (target attack time, []); the target list after completion is as follows: 1. When (A, B), the target list is [(0 o'clock, []), (0:30, []), (1 o'clock, []), (1:30, []), ..., (16 o'clock, [A]), (16:30, []), (17 o'clock, [D]), (17:30, []), (18 o'clock, [A]), (18:30, []), : 1. When (B), the target list is [(0:00, []), (0:30, []), (1:00, []), (1:30, []), …, (14:30, [A]), (15:00, []) …]; 2. When (A, C), the target list is [(0:00, []), (0:30, []), (1:00, []), (1:30, []), …, (15:30, [A]), (16:00, []) …]. Each target list includes the time of day.

[0065] Step S13: construct three time series corresponding to each of the target lists, and calculate the sequence periods corresponding to the three time series of each of the target lists; the three time series are the log quantity time series, the attack IP type time series, and the attack IP information entropy time series.

[0066] In this embodiment, the calculation of the sequence periods corresponding to the three time series of each target list includes: using a fast Fourier transform algorithm to calculate the sequence periods corresponding to the three time series of each target list; wherein the sequence period is the period corresponding to the sinusoidal wave frequency with the largest signal amplitude.

[0067] It should be pointed out that the time series of log quantity, attack IP type, and attack IP information entropy are constructed for periodic calculation: the log quantity time series indicates how many times a log type has been alarmed under a preset time series analysis intensity within a time window; the attack IP type time series indicates how many different IPs of a log type have been used to alarm the target under a preset time series analysis intensity within a time window; the attack IP information entropy time series indicates whether the attack IP that initiates an alarm for a log type under a preset time series analysis intensity within a time window is fixed; the characteristics of the above three dimensions evaluate whether the alarm has periodicity, regularity, and stability, and evaluate whether it conforms to the characteristics of normal network access behavior. It should be noted that, in a specific embodiment, taking one day and the preset time series analysis granularity of 30 minutes at 1 (A, B) as an example, the number of logs is four: (16 o'clock, [A]), (17 o'clock, [D]), (18 o'clock, [A]), and (19 o'clock, [D]). The attacking IP types are A and D, not A, D, and A. The attacking IP information entropy is calculated using the following information entropy calculation formula:

[0068] ;

[0069] in, Represents a list of attacking IPs (target list) for a type of log under a preset time series analysis intensity within a time window. Indicates each IP in the target list, It represents the probability of the IP appearing, n represents the number of different IPs in the IP list, and the more stable the IP list is, the lower the information entropy is.

[0070] It's important to note that the Fast Fourier Transform (FFT) algorithm is used to calculate the periodicity of the time series with the three characteristics described above. FFT is a fundamental method in time-frequency domain analysis. It transforms the time domain signal into the frequency domain, synthesizing the time domain signal using multiple sine waves. The frequency of the sine wave with the largest amplitude is the period of the sequence.

[0071] Step S14: If the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm.

[0072] This embodiment combines the period values ​​of three time series with the statistical characteristics of the time series analysis benchmark data to comprehensively determine whether a particular alarm log is a false alarm from multiple perspectives. Taking into account the characteristics of normal network access behavior, such as limited and fixed access sources and repetitive access frequencies, the present invention first determines whether the period values ​​of each time series are reasonable; secondly, whether the periods of multiple time series are consistent; and finally, whether the attacking IP address that initiated the alarm is limited and fixed to comprehensively determine false alarms. Logs that meet these criteria are recorded and feedback is provided.

[0073] It should be noted that the preset reasonableness rule is that the sequence period is less than a predetermined length; the predetermined length is half the time series corresponding to the sequence period; accordingly, the category limit rule is that the number of attacking IP types in the log category corresponding to the target list is less than a predetermined number. It should be noted that a cycle only exists when the sequence period is less than the predetermined length.

[0074] In summary, the existing detection schemes have problems with their dependence on models and samples. This application starts from the stability, periodicity, and regularity of normal network access behavior, and uses efficient mathematical algorithms to perform calculations and analysis on the sequence characteristics in different alarm logs to achieve false alarm detection. No prior training is required, and the algorithm and model parameter adjustment problem is also not included. The existing detection schemes have problems with the difficulty in fully utilizing external data after introducing it. This application starts from the time and space characteristics of the alarm log itself for calculation and analysis, and does not need to introduce external information such as context and threat intelligence for secondary parsing and correlation operations. The existing detection schemes have problems with balancing timeliness and accuracy. This application can quickly achieve false alarm detection of different time granularities by flexibly setting time windows. At the same time, this scheme can simultaneously perform analysis of multiple time windows, which can not only quickly discover existing false alarms in a short time, but also not ignore false alarms that occur in low frequency and long periods. In addition, the technical solution proposed in this application adopts a configuration method to flexibly analyze the temporal characteristics of alarm logs in different time windows, and can simultaneously consider low-frequency and high-frequency normal network access behaviors, while ensuring the timeliness and comprehensiveness of false alarm detection; the proposed technical solution does not require preliminary learning and training, and does not require additional operations such as constructing sample data and screening suitable models, saving time and labor costs; the proposed technical solution does not require complex models, adaptation of external data and other additional operations, and can achieve simple and efficient detection goals based on the information contained in the original log using mathematical algorithms.

[0075] It can be seen that the present application extracts several time periods of to-be-detected alarm log data from historical alarm log data based on several preset data reading windows; constructs a target list corresponding to different log types under each preset time series analysis granularity in each time period based on the alarm log data to be detected; the target list includes target attack time and attack IP; the log type and / or attacked IP are different, then the log type is different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; constructs three time series corresponding to each target list, and calculates the sequence periods corresponding to the three time series of each target list; the three time series are the log quantity time series, the attack IP type time series and the attack IP information entropy time series; if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type in the time period corresponding to the target list is a false alarm. It can be seen that the present application directly uses the original content of the historical alarm log data to judge false alarms. It does not require a model, nor does it require model training, nor does it require the participation of external data. Therefore, it is beneficial to save costs and simplify the process to improve efficiency. In addition, the present application comprehensively considers the sequence periods of the three time series and the restrictions on the number of attack IP types, and uses multiple features to judge whether it is a false alarm, thereby improving the accuracy of false alarm judgment. In summary, the present application ensures accuracy on the basis of improving efficiency and achieves a balance between timeliness and accuracy.

[0076] See also Figure 2 The figure shows a schematic diagram of a false alarm detection process; the steps in the figure are as follows: 1) Parse the configuration information in the time series analysis to determine the data reading window, the time series analysis granularity, the key attribute based on aggregation, and the aggregated value attribute. 2) According to the window configuration for data reading, such as 1 day, 7 days, 30 days, etc., read historical log data for a period of time from the storage, and filter out logs with incomplete key attributes, such as no attack type, no IP information, etc. 3) Extract and aggregate attributes of historical log data based on the configured key attribute and value attribute to obtain benchmark data for different alarm logs. 4) For multiple alarm logs, construct time series analysis data of different alarm logs one by one from multiple feature dimensions to facilitate subsequent periodic analysis and false alarm determination. See the detailed process. Figure 3 .

[0077] See also Figure 3The figure shows a schematic diagram of a multi-dimensional time series data construction process; the steps in the figure are as follows: 4.1) Aggregate the original data (log benchmark data) according to the time series analysis granularity in the configuration file, such as 1 minute, 30 minutes, 1 day, etc., and aggregate to obtain all the attack IP list information (temporary list) at each time granularity; 4.2) According to the data requirements of the time series analysis, fill in all the missing time granularities in the current data, and fill in the data with an empty list of attack IPs to obtain the benchmark data (target list) for time series analysis; 4.3) Construct time series of log quantity, attack IP type, and attack IP information entropy for periodic calculation: the log quantity time series indicates how many times a log type has been alarmed under a preset time series analysis intensity within a time window; the attack IP type time series indicates how many different IPs of a log type have been used to alarm the target under a preset time series analysis intensity within a time window; the attack IP information entropy time series indicates whether the attack IP that initiates an alarm for a log type under a preset time series analysis intensity within a time window is fixed. The characteristics of the above three dimensions evaluate whether the alarm has periodicity, regularity, and stability, and whether it conforms to the characteristics of normal network access behavior.

[0078] 5) For each of the three time series features described above, the Fast Fourier Transform (FFT) algorithm is used to calculate the period within each sequence. FFT is a fundamental method in time-frequency domain analysis. It transforms a time-domain signal into the frequency domain, synthesizing the time-domain signal using multiple sine waves. The frequency of the sine wave with the largest signal amplitude is the period of the sequence. 6) Combining the period values ​​of the three time series with the statistical characteristics of the benchmark time series analysis data, a comprehensive determination is made from multiple perspectives to determine whether a particular alarm log is a false positive. Taking into account the characteristics of normal network access behavior, such as the limited and fixed nature of access sources and the repetitive nature of access frequencies, this method first determines whether the period values ​​of each time series are reasonable; secondly, whether the periods of multiple time series are consistent; and finally, whether the attacking IP address that initiated the alarm is limited and fixed to comprehensively determine false positives. Logs that meet these criteria are recorded and feedback is provided.

[0079] Correspondingly, the embodiment of the present application also discloses a false alarm detection device for network attack alarms, see Figure 4 As shown, the device includes:

[0080] The data extraction module 11 is used to extract the alarm log data to be detected in several time periods from the historical alarm log data based on several preset data reading windows;

[0081] A list construction module 12 is configured to construct a target list corresponding to different log types at each preset time series analysis granularity within each time period based on the alarm log data to be detected; the target list includes a target attack time and an attacking IP address; the log type and / or the attacked IP address are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity;

[0082] A time series construction module 13 is used to construct three time series corresponding to each target list; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series;

[0083] A sequence period calculation module 14 is used to calculate the sequence periods corresponding to the three time series of each target list;

[0084] The false alarm judgment module 15 is used to judge that if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm.

[0085] Among them, the more specific working processes of the above modules can refer to the corresponding contents disclosed in the above embodiments, which will not be repeated here.

[0086] It can be seen that the present application extracts several time periods of to-be-detected alarm log data from historical alarm log data based on several preset data reading windows; constructs a target list corresponding to different log types under each preset time series analysis granularity in each time period based on the alarm log data to be detected; the target list includes target attack time and attack IP; the log type and / or attacked IP are different, then the log type is different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; constructs three time series corresponding to each target list, and calculates the sequence periods corresponding to the three time series of each target list; the three time series are the log quantity time series, the attack IP type time series and the attack IP information entropy time series; if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type in the time period corresponding to the target list is a false alarm. It can be seen that the present application directly uses the original content of the historical alarm log data to judge false alarms. It does not require a model, nor does it require model training, nor does it require the participation of external data. Therefore, it is beneficial to save costs and simplify the process to improve efficiency. In addition, the present application comprehensively considers the sequence periods of the three time series and the restrictions on the number of attack IP types, and uses multiple features to judge whether it is a false alarm, thereby improving the accuracy of false alarm judgment. In summary, the present application ensures accuracy on the basis of improving efficiency and achieves a balance between timeliness and accuracy.

[0087] Furthermore, an embodiment of the present application also provides an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0088] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a display 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the false alarm detection method for network attack alerts disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0089] In this embodiment, the power supply 26 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 24 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0090] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, a magnetic disk, or an optical disk, etc. The resources stored thereon can include a computer program 221, which can be stored in a temporary or permanent manner. In addition to including a computer program capable of implementing the false alarm detection method for network attack alarms performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 221 can further include a computer program capable of performing other specific tasks.

[0091] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the false alarm detection method for network attack alarm disclosed above is implemented.

[0092] The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0093] The various embodiments in this application are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0094] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0095] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0096] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0097] The above is a detailed introduction to the false alarm detection method, device, equipment, and storage medium for network attack alarms provided by this application. Specific examples are used in this article to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method of this application and its core ideas. At the same time, for general technical personnel in this field, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. A false alarm detection method for network attack alarms, characterized in that: include: Extracting the alarm log data to be detected for several time periods from the historical alarm log data based on several preset data reading windows; Based on the alarm log data to be detected, a target list corresponding to different log types at each preset time series analysis granularity within each time period is constructed; the target list includes target attack time and attack IP; the log type and / or attacked IP are different if the log type and / or attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; Constructing three time series corresponding to each target list, and calculating the sequence periods corresponding to the three time series of each target list; the three time series are the log quantity time series, the attack IP type time series, and the attack IP information entropy time series; If the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm.

2. The false alarm detection method for network attack alarm according to claim 1, characterized in that: The step of constructing a target list corresponding to different log types at each preset time series analysis granularity within each time period based on the alarm log data to be detected includes: Based on the preset key-value attributes, the attributes of the alarm log data to be detected in different time periods are extracted and aggregated to obtain log benchmark data of different log types in different time periods; wherein the key attribute includes the log type and the attacked IP, and the value attribute includes the attack time and the attack IP; Based on several preset time series analysis granularities, attack IP aggregation is performed on each log benchmark data respectively to obtain a target list corresponding to different log types at each preset time series analysis granularity in each time period.

3. The false alarm detection method for network attack alarm according to claim 2, characterized in that: Before extracting the alarm log data to be detected for a plurality of time periods from the historical alarm log data based on a plurality of preset data reading windows, the method further includes: Extracting the preset data reading window, the preset key-value attribute, and the preset time series analysis granularity from preset configuration information; Accordingly, the method further includes: Modify the preset configuration information according to actual configuration requirements.

4. The false alarm detection method for network attack alarm according to claim 2, characterized in that: The attack IP aggregation is performed on each log benchmark data based on the plurality of preset time series analysis granularities to obtain a target list corresponding to different log types at each preset time series analysis granularity within each time period, including: Aggregate the attack IP addresses of each log benchmark data based on the preset time series analysis granularity to obtain a temporary list corresponding to different log types at each preset time series analysis granularity within each time period; The temporary list is completed to obtain a target list; wherein the completion method is: determining the target attack time missing from the temporary list, and setting the attack IP corresponding to the missing target attack time in the target list to empty.

5. The false alarm detection method for network attack alarm according to claim 1, characterized in that: The calculating of the sequence periods corresponding to the three time series of each target list includes: The fast Fourier transform algorithm is used to calculate the sequence periods corresponding to the three time series of each target list; wherein the sequence period is the period corresponding to the sine wave frequency with the largest signal amplitude.

6. The false alarm detection method for network attack alarm according to claim 1, characterized in that: The step of extracting the alarm log data to be detected for a plurality of time periods from the historical alarm log data based on a plurality of preset data reading windows includes: Extracting original alarm log data of several time periods from historical alarm log data based on several preset data reading windows; The log data lacking key attributes in the original alarm log data is filtered to obtain the alarm log data to be detected; the key attributes include the original attack time, attacking IP, log type and attacked IP.

7. The false alarm detection method for network attack alarms according to any one of claims 1 to 6, characterized in that: The preset reasonable rule is that the sequence period is less than a predetermined length; the predetermined length is half of the time series corresponding to the sequence period; Correspondingly, the category number restriction rule is that the number of attack IP categories of the log category corresponding to the target list is less than a predetermined number.

8. A false alarm detection device for network attack alarms, characterized in that: include: A data extraction module is used to extract the alarm log data to be detected for several time periods from the historical alarm log data based on several preset data reading windows; A list construction module is configured to construct, based on the alarm log data to be detected, a target list corresponding to different log types at each preset time series analysis granularity within each time period; the target list includes a target attack time and an attacking IP address; the log type and / or the attacked IP address are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; A time series construction module is used to construct three time series corresponding to each target list; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series; A sequence period calculation module, used for calculating the sequence periods corresponding to the three time series of each target list; The false alarm judgment module is used to judge that if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the false alarm detection method for network attack alarms according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the false alarm detection method for network attack alarms according to any one of claims 1 to 7 is implemented.

Images