A false alarm detection method, device and equipment for network attack alarm and a medium

Abstract

This application discloses a method, apparatus, device, and medium for detecting false alarms in network attack alerts, relating to the field of network security. The method includes: constructing a target list corresponding to different log types at each preset time series analysis granularity within each time period based on alarm log data from several time periods in historical data; the target list includes the target attack time and the attacking IP; different log types and / or attacked IPs result in different log types; constructing three time series for each target list, and calculating the sequence periods corresponding to the three time series; the three time series are a log quantity time series, an attacking IP type time series, and an attacking IP information entropy time series; if the three sequence periods are consistent and meet preset reasonable rules, and the number of attacking IP types for the log type corresponding to the target list meets the type limit rule, then the alarm log for that log type is a false alarm. This method can improve false alarm detection efficiency and reduce costs while ensuring accuracy.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method, apparatus, device, and medium for detecting false alarms in network attack alerts. Background Technology

[0002] False alarm rate is an important indicator for measuring the quality of intrusion detection systems in the field of cybersecurity. False alarms not only consume resources and time to process, but also reduce the sensitivity of security analysts to attacks and distract them from dealing with real security threats. Effectively reducing the false alarm rate is a hot topic.

[0003] Mainstream methods for detecting false positives in network attack alerts can be categorized into three types: context-based, correlation-based, and context-based. Feature-based detection schemes learn and model features such as alert time, source, stage, number, severity, and attacking IP (Internet Protocol) information contained in the alert logs to distinguish false positives. Context-based detection schemes reduce false positives by incorporating network context information (such as session state) into the original detection process. Correlation-based detection schemes comprehensively analyze and process security information from multiple sources, including alert logs, raw traffic logs, vulnerability information, and threat intelligence.

[0004] However, while feature-based network attack alert false positive detection methods use machine learning algorithms to learn features and distinguish false positives from correct attacks, the accuracy of these methods is highly dependent on factors such as model fit, algorithm parameters, and sample quality. This makes it difficult to achieve good results quickly in real-world environments, requiring multiple rounds of parameter tuning and training iterations. Context-based network attack alert false positive detection methods can incorporate network context information during detection, but different types of alerts require different contextual information, and different detection engines also have different alert types, making it difficult to build a comprehensive detection solution. Association-based network attack alert false positive detection methods can improve accuracy by introducing external information, but they also face technical challenges such as multi-source heterogeneous data, significant differences in the correlation between different data sources and false positive detection judgments, and how to comprehensively correlate multi-source information. In summary, existing technologies require complex model building, parameter learning, and data adaptation steps, resulting in insufficient practicality and low efficiency. Furthermore, existing technologies require significant time and manpower for model building and data adaptation.

[0005] In conclusion, how to improve the efficiency of false alarm detection and reduce costs while ensuring accuracy is an urgent problem to be solved. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for detecting false alarms in network attack alerts, which can improve the efficiency of false alarm detection and reduce costs while ensuring accuracy. The specific solution is as follows:

[0007] Firstly, this application discloses a method for detecting false alarms in network attack alerts, including:

[0008] Based on several preset data reading windows, extract alarm log data to be detected for several time periods from historical alarm log data;

[0009] Based on the alarm log data to be detected, a target list corresponding to different log types under each preset time series analysis granularity is constructed within each time period; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity;

[0010] Three time series are constructed for each of the target lists, and the sequence period corresponding to each of the three time series for each target list is calculated; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series.

[0011] If the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm logs of the log type within the time period corresponding to the target list are false alarms.

[0012] Optionally, the step of constructing a target list corresponding to different log types at each preset time series analysis granularity within each time period based on the alarm log data to be detected includes:

[0013] Based on preset key-value attributes, attribute extraction and aggregation are performed on the alarm log data to be detected in different time periods to obtain log baseline data for different log types in different time periods; wherein, the key attribute includes log type and attacked IP, and the value attribute includes attack time and attack IP;

[0014] Attack IPs are aggregated for each of the aforementioned preset time series analysis granularities to obtain a target list corresponding to different log types under each preset time series analysis granularity within each time period.

[0015] Optionally, before extracting alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows, the method further includes:

[0016] Extract the preset data reading window, the preset key-value attribute, and the preset time series analysis granularity from the preset configuration information;

[0017] Correspondingly, the method for detecting false alarms in network attack alerts also includes:

[0018] The preset configuration information is modified according to the actual configuration requirements.

[0019] Optionally, the attack IP aggregation is performed on each of the log baseline data based on several preset time series analysis granularities to obtain a target list corresponding to different log types under each preset time series analysis granularity within each time period, including:

[0020] Based on several preset time series analysis granularities, attack IPs are aggregated for each log baseline data to obtain temporary lists corresponding to different log types under each preset time series analysis granularity within each time period.

[0021] The temporary list is supplemented to obtain the target list; wherein, the supplementation method is: to determine the target attack time that is missing in the temporary list, and to set the attack IP corresponding to the missing target attack time in the target list to empty.

[0022] Optionally, calculating the sequence period corresponding to the three time series for each of the target lists includes:

[0023] The sequence period corresponding to the three time series of each of the target lists is calculated using the Fast Fourier Transform algorithm; wherein the sequence period is the period corresponding to the frequency of the sine wave with the largest signal amplitude.

[0024] Optionally, the step of extracting alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows includes:

[0025] Based on several preset data reading windows, extract raw alarm log data for several time periods from historical alarm log data;

[0026] The original alarm log data is filtered to obtain the alarm log data to be detected, which contains log data missing key attributes. The key attributes include the original attack time, attacking IP, log type, and attacked IP.

[0027] Optionally, the preset reasonable rule is that the sequence period is less than a predetermined length; the predetermined length is half of the time series corresponding to the sequence period;

[0028] Accordingly, the rule limiting the number of types is that the number of attacking IP types corresponding to the log type in the target list is less than a predetermined number.

[0029] Secondly, this application discloses a false alarm detection device for network attack alerts, comprising:

[0030] The data extraction module is used to extract alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows;

[0031] The list construction module is used to construct a target list corresponding to different log types under each preset time series analysis granularity within each time period based on the alarm log data to be detected; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity;

[0032] The time series construction module is used to construct three time series corresponding to each of the target lists; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series.

[0033] The sequence period calculation module is used to calculate the sequence period corresponding to the three time series of each of the target lists;

[0034] The false alarm judgment module is used to determine that if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type in the time period corresponding to the target list is a false alarm.

[0035] Thirdly, this application discloses an electronic device, including:

[0036] Memory, used to store computer programs;

[0037] A processor is used to execute the computer program to implement the aforementioned disclosed method for detecting false alarms of network attack alerts.

[0038] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for detecting false alarms of network attack alerts.

[0039] As can be seen, this application extracts alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows; constructs a target list corresponding to different log types under each preset time series analysis granularity within each time period based on the alarm log data to be detected; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; constructs three time series corresponding to each target list, and calculates the sequence period corresponding to the three time series of each target list; the three time series are the log quantity time series, the attacking IP type time series, and the attacking IP information entropy time series; if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attacking IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm. Therefore, this application directly utilizes the existing content of historical alarm log data for false alarm judgment, without the need for a model, model training, or external data. This saves costs and simplifies the process to improve efficiency. In addition, this application comprehensively considers the sequence period of the three time series and the limitation of the number of attack IP types, using multiple features to judge whether it is a false alarm, thus improving the accuracy of false alarm judgment. In summary, this application ensures accuracy while improving efficiency, achieving a balance between timeliness and accuracy. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 This application discloses a flowchart of a method for detecting false alarms in network attack alerts.

[0042] Figure 2 This is a schematic diagram of a false alarm detection process disclosed in this application;

[0043] Figure 3 This is a schematic diagram of a multi-dimensional time series data construction process disclosed in this application;

[0044] Figure 4 This is a schematic diagram of the structure of a false alarm detection device for network attack alarms disclosed in this application;

[0045] Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] The mainstream methods for detecting false positives in network attack alerts mainly fall into three categories: context-based, correlation-based, and feature-based. Feature-based detection schemes learn and model based on the feature attributes contained in the alert log itself, such as alert time, alert source, alert stage, number of alerts, alert severity, and attack IP information, to distinguish false positives. Context-based detection schemes reduce false positives by incorporating network context information (such as session state) into the original detection process. Correlation-based detection schemes comprehensively analyze and process security information from multiple sources, such as alert logs, raw traffic logs, vulnerability information, and threat intelligence.

[0048] Feature-based false positive detection methods for network attack alerts employ machine learning algorithms to learn features, thereby distinguishing false positives from correct attacks. However, the accuracy of the detection results is highly dependent on multiple factors such as model adaptability, algorithm parameters, and sample quality, making it difficult to achieve good results quickly in real-world environments. Multiple rounds of parameter tuning and training iterations are required. Context-based false positive detection methods for network attack alerts can incorporate network context information during detection, but different types of alerts require different contextual information, and different detection engines also have different alert types, making it difficult to build a comprehensive detection solution. Association-based false positive detection methods for network attack alerts can improve the accuracy of detection results by introducing external information, but they also face technical challenges such as multi-source heterogeneous data, significant differences in the correlation between different data sources and false positive detection judgments, and how to comprehensively associate multi-source information. In summary, existing technologies require complex model building, parameter learning, and data adaptation steps, resulting in insufficient practicality and low efficiency. Existing technologies also require significant time and manpower for model building and data adaptation.

[0049] Therefore, this application proposes a false alarm detection scheme that can improve false alarm detection efficiency and reduce costs while ensuring accuracy.

[0050] This application discloses a method for detecting false alarms in network attack alerts. See [link to relevant documentation]. Figure 1 As shown, the method includes:

[0051] Step S11: Extract alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows.

[0052] In this embodiment, the specific process of the false alarm detection method for network attack alarms is as follows: parsing configuration information for time series analysis; reading historical alarm data based on time windows; aggregating raw log data based on key attributes; constructing time series data of multi-dimensional features of alarm logs; calculating the time series periodicity based on Fast Fourier Transform (FFT); and determining false alarms based on multi-perspective features.

[0053] In this embodiment, the configuration information can be modified according to the actual situation. Specifically, before extracting alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows, the method further includes: extracting the preset data reading window, the preset key-value attribute, and the preset time series analysis granularity from the preset configuration information; correspondingly, the method further includes: changing the preset configuration information according to actual configuration requirements.

[0054] It should be noted that the preset reading window includes windows for various time periods, such as 1 day, 7 days, 30 days, etc.; the preset key-value attributes include key attributes and value attributes, where the key attribute includes the log type and the attacked IP, and the value attribute includes the attack time and the attacking IP; the preset time series analysis granularity can include 1 minute, 30 minutes, 1 day, etc.

[0055] In this embodiment, after acquiring data using windows, it is also necessary to filter out data that does not meet the requirements. Specifically, the step of extracting alarm log data to be detected from historical alarm log data for several time periods based on several preset data reading windows includes: extracting original alarm log data for several time periods from historical alarm log data based on several preset data reading windows; filtering log data missing key attributes in the original alarm log data to obtain alarm log data to be detected; the key attributes include the original attack time, attacking IP, log type, and attacked IP.

[0056] In one specific embodiment, the preset reading window includes 1 day and 3 days. Taking 1 day as an example, the alarm log data to be detected includes: 16:22:40 A (IP) attack B (IP) log type A, 15:40:20 A attack C log type A, 14:50:10 A attack B log type B, 18:10:22 A attack B log type A, 17:22:30 D attack B log type A, and 19:22:30 D attack B log type A.

[0057] Step S12: Based on the alarm log data to be detected, construct a target list corresponding to different log types under each preset time series analysis granularity within each time period; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity.

[0058] In this embodiment, constructing a target list corresponding to different log types under each preset time series analysis granularity within each time period based on the alarm log data to be detected includes: extracting and aggregating attributes of the alarm log data to be detected in different time periods based on preset key-value attributes to obtain log baseline data under different log types within different time periods; wherein, the key attribute includes log type and attacked IP, and the value attribute includes attack time and attack IP; and aggregating attack IPs for each log baseline data based on several preset time series analysis granularities to obtain a target list corresponding to different log types under each preset time series analysis granularity within each time period.

[0059] It should be noted that the display format of the log baseline data is as follows: (log type, attacked IP) -> [(original attack time, attacking IP), (original attack time, attacking IP), ...].

[0060] In one specific embodiment, taking 1 day as an example, the log baseline data obtained after processing based on preset key-value attributes includes: 1. (A, B) -> [(16:22:40, A), (17:22:30, D), (18:10:22, A), (19:22:30, D)]; 2. (B, B) -> [(14:50:10, A)]; 3. (A, C) -> [(15:40:20, A)].

[0061] In this embodiment, after obtaining data based on a preset time series analysis granularity, there may be idle data that needs to be filled. Specifically, the step of aggregating attack IPs for each log baseline data based on several preset time series analysis granularities to obtain a target list corresponding to different log types under each preset time series analysis granularity within each time period includes: aggregating attack IPs for each log baseline data based on several preset time series analysis granularities to obtain a temporary list corresponding to different log types under each preset time series analysis granularity within each time period; and filling the temporary list to obtain the target list. The filling method is as follows: determining the target attack time missing in the temporary list and setting the attack IP corresponding to the missing target attack time in the target list to empty.

[0062] It should be noted that the temporary list obtained by aggregation is the list of all attacking IPs at each time granularity. Due to the data requirements of time series analysis, all missing time granularities in the current data are filled in, and the filled data is an empty list of attacking IPs, thus obtaining the baseline data for time series analysis, that is, the target list.

[0063] In one specific embodiment, taking 1 day as an example, the preset time series analysis granularity is 30 minutes, and the display mode of the temporary list is: [(target attack time, [attack IP, attack IP...])]; the temporary list is as follows: 1. When (A, B), the temporary list is [(16:00, [A]), (17:00, [D]), (18:00, [A]), (19:00, [D])]; 2. When (B, B), the temporary list is [(14:30, [A])]; 3. When (A, C), the temporary list is [(15:30, [A])].

[0064] In one specific embodiment, taking 1 day as an example, the preset time series analysis granularity is 30 minutes, and the display model for the supplemented content is (target attack time, []); the target list after supplementation is as follows: 1. When (A, B), the target list is [(0 o'clock, []), (0:30, []), (1 o'clock, []), (1:30, []), ..., (16 o'clock, [A]), (16:30, []), (17 o'clock, [D]), (17:30, []), (18 o'clock, [A]), (18:30, []). 1. At (B), the target list is [(0:00, []), (0:30, []), (1:00, []), (1:30, []), ..., (14:30, [A]), (15:00, []) ...; 2. At (B), the target list is [(0:00, []), (0:30, []), (1:00, []), (1:30, []), ..., (15:30, [A]), (16:00, []) ...]. Each target list includes the time of day.

[0065] Step S13: Construct three time series corresponding to each of the target lists, and calculate the sequence period corresponding to the three time series of each target list; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series.

[0066] In this embodiment, calculating the sequence period corresponding to the three time series of each target list includes: using the Fast Fourier Transform algorithm to calculate the sequence period corresponding to the three time series of each target list; wherein, the sequence period is the period corresponding to the frequency of the sine wave with the largest signal amplitude.

[0067] It should be noted that time series of the number of constructed logs, types of attacking IPs, and information entropy of attacking IPs are constructed for periodicity calculation: the time series of the number of logs indicates how many alarms of a log type occur within a time window under a preset time series analysis strength; the time series of attacking IP types indicates how many different IPs of a log type trigger alarms for the target within a time window under a preset time series analysis strength; the time series of attacking IP information entropy indicates whether the attacking IPs that trigger alarms of a log type are fixed within a time window under a preset time series analysis strength. The features in the above three dimensions evaluate whether the alarms have periodicity, regularity and stability, and assess whether they conform to the characteristics of normal network access behavior. It should be noted that, in a specific embodiment, taking 1 day as the time window and 1 (A, B) when the preset time series analysis granularity is 30 minutes as an example, the number of logs is four: (16 o'clock, [A]), (17 o'clock, [D]), (18 o'clock, [A]), (19 o'clock, [D]), and the number of attacking IP types is two types A and D, instead of three A, D, A. The information entropy of attacking IP is calculated by the following information entropy calculation formula:

[0068] ;

[0069] wherein, represents the attacking IP list (target list) of a log type within a time window under a preset time series analysis strength, represents each IP in the target list, represents the occurrence probability of the IP, n represents the number of different IPs in the IP list. The more stable the IP list, the lower the information entropy.

[0070] It should be noted that the Fast Fourier Transform (FFT) algorithm is used to respectively calculate the periods existing in the time series of the above three features. FFT is a basic method in time-domain to frequency-domain transformation analysis, which transforms a signal from the time domain to the frequency domain, and synthesizes the time-domain signal with a plurality of sine waves, wherein the frequency of the sine wave with the largest signal amplitude is the period of the sequence.

[0071] Step S14: if the three sequence periods of the target list are consistent and satisfy a preset reasonable rule, and the number of attacking IP types of the log type corresponding to the target list satisfies a type number limitation rule, then the alarm logs of the log type in the time period corresponding to the target list are false positives.

[0072] In this embodiment, by combining the period values ​​of three time series and the statistical characteristics present in the time series analysis benchmark data, a comprehensive determination is made from multiple perspectives to determine whether a certain type of alarm log is a false alarm. Considering the characteristics of normal network access behavior, such as limited and fixed access sources and repetitive access frequencies, this invention first determines whether the period values ​​of each time series are reasonable; secondly, it determines whether the periods of multiple time series are consistent; and finally, it determines whether the attacking IPs that initiate such alarms are limited and fixed to comprehensively determine false alarms. Logs that meet the above determination conditions are recorded and feedback is provided.

[0073] It should be noted that the preset reasonable rule is that the sequence period is less than a predetermined length; the predetermined length is half of the time series corresponding to the sequence period; correspondingly, the rule for limiting the number of categories is that the number of attacking IP categories for the log category corresponding to the target list is less than a predetermined number. It should be noted that a period only exists when the sequence period is less than the predetermined length.

[0074] In summary, existing detection schemes suffer from dependence on models and samples. This application addresses this by starting with the stability, periodicity, and regularity of normal network access behavior. It employs efficient mathematical algorithms to calculate and analyze the sequence characteristics in different alarm logs to achieve false alarm detection, eliminating the need for pre-training and avoiding parameter adjustments for algorithms and models. Regarding the difficulty in fully utilizing external data in existing detection schemes, this application addresses the problem by focusing on the temporal and spatial characteristics of alarm logs themselves, eliminating the need for secondary parsing and correlation operations using external information such as context or threat intelligence. Finally, regarding the balance between timeliness and accuracy in existing detection schemes, this application addresses the issue by flexibly setting time windows to quickly achieve false alarm detection at different time granularities. Furthermore, this scheme can simultaneously analyze multiple time windows, enabling rapid detection of false alarms in a short time while also addressing the issue of ignoring low-frequency and long-term false alarms. Furthermore, the technical solution proposed in this application adopts a configuration-based approach to flexibly analyze the temporal characteristics of alarm logs within different time windows, and can simultaneously consider low-frequency and high-frequency normal network access behaviors, thus ensuring the timeliness and comprehensiveness of false alarm detection. The proposed technical solution does not require prior learning and training, nor does it require additional sample data construction or selection of suitable models, saving time and manpower costs. The proposed technical solution does not require complex models or external data adaptation, and can achieve simple and efficient detection targets based on the information contained in the original logs using mathematical algorithms.

[0075] As can be seen, this application extracts alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows; constructs a target list corresponding to different log types under each preset time series analysis granularity within each time period based on the alarm log data to be detected; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; constructs three time series corresponding to each target list, and calculates the sequence period corresponding to the three time series of each target list; the three time series are the log quantity time series, the attacking IP type time series, and the attacking IP information entropy time series; if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attacking IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm. Therefore, this application directly utilizes the existing content of historical alarm log data for false alarm judgment, without the need for a model, model training, or external data. This saves costs and simplifies the process to improve efficiency. In addition, this application comprehensively considers the sequence period of the three time series and the limitation of the number of attack IP types, using multiple features to judge whether it is a false alarm, thus improving the accuracy of false alarm judgment. In summary, this application ensures accuracy while improving efficiency, achieving a balance between timeliness and accuracy.

[0076] See Figure 2 The diagram illustrates a false alarm detection process. The steps are as follows: 1) Parse the configuration information in the time-series analysis to determine the data reading window, time-series analysis granularity, the key attribute used for aggregation, and the aggregation value attribute. 2) Based on the configured data reading window (e.g., 1 day, 7 days, 30 days), read historical log data for a specific period from storage, while filtering logs with incomplete key attributes, such as lack of attack type or IP information. 3) Extract and aggregate attributes from the historical log data based on the configured key and value attributes to obtain baseline data for different alarm logs. 4) For various alarm logs, construct time-series analysis data for each alarm log from multiple feature dimensions to facilitate subsequent periodic analysis and false alarm determination. See the detailed process below. Figure 3 .

[0077] See Figure 3The diagram illustrates a multi-dimensional time series data construction process. The steps are as follows: 4.1) Aggregate the original data (log baseline data) according to the time series analysis granularity in the configuration file, such as 1 minute, 30 minutes, 1 day, etc., to obtain a temporary list of all attacking IPs for each time granularity. 4.2) Based on the data requirements for time series analysis, complete all missing time granularities in the current data, filling in an empty list of attacking IPs to obtain the baseline data for time series analysis (target list). 4.3) Construct time series for log quantity, attacking IP type, and attacking IP information entropy for periodic calculation: The log quantity time series indicates how many alarms occurred for a log type under a preset time series analysis intensity within a time window; the attacking IP type time series indicates how many different IPs alerted the target for a log type under a preset time series analysis intensity within a time window; the attacking IP information entropy time series indicates whether the attacking IP initiating the alarm for a log type is fixed under a preset time series analysis intensity within a time window. The above three dimensions of characteristics were used to assess whether the alarms were periodic, regular, and stable, and to evaluate whether they conformed to the characteristics of normal network access behavior.

[0078] 5) For the time series with the above three characteristics, the Fast Fourier Transform (FFT) algorithm is used to calculate the period present in the sequence. FFT is a basic method in time-domain to frequency-domain transformation analysis, transforming the signal in the time domain to the frequency domain, and synthesizing the time-domain signal using multiple sine waves. The frequency of the sine wave with the largest signal amplitude is the period of the sequence. 6) Combining the period values ​​of the three time series with the statistical characteristics present in the time series analysis benchmark data, a comprehensive judgment is made from multiple perspectives to determine whether a certain type of alarm log is a false alarm. Considering the characteristics of normal network access behavior, such as limited and fixed access sources and repetitive access frequencies, this invention first determines whether the period values ​​of each time series are reasonable; secondly, it determines whether the periods of multiple time series are consistent; and finally, it determines whether the attacking IPs that initiated this type of alarm are limited and fixed to comprehensively determine false alarms. Logs that meet the above judgment conditions are recorded and feedback is provided.

[0079] Accordingly, this application also discloses a false alarm detection device for network attack alarms, see [link to relevant documentation]. Figure 4 As shown, the device includes:

[0080] The data extraction module 11 is used to extract alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows;

[0081] List building module 12 is used to build a target list corresponding to different log types under each preset time series analysis granularity within each time period based on the alarm log data to be detected; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP is different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity;

[0082] Time series construction module 13 is used to construct three time series corresponding to each of the target lists; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series;

[0083] The sequence period calculation module 14 is used to calculate the sequence period corresponding to the three time series of each of the target lists;

[0084] The false alarm judgment module 15 is used to determine that if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type in the time period corresponding to the target list is a false alarm.

[0085] The more specific working process of each of the above modules can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0086] As can be seen, this application extracts alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows; constructs a target list corresponding to different log types under each preset time series analysis granularity within each time period based on the alarm log data to be detected; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; constructs three time series corresponding to each target list, and calculates the sequence period corresponding to the three time series of each target list; the three time series are the log quantity time series, the attacking IP type time series, and the attacking IP information entropy time series; if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attacking IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type within the time period corresponding to the target list is a false alarm. Therefore, this application directly utilizes the existing content of historical alarm log data for false alarm judgment, without the need for a model, model training, or external data. This saves costs and simplifies the process to improve efficiency. In addition, this application comprehensively considers the sequence period of the three time series and the limitation of the number of attack IP types, using multiple features to judge whether it is a false alarm, thus improving the accuracy of false alarm judgment. In summary, this application ensures accuracy while improving efficiency, achieving a balance between timeliness and accuracy.

[0087] Furthermore, embodiments of this application also provide an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0088] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the false alarm detection method for network attack alarms disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.

[0089] In this embodiment, the power supply 26 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 24 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0090] Furthermore, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon may include computer programs 221, and the storage method may be temporary storage or permanent storage. The computer programs 221 may include, in addition to computer programs capable of performing the false alarm detection method for network attack alarms executed by the electronic device 20 as disclosed in any of the foregoing embodiments, computer programs capable of performing other specific tasks.

[0091] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for detecting false alarms of network attack alerts.

[0092] The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0093] The various embodiments in this application are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. For the same or similar parts between the various embodiments, refer to each other. As for the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and relevant parts can be referred to the method section.

[0094] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0095] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0096] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0097] The above provides a detailed description of the false alarm detection method, apparatus, device, and storage medium for network attack alarms provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting false alarms in network attack alerts, characterized in that, include: Based on several preset data reading windows, extract alarm log data to be detected for several time periods from historical alarm log data; Based on the alarm log data to be detected, a target list corresponding to different log types under each preset time series analysis granularity is constructed within each time period; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; Three time series are constructed for each of the target lists, and the sequence period corresponding to each of the three time series for each target list is calculated; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series. If the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log type corresponding to the target list meets the type number limit rule, then the alarm log of the log type in the time period corresponding to the target list is a false alarm; wherein, the preset reasonable rule is that the sequence period is less than a predetermined length; the predetermined length is half of the time series corresponding to the sequence period.

2. The method for detecting false alarms in network attack alerts according to claim 1, characterized in that, The step of constructing a target list corresponding to different log types at each preset time series analysis granularity within each time period based on the alarm log data to be detected includes: Based on preset key-value attributes, attribute extraction and aggregation are performed on the alarm log data to be detected in different time periods to obtain log baseline data for different log types in different time periods; wherein, the key attribute includes log type and attacked IP, and the value attribute includes attack time and attack IP; Attack IPs are aggregated for each of the aforementioned preset time series analysis granularities to obtain a target list corresponding to different log types under each preset time series analysis granularity within each time period.

3. The method for detecting false alarms in network attack alerts according to claim 2, characterized in that, Before extracting alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows, the process also includes: Extract the preset data reading window, the preset key-value attribute, and the preset time series analysis granularity from the preset configuration information; Accordingly, the method further includes: The preset configuration information is modified according to the actual configuration requirements.

4. The method for detecting false alarms in network attack alerts according to claim 2, characterized in that, The attack IP aggregation is performed on each of the log baseline data based on several preset time series analysis granularities to obtain a target list corresponding to different log types under each preset time series analysis granularity within each time period, including: Based on several preset time series analysis granularities, attack IPs are aggregated for each log baseline data to obtain temporary lists corresponding to different log types under each preset time series analysis granularity within each time period. The temporary list is supplemented to obtain the target list; wherein, the supplementation method is: to determine the target attack time that is missing in the temporary list, and to set the attack IP corresponding to the missing target attack time in the target list to empty.

5. The method for detecting false alarms in network attack alerts according to claim 1, characterized in that, The calculation of the sequence period corresponding to the three time series of each of the target lists includes: The sequence period corresponding to the three time series of each of the target lists is calculated using the Fast Fourier Transform algorithm; wherein the sequence period is the period corresponding to the frequency of the sine wave with the largest signal amplitude.

6. The method for detecting false alarms in network attack alerts according to claim 1, characterized in that, The step of extracting alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows includes: Based on several preset data reading windows, extract raw alarm log data for several time periods from historical alarm log data; The original alarm log data is filtered to obtain the alarm log data to be detected, which contains log data missing key attributes. The key attributes include the original attack time, attacking IP, log type, and attacked IP.

7. The method for detecting false alarms in network attack alerts according to any one of claims 1 to 6, characterized in that, The rule limiting the number of types is that the number of attacking IP types corresponding to the log type in the target list is less than a predetermined number.

8. A false alarm detection device for network attack alerts, characterized in that, include: The data extraction module is used to extract alarm log data to be detected for several time periods from historical alarm log data based on several preset data reading windows; The list construction module is used to construct a target list corresponding to different log types under each preset time series analysis granularity within each time period based on the alarm log data to be detected; the target list includes the target attack time and the attacking IP; the log types are different if the log type and / or the attacked IP are different; the target attack time is the attack time determined based on the original attack time and the preset time series analysis granularity; The time series construction module is used to construct three time series corresponding to each of the target lists; the three time series are log quantity time series, attack IP type time series, and attack IP information entropy time series. The sequence period calculation module is used to calculate the sequence period corresponding to the three time series of each of the target lists; The false alarm judgment module is used to determine if the alarm logs of the log types in the time period corresponding to the target list are false alarms if the three sequence periods of the target list are consistent and meet the preset reasonable rules, and the number of attack IP types of the log types corresponding to the target list meets the type number limit rule; wherein, the preset reasonable rule is that the sequence period is less than a predetermined length; the predetermined length is half of the time series corresponding to the sequence period.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the false alarm detection method for network attack alarms as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the false alarm detection method for network attack alarms as described in any one of claims 1 to 7.

Images