Alarm processing method and system, readable storage medium and electronic equipment

Abstract

The invention relates to the technical field of network security, and discloses an alarm processing method and system, a readable storage medium and electronic equipment. The alarm processing method comprises the following steps: acquiring initial alarm data; determining data format conversion rule information corresponding to the initial alarm data; performing data format conversion on the initial alarm data based on the data format conversion rule information to obtain intermediate alarm data, wherein the intermediate alarm data has a set data format; and performing research and judgment response on the intermediate alarm data based on the research and judgment response strategy information. According to the alarm processing method provided by the invention, the format unification of the alarm data can be realized, so that the redundancy of research and judgment analysis logic caused by the alarm data format difference in the prior art can be reduced, and the complexity of research and judgment analysis is reduced. Moreover, the research and judgment process does not need manual research and judgment analysis, the processing efficiency of the alarm data is high, the time delay is short, and the timeliness of alarm data response is high.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an alarm processing method, system, readable storage medium, and electronic device. Background Art

[0002] With the rapid development of Internet technology and the comprehensive advancement of informatization, network systems have become an indispensable infrastructure for production and life. At the same time, the means of cyber attacks are becoming increasingly diverse and complex, posing challenges to network security.

[0003] In real-time network security monitoring scenarios, a vast number of devices and systems continuously generate diverse alarm data. This alarm data may originate from network devices from different vendors, which often use different formats. Furthermore, different vendors have different definitions of alarm data. This complexity complicates the analysis of alarm data in these different formats. Furthermore, in related technical solutions, manual analysis of alarm data is often performed. This inefficiency in processing large amounts of alarm data leads to slow alarm response times. Summary of the Invention

[0004] In view of this, the present invention provides an alarm processing method, system, readable storage medium and electronic device. The present invention converts the data format of the initial alarm data, and the obtained intermediate alarm data has a set data format, thereby realizing the unification of the format of the intermediate alarm data. Then, the analysis and response strategy information corresponding to the intermediate alarm data is determined, and the intermediate alarm data is analyzed and responded based on the analysis and response strategy information. Since the format of the intermediate data is unified, when the intermediate alarm data is analyzed based on the analysis and response strategy information, the redundancy of the analysis and parsing logic caused by the difference in the alarm data format in the prior art can be reduced, and the complexity of analyzing the alarm data can be reduced. In addition, the present invention can automatically determine the corresponding format conversion rule information based on the initial alarm data, and automatically determine the corresponding analysis and response strategy information based on the intermediate alarm data, without the need for manual analysis and judgment, which can improve the processing efficiency of the alarm data, reduce the delay in alarm data processing, and improve the timeliness of alarm processing.

[0005] In a first aspect, the present invention provides an alarm processing method, comprising: Obtain initial alarm data; Determine data format conversion rule information corresponding to the initial alarm data; Performing data format conversion on the initial alarm data based on the data format conversion rule information to obtain intermediate alarm data, where the intermediate alarm data has a set data format; Determine the analysis and response strategy information corresponding to the intermediate alarm data; Analyze and respond to intermediate alarm data based on analysis and response strategy information.

[0006] In a possible implementation of the first aspect, the initial alarm data includes an initial alarm source field, and the data format conversion rule information corresponding to the initial alarm data is determined in the following manner: The initial alarm source field is input into the set data format conversion rule generation model to obtain data format conversion rule information corresponding to the initial alarm data.

[0007] In a possible implementation of the first aspect, the alarm processing method further includes: receiving a target data format conversion rule generation instruction input by a user, wherein the target data format conversion rule generation instruction includes semantic feature information of the target data format conversion rule; The target data format conversion rule generation instruction is parsed using the set data format conversion rule generation model, and target data format conversion rule information is generated.

[0008] In a possible implementation of the first aspect, determining the analysis and response strategy information corresponding to the intermediate alarm data includes: The intermediate alarm data is input into the set analysis and response model to obtain the analysis and response strategy information corresponding to the intermediate alarm data.

[0009] In a possible implementation of the first aspect, the analysis and response strategy information includes at least one of the following: strategy priority, data source applicable to the strategy, analysis and decision process information, manual marking information, and response action configuration information.

[0010] In a possible implementation of the first aspect, the alarm processing method further includes: Receiving a target analysis and response strategy generation instruction input by a user, wherein the target analysis and response strategy generation instruction includes semantic feature information of the target analysis and response strategy; The target analysis and response strategy generation instructions are analyzed using the set analysis and response model, and target analysis and response strategy information is generated.

[0011] In a possible implementation of the first aspect, the alarm processing method further includes: Display target analysis and response strategy information; Receive modification operations input by the user and modify the target analysis and response strategy information.

[0012] In a possible implementation of the first aspect, the alarm processing method further includes: When it is determined that the intermediate alarm data needs to be reported, a data reporting rule corresponding to the intermediate alarm data is determined based on the response strategy information; The intermediate alarm data is reported using the data reporting rules corresponding to the intermediate alarm data.

[0013] In a possible implementation of the first aspect, determining the data reporting rule corresponding to the intermediate alarm data based on the analysis and response strategy information includes: The analysis and response strategy information is input into the set data reporting field mapping model to obtain the data reporting rules corresponding to the intermediate alarm data.

[0014] In a possible implementation of the first aspect, the alarm processing method further includes: Determine statistical display rule information corresponding to the intermediate alarm data; The intermediate alarm data is counted and displayed according to the statistical display rule information.

[0015] In a possible implementation of the first aspect, the statistical display rule information corresponding to the intermediate alarm data is determined in the following manner: The intermediate alarm data is input into the set statistical display rule generation model to obtain statistical display rule information corresponding to the intermediate alarm data.

[0016] In a possible implementation of the first aspect, the statistical display rule information includes at least one of the following: Display format identifier, alarm data source, statistical period time window, aggregation operator, and query conditions.

[0017] In a possible implementation of the first aspect, the set data format is JSON format.

[0018] In a second aspect, the present invention provides an alarm processing system, comprising: Probe, used to obtain initial alarm data; A data format conversion rule determination module is used to determine data format conversion rule information corresponding to the initial alarm data; A data format conversion module is used to convert the initial alarm data into an intermediate alarm data based on the data format conversion rule information, where the intermediate alarm data has a set data format; The analysis and response strategy determination module is used to determine the analysis and response strategy information corresponding to the intermediate alarm data; The analysis and response module is used to analyze and respond to intermediate alarm data based on the analysis and response strategy information.

[0019] In a possible implementation of the second aspect, the alarm processing system further includes: A data reporting rule determination module is used to determine the data reporting rules corresponding to the intermediate alarm data based on the analysis and response strategy information when it is determined that the intermediate alarm data needs to be reported; The data reporting module is used to report the intermediate alarm data using the data reporting rules corresponding to the intermediate alarm data.

[0020] In a possible implementation of the second aspect, the alarm processing system further includes: A statistical display rule determination module is used to determine statistical display rule information corresponding to the intermediate alarm data; The statistical display module is used to count and display the intermediate alarm data according to the statistical display rule information.

[0021] In a third aspect, the present invention provides a computer-readable storage medium having instructions stored thereon, which, when executed on an electronic device, causes the electronic device to execute the alarm processing method of any one of claims 1-16.

[0022] In a fourth aspect, the present invention provides a computer program product, which includes instructions. When the instructions are executed by one or more processors, they are used to implement the alarm processing method in the first aspect and any possible implementation of the first aspect.

[0023] In a fifth aspect, the present invention provides an electronic device, comprising: It includes a memory and a processor, the memory is used to store a computer program executable by the processor; the processor is used to execute the computer program in the memory to implement the alarm processing method in the above-mentioned first aspect and any possible implementation of the first aspect.

[0024] Compared with the prior art, the present invention has the following advantages: The present invention determines the data format conversion rule information corresponding to the initial alarm data, and then converts the data format of the initial alarm data. The obtained intermediate alarm data has a set data format, thereby achieving the unification of the format of the intermediate alarm data. Then, the analysis and response strategy information corresponding to the intermediate alarm data is determined, and based on the analysis and response strategy information, the intermediate alarm data is analyzed and judged, and the response action corresponding to the intermediate alarm data is triggered. Since the format of the intermediate data is unified, when the intermediate alarm data is analyzed based on the analysis and response strategy information, the redundancy of the analysis and parsing logic caused by the difference in the alarm data format in the prior art can be reduced, and the complexity of analyzing the alarm data can be reduced. In addition, the present invention can automatically determine the corresponding format conversion rule information based on the initial alarm data, and automatically determine the corresponding analysis and response strategy information based on the intermediate alarm data, without the need for manual analysis and judgment, which can improve the processing efficiency of the alarm data, reduce the delay in alarm data processing, and improve the timeliness of alarm processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 According to some embodiments of the present application, a network security application scenario is shown; Figure 2 According to some embodiments of the present application, a flowchart of an alarm processing method is shown; Figure 3 According to some embodiments of the present application, a structural block diagram of an alarm processing system is shown; Figure 4 According to some embodiments of the present application, a structural block diagram of an electronic device is shown. DETAILED DESCRIPTION

[0026] The illustrative embodiments of the present application include, but are not limited to, an alarm processing method, system, readable storage medium, and electronic device.

[0027] Explanation of terms: (1) Probe Probes are core tools for data collection. Their core function is to monitor and collect real-time data on the operating status of a system, network, or application. Probes can be software or hardware tools that capture data through active scanning or passive monitoring. For example, active probes collect data by polling system indicators, while passive probes may obtain information by monitoring network traffic or log files. (2) Kafka Kafka is a distributed stream processing platform. As a message middleware, its core function is to buffer, store, and distribute real-time data to ensure high throughput, low latency, and reliability. In order to make the purpose, technical solutions and advantages of this application more clearly understood, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0028] First, combine Figure 1 , briefly describes a network security application scenario to which this application is applicable.

[0029] refer to Figure 1 The application scenario shown includes a network 100 and an alarm processing system 200. The network 100 includes multiple network devices. The alarm processing system 200 obtains multi-source heterogeneous alarm data generated by multiple network devices in the network 100, and uses the alarm processing method provided in this application to perform research and analysis, etc., so as to ensure network security.

[0030] The following combination Figure 2 , a method for handling alarms provided by this application is introduced in detail. Figure 2 As shown, the alarm processing method provided by this application includes the following steps: S11: Obtain initial alarm data.

[0031] In some embodiments, probes can be used to collect various alarm information from different devices or systems in real time, and the alarm information collected by the probes can be used as initial alarm data. For example, probes can be used to collect log files generated by firewalls, intrusion detection systems, service servers, alarm signals from network devices, and exception reports fed back through application programming interfaces (APIs). It should be understood that because the initial alarm data originates from different devices from different manufacturers, it is multi-source heterogeneous alarm data.

[0032] In some embodiments, after the initial alarm data is obtained by using a probe, the initial alarm data can also be buffered and stored through Kafka, thereby avoiding accumulation or loss of alarm data.

[0033] S12: Determine data format conversion rule information corresponding to the initial alarm data.

[0034] In some embodiments, the above-mentioned initial alarm data includes an initial alarm source field, and the data format conversion rule information corresponding to the initial alarm data is determined in the following manner: the initial alarm source field is input into the set data format conversion rule generation model to obtain the data format conversion rule information corresponding to the initial alarm data.

[0035] For example, initial alarm data is cached in Kafka. The initial alarm data is obtained from Kafka, and then the initial alarm source field corresponding to the initial alarm data is input into the set data format conversion rule generation model, so that the model automatically outputs the data format conversion rule information corresponding to the initial alarm data.

[0036] The above-mentioned data format conversion rule information at least includes a data source identifier, a data source format and a field mapping list. Among them, the above-mentioned field mapping list at least includes a source field name, a target field name, a source data type, a target data type and formatting requirements. The source field name here refers to the name of each field in the initial alarm data; the target field name refers to the name of each field in the intermediate alarm data with a set format obtained after the above-mentioned initial alarm data is converted into a data format; the source data type refers to the data type of the initial alarm data; the target data type refers to the data type of the intermediate alarm data with a set format obtained after the initial alarm data is converted into a data format; the formatting requirements clarify the specific requirements for converting the data format of the initial alarm data. For example, if the initial alarm data is an API message, the formatting requirements clearly state that this API message must be converted into JSON format.

[0037] It should be understood that the specific content of the above-mentioned data format conversion rule information and field mapping list can be set as needed, and this application does not limit this.

[0038] It should be noted that since the initial alarm data comes from multiple devices from different manufacturers, the initial alarm data may include alarm data in JSON format or alarm data in non-JSON format. For alarm data in JSON format, no further format conversion is required. For alarm data in non-JSON format, it is necessary to obtain the data format conversion rule information corresponding to the alarm data in non-JSON format through the above-mentioned set data format conversion rule generation model, so as to perform format conversion on the alarm data in non-JSON format according to this data format conversion rule information and convert the alarm data in non-JSON format into JSON format.

[0039] In some embodiments, the aforementioned data format conversion rule generation model is obtained by pre-training an open source model using cybersecurity corpus and fine-tuning the model using manually annotated field mapping samples. For example, an open source model such as CodeLlama-13B or ChatGLM3-6B is trained using cybersecurity corpus such as firewall logs, Common Vulnerabilities & Exposures Report (CVE), and Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) libraries as data samples. The trained open source model is then fine-tuned using 100,000 manually annotated field mapping samples to obtain the aforementioned data format conversion rule generation model. This improves the model's ability to semantically align specific field names across different vendors.

[0040] It should be understood that in the training of the production model of the above-mentioned data format conversion rules, the data samples are not limited to the above-mentioned firewall logs, CVE reports, ATT&CK knowledge base and other network security corpora. In actual applications, the data samples required for model training can be selected according to actual conditions.

[0041] In some embodiments, the above-mentioned alarm processing method also includes: receiving a target data format conversion rule generation instruction input by the user, wherein the target data format conversion rule generation instruction includes semantic feature information of the target data format conversion rule; using the set data format conversion rule generation model to parse the target data format conversion rule generation instruction, and generate target data format conversion rule information.

[0042] Among them, the target data format conversion rule generation instruction can be a voice instruction. For example, the user describes the data format conversion requirement in natural language. The conversion requirement carries the semantic information of the target data format conversion rule. The semantic feature information of this conversion requirement is extracted, and then the set data format conversion rule generation model is input to generate the corresponding data format conversion rule information. The dynamic generation of various data conversion rules can be realized, so that it can be flexibly applied to various network security alarm processing scenarios.

[0043] In some embodiments, the above-mentioned alarm processing method further includes: adding the target data format conversion rule information to a set data format conversion rule template library.

[0044] For example, a set data format conversion rule template library is maintained in advance, and the corresponding target data format conversion rule information is generated according to the conversion requirements described by the user in natural language using the above-mentioned set data format conversion rule generation model, and then the target data format conversion rule information is added to the set data format conversion rule template library.

[0045] S13: performing data format conversion on the initial alarm data based on the data format conversion rule information to obtain intermediate alarm data, where the intermediate alarm data has a set data format.

[0046] In some embodiments, the data format conversion rule information corresponding to the initial alarm data includes a data source identifier, a data source format, and a field mapping list corresponding to the initial alarm data. After determining the data format conversion rule information corresponding to the initial alarm data, field assignment, data type conversion, and formatting operations can be performed on the initial alarm data according to the field mapping list corresponding to the initial alarm data.

[0047] In some embodiments, the intermediate alarm data is formatted in JSON. By converting the initial alarm data into JSON, the format of heterogeneous alarm data from multiple sources is unified. This eliminates obstacles to subsequent analysis and judgment caused by differences in the formats of these heterogeneous alarm data, improving the timeliness of the analysis and response. Furthermore, since JSON itself has a hierarchical structure, converting alarm data into JSON can quickly locate network issues and improve operational efficiency.

[0048] In some embodiments, if the intermediate alarm data obtained after the data format conversion of the initial alarm data contains abnormalities such as missing fields or format conflicts, the abnormalities can be analyzed, correction suggestions generated, and fed back to the operation and maintenance interface to optimize the data format conversion rule generation model set above. It should be understood that the data format conversion rule information obtained by the optimized data format conversion rule generation model will be more accurate, thereby avoiding the occurrence of the aforementioned abnormalities.

[0049] S14: Determine analysis and response strategy information corresponding to the intermediate alarm data.

[0050] In some embodiments, determining the analysis and response strategy information corresponding to the intermediate alarm data includes inputting the intermediate alarm data into a defined analysis and response model to obtain the analysis and response strategy information corresponding to the intermediate alarm data. Obtaining the analysis and response strategy information through the defined analysis and response model eliminates the need for manual determination of the analysis and response strategy information, thereby improving alarm data processing efficiency, reducing alarm data processing latency, and enhancing the timeliness of alarm responses.

[0051] In some embodiments, in order to improve the accuracy and efficiency of alarm processing, the intermediate alarm data can also be subjected to noise reduction processing first, for example, deduplication and noise reduction, matching noise reduction and alarm suppression, etc., so as to filter out invalid alarm data and duplicate alarm data.

[0052] In some embodiments, the above-mentioned analysis and response strategy information includes at least one of the following: strategy priority, data source applicable to the strategy, analysis and decision process information, manual marking information and response action configuration information.

[0053] The above-mentioned strategy priority defines which analysis and response strategy is executed first when multiple analysis and response strategies are determined based on the same intermediate alarm data.

[0054] The aforementioned policy-applicable data source defines for which intermediate alarm data the analysis and response policy is effective. For example, the analysis and response policy can be specified to be effective only for intermediate alarm data from a specific source. Alternatively, the analysis and response policy can be specified to be effective only for intermediate alarm data that has been converted to a specific data format using specific data format conversion rules. In some embodiments, the analysis and response policy can also be defined to be effective for all intermediate alarm data.

[0055] The above-mentioned analysis and judgment process information definition describes the conditions that must be met by the intermediate alarm data to trigger the corresponding analysis and judgment response action. Among them, there are many ways to analyze the intermediate alarm data: field exact matching, field fuzzy matching, phenomenon description, time range constraint, etc. In some embodiments, when it is determined based on the analysis and judgment process information that the analysis and judgment method for the intermediate alarm data is phenomenon description, the above-mentioned analysis and judgment response model is required to extract the special analysis and judgment response requirements described by the user in natural language, and determine which additional information is needed for analysis and response. For example: for the alarm data of the financial system, the alarm data is analyzed and responded based on additional information such as asset information and the latest log information.

[0056] The above-mentioned manual marking information specifies whether it is necessary to push the analysis and response strategy information to relevant personnel after the corresponding analysis and response strategy information is determined based on the intermediate alarm data through the above-mentioned analysis and response model.

[0057] The above-mentioned response action configuration information specifies which response actions need to be triggered after the corresponding analysis and response strategy information is determined based on the intermediate alarm data through the above-mentioned analysis and response model. For example, the response actions include but are not limited to: sending work orders, blocking IP, blocking domain names, and issuing policies, etc.

[0058] In some embodiments, the above-mentioned alarm processing method further includes: receiving a target analysis and response strategy generation instruction input by a user, wherein the target analysis and response strategy generation instruction includes semantic features of the target analysis and response strategy; parsing the target analysis and response strategy generation instruction using a set analysis and response model, and generating target analysis and response strategy information. Since the set analysis and response model can be used to generate the target analysis and response strategy information based on the target analysis and response strategy generation instruction input by the user, dynamic generation of the analysis and response strategy information can be achieved, eliminating the need for redevelopment based on individual user needs, quickly implementing user customization functions, and avoiding waste of R&D resources.

[0059] In some embodiments, the above-mentioned alarm processing method further includes: displaying target analysis and response strategy information; receiving a modification operation input by a user to modify the target analysis and response strategy information; or receiving a configuration operation input by a user to configure the target analysis and response strategy information. By displaying the target analysis and response strategy information, the user can intuitively understand the target analysis and response strategy information generated in real time by the above-mentioned set analysis and response model according to the target analysis and response strategy generation instruction input by the user, making it easier for the user to modify or configure, facilitating user operations, and improving the user experience.

[0060] S15: Analyze and respond to the intermediate alarm data based on the analysis and response strategy information.

[0061] In some embodiments, since the analysis and response strategy information includes strategy priority, data source applicable to the strategy, analysis and response process information, manual marking information, and response action configuration information, after determining the analysis and response strategy information corresponding to the intermediate alarm data, the intermediate alarm data can be analyzed and the response action corresponding to the intermediate alarm data can be triggered based on the specific content of this analysis and response strategy information. Since the entire analysis and response process does not require manual analysis and can automatically trigger the response action to the intermediate alarm data, the processing efficiency of the alarm data can be improved, the delay in alarm data processing can be reduced, and the timeliness of the alarm response can be improved.

[0062] In some embodiments, after the intermediate alarm data is analyzed based on the analysis and response strategy information, if it is manually marked as an analysis error, the intermediate alarm data and the analysis and response strategy information will be added to the negative samples in the training set of the above-mentioned analysis and response model, and the above-mentioned analysis and response model will extract false alarm features from the intermediate alarm data manually marked as analysis errors. The false alarm features can be added to the whitelist rule library or filled in the original policy template, and then the set analysis and response model can be fine-tuned and trained to improve the alarm analysis efficiency and the analysis accuracy of the set analysis and response model.

[0063] In some embodiments, the above-mentioned alarm processing method also includes: when it is determined that the intermediate alarm data needs to be reported, determining the data reporting rules corresponding to the intermediate alarm data based on the analysis and response strategy information; and reporting the intermediate alarm data using the data reporting rules corresponding to the intermediate alarm data.

[0064] In some embodiments, the above-mentioned determination of the data reporting rules corresponding to the intermediate alarm data based on the analysis and response strategy information includes: inputting the analysis and response strategy information into the set data reporting field mapping model to obtain the data reporting rules corresponding to the intermediate alarm data.

[0065] After determining the data reporting rules corresponding to the intermediate alarm data, the fields of the intermediate alarm data can be mapped according to the rules to obtain the data to be reported, thereby realizing rapid conversion between the intermediate alarm data and the data to be reported.

[0066] In some embodiments, if the data reporting rules corresponding to the intermediate alarm data determine that the alarm data should be reported via an API interface, an HTTP interface can be called to send the data to be reported via that interface. If the data reporting rules corresponding to the intermediate alarm data determine that the alarm data should be reported via Kafka, the data to be reported can be pushed to the corresponding Kafka. In some embodiments, the reported data and reporting results can also be stored in a distributed real-time search and analysis engine to facilitate subsequent data retrieval.

[0067] In some embodiments, the data reporting rule corresponding to the intermediate alarm data may also be determined based on the identifier of the analysis and response strategy corresponding to the intermediate alarm data or the identifier of the data format conversion rule corresponding to the initial alarm data.

[0068] In some embodiments, the alarm processing method further includes: receiving a user-input instruction for generating processing logic; parsing the instruction for generating processing logic code using a set processing logic generation model, and generating the set processing logic. This process of generating the set processing logic can also be referred to as a custom special logic conversion process. The user-input instruction for generating processing logic can be a user-defined requirement for generating processing logic described in natural language. The set processing logic can be processing logic represented by a piece of code.

[0069] In addition, in some embodiments, the above-mentioned data reporting rules and the above-mentioned set processing logic can be modified and debugged by integrating the set rule test sandbox environment.

[0070] In some embodiments, the alarm processing method further includes: performing setting processing on the intermediate alarm data using setting processing logic. For example, for alarm data indicating a virus infection, the risk level field (risk_level) is extracted and converted to an enumeration value, and the decimal report number field (report_num) in the alarm data is converted to scientific notation.

[0071] In some embodiments, the above-mentioned alarm processing method further includes: determining statistical display rule information corresponding to the intermediate alarm data; and performing statistics and display on the intermediate alarm data according to the statistical display rule information.

[0072] In some embodiments, the statistical display rule information corresponding to the intermediate alarm data is determined in the following manner: the intermediate alarm data is input into a set statistical display rule generation model to obtain the statistical display rule information corresponding to the intermediate alarm data.

[0073] For example, in some embodiments, if it is determined based on the statistical display rule information that a Word report needs to be generated, the data to be displayed can be injected into the placeholder area of ​​a predefined DOCX template, and an asynchronous rendering queue can be enabled to generate the Word report. For another example, in other embodiments, if it is determined based on the statistical display rule information that a large-screen display of the alarm data is required, a large-screen thumbnail can be generated, and if an operation is received to click to view the thumbnail, the corresponding large-screen display function can be triggered.

[0074] In some embodiments, the statistical display rule information includes at least one of the following: a display format identifier, an alarm data source, a statistical period time window, an aggregation operator, and a query condition.

[0075] In some embodiments, the above query conditions may also be converted into a set query language, such as the AiQL query language, to facilitate subsequent screening of the alarm data.

[0076] It can be understood that the execution order of the above steps 11 to S15 is only an illustration. In other embodiments, other execution orders may be adopted, and some steps may be split or combined, which is not limited here.

[0077] In addition, the present invention also provides an alarm processing system, see Figure 3 , the alarm processing system 200 includes: Probe 201, used for acquiring initial alarm data, where the initial alarm data has a first data format; The data format conversion rule determination module 202 is used to determine the data format conversion rule information corresponding to the initial alarm data; The data format conversion module 203 is configured to convert the initial alarm data into an intermediate alarm data based on the data format conversion rule information, wherein the intermediate alarm data has a set data format that is different from the first data format. The analysis and response strategy determination module 204 is used to determine the analysis and response strategy information corresponding to the intermediate alarm data; The analysis and response module 205 is used to analyze and respond to the intermediate alarm data based on the analysis and response strategy information.

[0078] In some embodiments, the alarm processing system 200 further includes: The data reporting rule determination module 206 is configured to determine, when it is determined that the intermediate alarm data needs to be reported, a data reporting rule corresponding to the intermediate alarm data based on the analysis and response strategy information; The data reporting module 207 is configured to report the intermediate alarm data using a data reporting rule corresponding to the intermediate alarm data.

[0079] In some embodiments, the alarm processing system 200 further includes: The statistical display rule determination module 208 is used to determine statistical display rule information corresponding to the intermediate alarm data; The statistics display module 209 is used to collect statistics and display the intermediate alarm data according to the statistics display rule information.

[0080] Regarding the alarm processing system 200 in the above embodiment, the specific processing method of each module has been described in detail in the embodiment of the method, and will not be elaborated here.

[0081] This application also provides an electronic device 300, such as Figure 4 As shown, the electronic device 300 includes a memory 301 and a processor 302. The memory 301 is used to store computer programs executable by the processor 302; the processor 302 is used to execute the computer program in the memory 301 to implement the alarm processing method provided in any one of the above embodiments.

[0082] Figure 4 The electronic device 300 shown further includes a communication interface 303. The processor 302, the memory 301 and the communication interface 303 are connected via a communication bus and communicate with each other.

[0083] The processor 302 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above-mentioned programs.

[0084] The communication interface 303 is used to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc.

[0085] The memory 301 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory can be independent and connected to the processor via a bus. The memory can also be integrated with the processor.

[0086] An embodiment of the present invention further provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed on an electronic device, the electronic device executes the alarm processing method provided in any of the above embodiments.

[0087] An embodiment of the present invention further provides a computer program product, which includes instructions. When the instructions are executed by one or more processors, they are used to implement the alarm processing method provided in any of the above embodiments.

[0088] The various embodiments of the mechanisms disclosed in the present invention can be implemented in hardware, software, firmware, or a combination of these implementation methods. The embodiments of the present invention can be implemented as a computer program or program code executed on a programmable system, the programmable system including at least one processor, a storage system (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device.

[0089] It should be noted that the various units / modules mentioned in the various device embodiments of the present invention are all logical units / modules. Physically, a logical unit / module can be a physical unit / module, or a part of a physical unit / module, or can be implemented as a combination of multiple physical units / modules. The physical implementation of these logical units / modules themselves is not the most important. The combination of functions implemented by these logical units / modules is the key to solving the technical problems raised by the present invention. In addition, in order to highlight the innovative part of the present invention, the above-mentioned device embodiments of the present invention do not introduce units / modules that are not closely related to solving the technical problems raised by the present invention. This does not mean that other units / modules do not exist in the above-mentioned device embodiments.

[0090] It should be noted that in the examples and description of this patent, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "including a" does not exclude the presence of other identical elements in the process, method, article or device that includes the element.

[0091] While the present invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

Claims

1. An alarm processing method, characterized in that: include: Obtain initial alarm data; Determining data format conversion rule information corresponding to the initial alarm data; performing data format conversion on the initial alarm data based on the data format conversion rule information to obtain intermediate alarm data, wherein the intermediate alarm data has a set data format; Determining analysis and response strategy information corresponding to the intermediate alarm data; The intermediate alarm data is analyzed and responded to based on the analysis and response strategy information.

2. The alarm processing method according to claim 1, characterized in that: The initial alarm data includes an initial alarm source field, and the data format conversion rule information corresponding to the initial alarm data is determined in the following manner: The initial alarm source field is input into a set data format conversion rule generation model to obtain data format conversion rule information corresponding to the initial alarm data.

3. The alarm processing method according to claim 2, characterized in that: The method further comprises: Receiving a target data format conversion rule generation instruction input by a user, wherein the target data format conversion rule generation instruction includes semantic feature information of the target data format conversion rule; The target data format conversion rule generation instruction is parsed using the set data format conversion rule generation model, and target data format conversion rule information is generated.

4. The alarm processing method according to claim 1, characterized in that: The determining of analysis and response strategy information corresponding to the intermediate alarm data includes: The intermediate alarm data is input into a set analysis and response model to obtain analysis and response strategy information corresponding to the intermediate alarm data.

5. The alarm processing method according to claim 4, characterized in that: The analysis and response strategy information includes at least one of the following: strategy priority, data source applicable to the strategy, analysis and response process information, manual marking information and response action configuration information.

6. The alarm processing method according to claim 4, characterized in that: The method further comprises: Receiving a target analysis and response strategy generation instruction input by a user, wherein the target analysis and response strategy generation instruction includes semantic feature information of the target analysis and response strategy; The target analysis and response strategy generation instruction is parsed using the set analysis and response model, and target analysis and response strategy information is generated.

7. The alarm processing method according to claim 6, characterized in that: The method further comprises: Displaying the target analysis and response strategy information; Receive the modification operation input by the user and modify the target analysis and response strategy information.

8. The alarm processing method according to claim 1, characterized in that: The method further comprises: In the case where it is determined that the intermediate alarm data needs to be reported, determining a data reporting rule corresponding to the intermediate alarm data based on the analysis and response strategy information; The intermediate alarm data is reported using a data reporting rule corresponding to the intermediate alarm data.

9. The alarm processing method according to claim 8, characterized in that: The determining of a data reporting rule corresponding to the intermediate alarm data based on the analysis and response strategy information includes: The analysis and response strategy information is input into a set data reporting field mapping model to obtain a data reporting rule corresponding to the intermediate alarm data.

10. The alarm processing method according to claim 9, characterized in that: The method further comprises: Determining statistical display rule information corresponding to the intermediate alarm data; The intermediate alarm data is counted and displayed according to the statistical display rule information.

11. The alarm processing method according to claim 10, characterized in that: The statistical display rule information corresponding to the intermediate alarm data is determined in the following manner: The intermediate alarm data is input into a set statistical display rule generation model to obtain statistical display rule information corresponding to the intermediate alarm data.

12. The alarm processing method according to claim 11, characterized in that: The statistical display rule information includes at least one of the following: Display format identifier, alarm data source, statistical period time window, aggregation operator, and query conditions.

13. An alarm processing system, characterized in that: include: Probe, used to obtain initial alarm data; A data format conversion rule determination module, configured to determine data format conversion rule information corresponding to the initial alarm data; a data format conversion module, configured to convert the initial alarm data into an intermediate alarm data based on the data format conversion rule information, wherein the intermediate alarm data has a set data format; An analysis and response strategy determination module is used to determine analysis and response strategy information corresponding to the intermediate alarm data; An analysis and response module is used to analyze and respond to the intermediate alarm data based on the analysis and response strategy information.

14. The alarm processing system according to claim 13, characterized in that: Also includes: a data reporting rule determination module, configured to, when determining that the intermediate alarm data needs to be reported, determine a data reporting rule corresponding to the intermediate alarm data based on the analysis and response strategy information; The data reporting module is configured to report the intermediate alarm data using a data reporting rule corresponding to the intermediate alarm data.

15. The alarm processing system according to claim 13, characterized in that: Also includes: A statistical display rule determination module, configured to determine statistical display rule information corresponding to the intermediate alarm data; The statistical display module is used to count and display the intermediate alarm data according to the statistical display rule information.

16. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, which, when executed on an electronic device, enable the electronic device to execute the alarm processing method according to any one of claims 1 to 12.

17. A computer program product, characterized in that The computer program product comprises instructions, which, when executed by one or more processors, are used to implement the alarm processing method according to any one of claims 1 to 12.

18. An electronic device, characterized in that: include: comprising a memory and a processor, wherein the memory is used to store a computer program executable by the processor; The processor is configured to execute the computer program in the memory to implement the alarm processing method according to any one of claims 1 to 12.

Images