Alarm management method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses an alarm management method and device, equipment and a storage medium, which can be applied to scenes such as smart traffic, auxiliary driving, cloud technology and artificial intelligence. The method comprises the following steps: if an alarm event is detected to be triggered, acquiring process tree information from alarm data corresponding to the alarm event, then acquiring a process feature set matched with the process tree information, and then analyzing the process tree information based on the process feature set to obtain a process feature set; the method comprises the steps of obtaining investigation direction information and a false alarm preliminary evaluation result aiming at an alarm event, then conducting investigation evidence obtaining from an investigation direction indicated by the investigation direction information to obtain an evidence obtaining result, and then generating a false alarm evaluation result aiming at the alarm event based on the evidence obtaining result and the false alarm preliminary evaluation result. According to the technical scheme, the accuracy and efficiency of alarm management are improved, and the reliability of alarm management is high.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to an alarm management method, an alarm management device, an electronic device, and a computer readable medium. BACKGROUND

[0002] At present, the security of network equipment is crucial, and thus security alarms for network equipment emerge as the times require, wherein the security alarm refers to a notification that a network equipment such as an Endpoint Detection and Response (EDR) equipment detects a potential security threat or abnormal behavior, so as to be able to timely handle or respond based on the security alarm.

[0003] In the related art, there is usually a false alarm situation of security alarms (also referred to as alarm events), and the accuracy of alarm management is low, and whether the alarm event is false alarm also needs to be artificially judged to determine the accuracy and / or importance of the alarm event, and the efficiency of alarm management is also low.

[0004] Therefore, how to better perform alarm management to improve the reliability of alarm management is a problem to be solved. SUMMARY

[0005] Embodiments of the present application provide an alarm management method, device, equipment and storage medium, which improve the accuracy and efficiency of alarm management, and the reliability of alarm management is high.

[0006] In a first aspect, the embodiments of the present application provide an alarm management method, comprising: if a trigger alarm event is detected, obtaining process tree information from alarm data corresponding to the alarm event; obtaining a process feature set matched with the process tree information; performing analysis processing on the process tree information based on the process feature set to obtain investigation direction information and a false alarm preliminary evaluation result for the alarm event; investigating and collecting evidence from the investigation direction indicated by the investigation direction information to obtain an evidence collection result; and generating a false alarm evaluation result for the alarm event based on the evidence collection result and the false alarm preliminary evaluation result.

[0007] In a second aspect, an alarm management apparatus is provided. The apparatus includes a first obtaining module configured to obtain process tree information from alarm data corresponding to a triggered alarm event; a second obtaining module configured to obtain a process feature set matching the process tree information; an analyzing module configured to analyze the process tree information based on the process feature set to obtain investigation direction information and a preliminary false alarm evaluation result for the alarm event; a forensics module configured to investigate and collect evidence from the investigation direction indicated by the investigation direction information to obtain a forensics result; and a generating module configured to generate a false alarm evaluation result for the alarm event based on the forensics result and the preliminary false alarm evaluation result.

[0008] In an embodiment of the present application, based on the foregoing scheme, the second obtaining module is specifically configured to extract process identification information from the process tree information, and select a process feature set matching the process identification information from process feature sets respectively corresponding to a plurality of processes, wherein the process feature set includes at least one of process function, process behavior, process startup path, process signature organization, and false alarm operation prone to cause false alarms of the alarm event.

[0009] In an embodiment of the present application, based on the foregoing scheme, the process identification information includes a process name, and the second obtaining module is further specifically configured to compare the extracted process name with process names respectively corresponding to a plurality of processes, and take a process corresponding to a process name that passes the comparison as a target process, and select a process feature set corresponding to the target process from process feature sets respectively corresponding to a plurality of processes.

[0010] In an embodiment of the present application, based on the foregoing scheme, the second obtaining module is further specifically configured to perform vector conversion processing on the extracted process identification information to obtain a first vector, and perform vector conversion processing on process identification information respectively corresponding to a plurality of processes to obtain a plurality of second vectors, calculate a correlation degree between the first vector and each second vector, take a process corresponding to a second vector with a correlation degree greater than a preset correlation degree threshold as a target process, and select a process feature set corresponding to the target process from process feature sets respectively corresponding to a plurality of processes.

[0011] In an embodiment of the present application, based on the foregoing scheme, the analyzing module is specifically configured to perform security level detection on the process tree information based on the process feature set to obtain a detection result, generate a preliminary false alarm evaluation result for the alarm event based on the detection result, and generate investigation direction information for the alarm event based on the detection result and the alarm data.

[0012] In an embodiment of the present application, based on the foregoing scheme, the analysis module is further specifically configured to: if the process feature set includes process behavior, performing security level detection on the process behavior contained in the process tree information based on preset alarm rules and the process behavior to obtain a detection result; if the process feature set includes process startup path, performing security level detection on the process startup path contained in the process tree information based on the process startup path to obtain a detection result; if the process feature set includes process signature organization, performing security level detection on the process signature organization contained in the process tree information based on the process signature organization to obtain a detection result; and if the process feature set includes false alarm operation that can easily cause false alarm of the alarm event, performing security level detection on the alarm operation contained in the process tree information based on the false alarm operation to obtain a detection result.

[0013] In an embodiment of the present application, based on the foregoing scheme, the analysis module is further specifically configured to: perform at least one of the following security level detection on the process tree information: performing security level detection on the use parameter contained in the process tree information to obtain a detection result; and performing security level detection on the calling relationship between processes contained in the process tree information to obtain a detection result.

[0014] In an embodiment of the present application, based on the foregoing scheme, the detection result is multiple; and the analysis module is further specifically configured to: if there are a first preset number of detection results with security level higher than a preset security level threshold in the multiple detection results, generating a preliminary evaluation result for representing that the false alarm probability of the alarm event is greater than a preset probability threshold; and if there are a second preset number of detection results with security level lower than the preset security level threshold in the multiple detection results, generating a preliminary evaluation result for representing that the false alarm probability of the alarm event is less than or equal to the preset probability threshold.

[0015] In an embodiment of the present application, based on the foregoing scheme, the detection result is multiple; and the analysis module is further specifically configured to: if the security level of all detection results in the multiple detection results is higher than a preset security level threshold, performing analysis processing on the alarm data to obtain a deep detection direction of the alarm event triggered by an attack, and generating investigation direction information for the alarm event based on the deep detection direction; and if there is at least one detection result with security level lower than a preset security level threshold in the multiple detection results, performing analysis processing on the alarm data and the at least one detection result to obtain a deep detection direction of the alarm event triggered by an attack, and generating investigation direction information for the alarm event based on the deep detection direction.

[0016] In an embodiment of the present application, based on the foregoing scheme, the evidence obtaining module is specifically configured to: generate agent calling code matched with the investigation direction indicated by the investigation direction information; and call agent implementation code through the agent calling code to run the agent implementation code to obtain evidence results.

[0017] In an embodiment of the present application, based on the foregoing scheme, the investigation direction information includes a plurality of investigation questions; and the evidence obtaining module is further specifically configured to: for each investigation question, generate question content corresponding to the investigation question and tool identification information required to be used to solve the investigation question, and generate agent calling code matched with the investigation question based on the question content and the tool identification information as parameters of the agent calling code to be generated.

[0018] In an embodiment of the present application, based on the foregoing scheme, the evidence obtaining module is further specifically configured to: combine the agent calling code and the agent implementation code to generate a code item; and start the code item in a sandbox to call the agent implementation code located in the sandbox through the agent calling code located in the sandbox to obtain evidence results.

[0019] In an embodiment of the present application, based on the foregoing scheme, the evidence results are a plurality of evidence results; and the generation module is specifically configured to: if there is at least one evidence result for representing that the alarm event is triggered by an attack in the plurality of evidence results, and the preliminary false alarm evaluation result is that the false alarm probability of the alarm event is less than or equal to a preset probability threshold, obtain an evaluation result for representing that the alarm event is not false alarm; and if there is no evidence result for representing that the alarm event is triggered by an attack in the plurality of evidence results, and the preliminary false alarm evaluation result is that the false alarm probability of the alarm event is greater than the preset probability threshold, obtain an evaluation result for representing that the alarm event is false alarm.

[0020] In an embodiment of the present application, based on the foregoing scheme, the analysis module is specifically configured to: input the process feature set and the process tree information into a display interface corresponding to the investigation model, so that the investigation model analyzes and processes the process tree information based on the process feature set to obtain investigation direction information and a preliminary false alarm evaluation result for the alarm event output by the investigation model in the display interface; the evidence obtaining module is specifically configured to: investigate and obtain evidence from the investigation direction indicated by the investigation direction information through the investigation model to obtain evidence results output by the investigation model in the display interface; and the generation module is specifically configured to: obtain a false alarm evaluation result for the alarm event output by the investigation model in the display interface based on the evidence results and the preliminary false alarm evaluation result through the investigation model.

[0021] In a third aspect, an electronic device is provided, which includes one or more processors; and a memory storing one or more programs, when the one or more programs are executed by the one or more processors, the electronic device implements the alarm management method as described above.

[0022] In a fourth aspect, a computer readable medium is provided, which stores a computer program, when the computer program is executed by a processor, the alarm management method as described above is implemented.

[0023] In a fifth aspect, a computer program product is provided, which includes computer instructions, when the computer instructions are executed by a processor, the alarm management method as described above is implemented.

[0024] In the technical solutions provided by the embodiments of the present application:

[0025] On the one hand, the process tree information is obtained from the alarm data corresponding to the triggered alarm event, and the process tree information is parsed by using the process feature set matched with the process tree information. Since the feature information of the process feature set is comprehensive and accurate, the explainability of the false alarm preliminary evaluation result and the investigation direction information obtained by parsing for the alarm event is strong, which improves the accuracy of the false alarm preliminary evaluation result and the investigation direction information, thereby improving the accuracy of the alarm management.

[0026] On the one hand, the investigation direction information is obtained at the same time when the false alarm preliminary evaluation result is parsed, that is, the related investigation suggestion for whether the alarm event is false is given. Thus, the investigation evidence can be obtained according to the investigation suggestion, and the false alarm final evaluation result is obtained by using the evidence and the false alarm preliminary evaluation result, which realizes the automatic judgment for whether the alarm event is false, avoids the phenomena such as time-consuming and laborious, easy to make mistakes and the like in the related art which depends on human judgment, and improves the efficiency and accuracy of the alarm management.

[0027] That is, the technical solutions of the present application improve the accuracy and efficiency of the alarm management, and the reliability of the alarm management is high.

[0028] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 is a schematic diagram of an exemplary implementation environment to which the technical solutions of the embodiments of the present application can be applied.

[0030] Figure 2 is a flowchart of an alarm management method shown by an exemplary embodiment of the present application.

[0031] Figure 3 is a flowchart of an alarm management method according to another example embodiment of the present application.

[0032] Figure 4 is a flowchart of an alarm management method according to another example embodiment of the present application.

[0033] Figure 5 is a flowchart of an alarm management method according to another example embodiment of the present application.

[0034] Figure 6 is a flowchart of an alarm management method according to another example embodiment of the present application.

[0035] Figure 7 is a flowchart of an alarm management method according to another example embodiment of the present application.

[0036] Figure 8A and Figure 8B is a schematic diagram of a visual display according to an example embodiment of the present application.

[0037] Figure 9 is a schematic diagram of a survey model implementation according to an example embodiment of the present application.

[0038] Figure 10 is a schematic diagram of a survey model processing according to an example embodiment of the present application.

[0039] Figure 11 is a flowchart of an alarm management method according to another example embodiment of the present application.

[0040] Figure 12 is a block diagram of an alarm management apparatus according to an example embodiment of the present application.

[0041] Figure 13 is a schematic diagram of a computer system of an electronic device suitable for implementing embodiments of the present application. DETAILED DESCRIPTION

[0042] The example embodiments will be described in detail in this document with reference to the drawings. Wherever possible, the same reference numbers will be used in various drawings and the following description to refer to the same or like parts. The embodiments described in the following examples do not represent all the implementations in accordance with this application. Instead, they merely represent different ways of implementing some aspects of this application, as detailed in the appended claims.

[0043] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0044] The block diagrams shown in the drawings are only functional entities, and do not necessarily have to correspond to physically independent entities. That is, these functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0045] The flowcharts shown in the drawings are only exemplary illustrations, and do not necessarily include all contents and operations / steps, nor do they have to be executed in the order described. For example, some operations / steps can be further decomposed, and some operations / steps can be combined or partially combined, so the actual execution order can be changed according to the actual situation.

[0046] It should be noted that "multiple" as mentioned in the present application refers to two or more. The association relationship of "and / or" describes the associated objects, which means that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone. The character " / " generally represents an "or" relationship between the associated objects before and after it.

[0047] At present, the security of network equipment is crucial, and thus security alerts for network equipment have emerged, wherein the security alert refers to a notification that a network equipment such as an EDR device detects a potential security threat or abnormal behavior, so as to be able to timely handle or respond based on the security alert. In the related art, there is usually a false alarm of the security alert (also referred to as an alarm event), the accuracy of alarm management is low, and whether the alarm event is false needs to be manually judged to determine the accuracy and / or importance of the alarm event, and the efficiency of alarm management is also low.

[0048] Therefore, in order to better manage the alarm and improve the reliability of alarm management, the present application provides an alarm management scheme. Please refer to Figure 1 , Figure 1 is a schematic diagram of an implementation environment related by the present application. The implementation environment mainly includes a terminal device 101 and a server 102, wherein:

[0049] The terminal device 101 includes, but is not limited to, a smart phone, a tablet computer, a television, a notebook computer, a desktop computer, and the like.

[0050] The server 102 can be a standalone physical server, or a server cluster or a distributed system composed of multiple physical servers, wherein the server cluster or the distributed system includes cloud servers for providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0051] It can be understood that the terminal device 101 and the server 102 establish a communication connection through a wired or wireless network. Exemplarily, the wireless network or the wired network uses standard communication technology and / or protocols. The network is usually the Internet, but can also be any other network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a private network or any combination of virtual private networks, and the like.

[0052] In an embodiment of the present application, the alarm management method can be executed by the terminal device 101. Specifically, the terminal device 101 detects a trigger alarm event, obtains process tree information from alarm data corresponding to the alarm event, then obtains a process feature set matched with the process tree information, then performs analysis and processing on the process tree information based on the process feature set, obtains investigation direction information and a preliminary false alarm evaluation result for the alarm event, then investigates and collects evidence from the investigation direction indicated by the investigation direction information, obtains the evidence collection result, and finally generates a false alarm evaluation result for the alarm event based on the evidence collection result and the preliminary false alarm evaluation result.

[0053] In an embodiment of the present application, the alarm management method can be executed by the server 102. Specifically, the server 102 detects a trigger alarm event, obtains process tree information from alarm data corresponding to the alarm event, then obtains a process feature set matched with the process tree information, then performs analysis and processing on the process tree information based on the process feature set, obtains investigation direction information and a preliminary false alarm evaluation result for the alarm event, then investigates and collects evidence from the investigation direction indicated by the investigation direction information, obtains the evidence collection result, and finally generates a false alarm evaluation result for the alarm event based on the evidence collection result and the preliminary false alarm evaluation result.

[0054] In an embodiment of the present application, the alarm management method can also be executed by the terminal device 101 and the server 102 interactively, and in actual application, can be flexibly adjusted according to specific application scenarios.

[0055] It should be clear that, Figure 1 The number of terminal devices 101 and servers 102 in the above-mentioned system is only illustrative, and according to actual needs, there can be any number of terminal devices 101 and servers 102.

[0056] It should be noted that in the specific embodiments of the present application, user-related data is involved, and when the embodiments of the present application are applied to specific products or technologies, user permission or consent needs to be obtained, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0057] The various implementation details of the technical solutions of the embodiments of the present application are described in detail as follows:

[0058] Please refer to Figure 2 , Figure 2 is a flowchart of an alarm management method according to an embodiment of the present application, which can be executed by the server 102. As Figure 2 shown, the alarm management method at least includes S201 to S205, which are described in detail as follows:

[0059] S201, if it is detected that an alarm event is triggered, process tree information is obtained from alarm data corresponding to the alarm event.

[0060] In the embodiments of the present application, the server can detect in real time whether an alarm event is triggered.

[0061] Optionally, when a network device such as an EDR device detects that there is a potential security threat or abnormal behavior in the network, it can send alarm information to the server; correspondingly, when the server receives the alarm information sent by the network device, it is detected that the alarm event is triggered at this time; and when the network device does not detect that there is a potential security threat or abnormal behavior in the network, the server will not receive the alarm information sent by the network device, that is, the server detects that the alarm event is not triggered at this time.

[0062] Optionally, the server can also detect that there is a potential security threat or abnormal behavior in the network and send an alarm message at this time, and the server detects that the alarm event is triggered; and when the server does not detect that there is a potential security threat or abnormal behavior in the network, the server detects that the alarm event is not triggered, and then continues to detect.

[0063] It should be clear that the alarm event corresponds to alarm data, and the alarm data is different according to the different protection objects, and in actual application, it can be flexibly adjusted according to the specific application scene.

[0064] The process tree information in the embodiment of the application refers to a tree structure used to represent the relationship between processes in an operating system. In the process tree, each process has a parent process and zero or more child processes. This hierarchical organization helps to understand and manage the dependency relationships and execution order between processes.

[0065] In the embodiment of the application, the server can obtain the process tree information from the alarm data corresponding to the alarm event after detecting the triggering alarm event, that is, extract the process tree information from the alarm data corresponding to the alarm event after detecting the triggering alarm event, so as to use the process tree information to automatically analyze the triggering alarm event.

[0066] S202, obtaining a process feature set matched with the process tree information.

[0067] In the embodiment of the application, the server obtains the process tree information from the alarm data corresponding to the triggered alarm event, and then obtains a process feature set matched with the process tree information.

[0068] In the embodiment of the application, the process feature set refers to a set of features related to a process, which includes but is not limited to at least one of process function, process behavior, process startup path, process signature organization, and false positive operation prone to cause false positives of alarm events. That is, in the embodiment of the application, the process function, process behavior, process startup path, process signature organization, and false positive operation prone to cause false positives of alarm events all belong to the features related to the process, wherein:

[0069] Process function refers to the task or function performed by a process. It can be understood that each process has one or more specific functions, which may involve file operations, network communication, computing tasks, etc. For example, the functions of a text editor process include opening, editing, and saving files.

[0070] Process behavior refers to the actions or operations exhibited by a process when it performs its tasks or functions. It can be understood that process behavior is very important for analyzing the running status of a process and detecting abnormal behavior. Process behavior can include file reading and writing, network connection, system call, etc. For example, a normal web browser process may have behaviors related to network communication, such as establishing a Transmission Control Protocol (TCP) connection and sending a Hypertext Transfer Protocol (HTTP) request.

[0071] The process startup path refers to the process of creating and starting a process, including but not limited to the way the process is started, the parameter settings at the time of starting, and the parent process that creates the process, and the like. It can be understood that by analyzing the startup path of the process, the dependency relationship and call chain between processes can be understood, for example, a system service process can be started by the startup script when the operating system is booted.

[0072] The process signature organization refers to the digital signature mechanism of the process, which can be used to verify the authenticity and integrity of the process, which is usually signed by the process developer or software vendor to ensure that the source of the process is trusted and has not been tampered with. It can be understood that by verifying the signature of the process, malicious software or unauthorized programs can be prevented from running in the system.

[0073] The false positive event that the process is prone to cause is an event that mistakenly considers a legitimate operation of the process as malicious or abnormal. This situation can be caused by false positives of security software, configuration errors, or changes in system environment, and the like.

[0074] It should be clear that in actual applications, the features related to the process can be flexibly adjusted according to specific application scenarios.

[0075] In the embodiments of the application, the server can pre-acquire process feature sets corresponding to a plurality of processes respectively, and store them in a corresponding database (referred to as a process feature library).

[0076] Optionally, the process feature library includes a process information list. The process information list includes process feature sets corresponding to a plurality of processes respectively, and the process feature set of each process includes but is not limited to the process name, the process function (referred to as the main function), the process behavior (referred to as the common behavior), the process startup path (referred to as the startup path), the process signature organization (referred to as the signature organization), and the false positive operation that the process is prone to cause (referred to as the possible false positive), and the like.

[0077] Optionally, the process feature library includes software information and a process information list. It can be understood that the process is associated with the software, so the process feature library can also include software information, which includes but is not limited to the software name, the software category label (referred to as the category label), and the software function (referred to as the function description); wherein the process information list is described above and will not be described here.

[0078] For example, taking the Microsoft Word stored in the json format as an example:

[0079]

[0080]

[0081] The server in the embodiments of the present application can find a process feature set matching the process tree information from the process feature library, thereby supplementing the process tree information and obtaining more fine-grained data.

[0082] In S203, the process tree information is analyzed based on the process feature set to obtain investigation direction information and a preliminary false alarm evaluation result for the alarm event.

[0083] In the embodiments of the present application, the server obtains the process feature set, and then analyzes the process tree information based on the process feature set to obtain the investigation direction information and the preliminary false alarm evaluation result for the alarm event.

[0084] In the embodiments of the present application, the investigation direction information refers to aspects or fields that need to be focused on and studied when processing the alarm event. These directions provide corresponding guidance to ensure comprehensive and systematic investigation and evaluation of the alarm event.

[0085] Optionally, the investigation direction indicated by the investigation direction information can be one or more; and when the investigation direction is multiple and the multiple investigation directions have no execution sequence limitation, the investigation can be carried out from multiple investigation directions in parallel, thereby improving the investigation efficiency.

[0086] In the embodiments of the present application, the preliminary false alarm evaluation result refers to a conclusion or result obtained after preliminary evaluation of the alarm event. The evaluation result helps to preliminarily determine whether the alarm event is a false alarm and provides guidance for subsequent processing.

[0087] Optionally, the preliminary false alarm evaluation result includes four cases: case 1, the false alarm possibility is very small; case 2, the false alarm possibility is medium and small; case 3, the false alarm possibility is medium and large; and case 4, the false alarm possibility is very large.

[0088] In S204, evidence is collected from the investigation direction indicated by the investigation direction information to obtain a collection result.

[0089] In the embodiments of the present application, the server obtains the investigation direction information for the alarm event, and then collects evidence from the investigation direction indicated by the investigation direction information to obtain a collection result, thereby verifying whether the preliminary false alarm evaluation result is correct.

[0090] In S205, a false alarm evaluation result for the alarm event is generated based on the collection result and the preliminary false alarm evaluation result.

[0091] In the embodiments of the present application, the server obtains the collection result, and then generates a false alarm evaluation result for the alarm event based on the collection result and the preliminary false alarm evaluation result. The false alarm evaluation result is the final evaluation result.

[0092] In the embodiments of the present application, the process tree information is obtained from the alarm data corresponding to the triggered alarm event, and the process feature set matched with the process tree information is used to analyze the process tree information. The obtained preliminary false alarm evaluation result and investigation direction information for the alarm event have strong interpretability, and the accuracy of the preliminary false alarm evaluation result and investigation direction information is improved, thereby improving the accuracy of the alarm management. Meanwhile, the investigation direction information is obtained at the same time as the preliminary false alarm evaluation result, wherein the investigation direction information gives relevant investigation suggestions for whether the alarm event is false. Thus, the final false alarm evaluation result is obtained by using the preliminary false alarm evaluation result and the evidence obtained by investigating according to the investigation suggestions, the automatic judgment for whether the alarm event is false is realized, and the efficiency and accuracy of the alarm management are improved. That is, the accuracy and efficiency of the alarm management in the embodiments of the present application are both high.

[0093] In an embodiment of the present application, another alarm management method is provided, which can be executed by the server 102. As shown in Figure 3 The alarm management method can include S301-S302, S201, S203-S205.

[0094] S301-S302 are described in detail as follows:

[0095] S301, process identification information is extracted from the process tree information.

[0096] In the embodiments of the present application, the server obtains the process tree information from the alarm data corresponding to the triggered alarm event, and then extracts the process identification information from the process tree information.

[0097] In the embodiments of the present application, the process identification information is used to uniquely identify a process, and includes but is not limited to at least one of a process name, a process number, etc.

[0098] S302, a process feature set matched with the process identification information is selected from a plurality of process feature sets respectively corresponding to a plurality of processes; wherein the process feature set includes at least one of a process function, a process behavior, a process startup path, a process signature organization, and a false alarm operation prone to cause the alarm event to be false.

[0099] In the embodiments of the present application, the server extracts the process identification information, and then selects a process feature set matched with the process identification information from a plurality of process feature sets respectively corresponding to a plurality of processes.

[0100] For example, if there are 100 process feature sets respectively corresponding to 100 processes, and the extracted process identification information is A, then a process feature set matched with the process identification information A is selected from the 100 process feature sets respectively corresponding to the 100 processes.

[0101] In an embodiment of the present application, the process identification information comprises a process name; the process of selecting the process feature set matching the process identification information from the process feature set corresponding to each of the plurality of processes in S302 can comprise:

[0102] comparing the extracted process identification information with the process names corresponding to the plurality of processes respectively, and taking the process corresponding to the process name that passes the comparison as the target process;

[0103] selecting the process feature set corresponding to the target process from the process feature set corresponding to each of the plurality of processes.

[0104] That is, in the optional embodiment, the extracted process identification information is specifically the process name, and the server compares the process name with the process names of the plurality of processes respectively, and takes the process corresponding to the process name that passes the comparison as the target process, and then obtains the process feature set corresponding to the target process, thereby obtaining the process feature set matching the process tree information.

[0105] In this way, by implementing the optional embodiment, the process name keyword / word comparison can be used to quickly and easily obtain the process feature set matching the process tree information, which is suitable for many scenarios.

[0106] In an embodiment of the present application, the process of selecting the process feature set matching the process identification information from the process feature set corresponding to each of the plurality of processes in S302 can comprise:

[0107] performing vector conversion processing on the extracted process identification information to obtain a first vector, and performing vector conversion processing on the process identification information corresponding to each of the plurality of processes to obtain a plurality of second vectors;

[0108] calculating the correlation degree between the first vector and each second vector;

[0109] taking the process corresponding to the second vector with a correlation degree greater than a preset correlation degree threshold as the target process;

[0110] selecting the process feature set corresponding to the target process from the process feature set corresponding to each of the plurality of processes.

[0111] That is, in the optional embodiment, the server performs vector conversion processing on the extracted process identification information and the process identification information of each of the plurality of processes respectively to obtain a first vector and a plurality of second vectors, then calculates the correlation degree between the first vector and each second vector, and takes the process corresponding to the second vector with a correlation degree greater than a preset correlation degree threshold as the target process, and then obtains the process feature set corresponding to the target process, thereby obtaining the process feature set matching the process tree information.

[0112] In optional embodiments, the process identification information includes, but is not limited to, at least one of a process name, a process startup path, a process signature organization, and a calling relationship between processes.

[0113] In optional embodiments, the vector conversion processing step can be triggered on the extracted process identification information and the process identification information of each of the plurality of processes, respectively, in the case of a failure in the process name comparison, i.e., the process name comparison scheme in the aforementioned optional embodiments is preferred; of course, there can be no restrictions, i.e., the vector-based semantic comparison scheme in the present optional embodiments can be directly preferred.

[0114] By implementing the optional embodiments, the process feature set matched with the process tree information can be accurately obtained by using the semantic comparison after vector conversion, which is suitable for many scenarios.

[0115] It should be noted that, Figure 3 For detailed descriptions of S201, S203 to S205, please refer to Figure 2 For detailed descriptions of S201, S203 to S205, please refer to

[0116] In the embodiments of the present application, the process identification information corresponding to the process tree information can be used to obtain the process feature set matched with the process tree information simply and accurately, which provides strong support for subsequent processing.

[0117] In an embodiment of the present application, another alarm management method is provided, which can be executed by the server 102. As shown in Figure 4 The alarm management method can include S401 to S403, S201 to S202, S204 to S205.

[0118] S401 to S403 are described in detail as follows:

[0119] S401, performing security level detection on the process tree information based on the process feature set to obtain a detection result.

[0120] In the embodiments of the present application, the server obtains the process feature set, and then performs security level detection on the process tree information based on the process feature set to obtain a detection result.

[0121] In an embodiment of the present application, the process of performing security level detection on the process tree information based on the process feature set to obtain a detection result in S401 can include:

[0122] If the process feature set includes a process behavior, performing security level detection on the process behavior contained in the process tree information based on a preset alarm rule and the process behavior to obtain a detection result;

[0123] If the process feature set includes the process startup path, the server performs security level detection on the process startup path contained in the process tree information based on the process startup path to obtain a detection result.

[0124] If the process feature set includes the process signature organization, the server performs security level detection on the process signature organization contained in the process tree information based on the process signature organization to obtain a detection result.

[0125] If the process feature set includes the false alarm operation prone to cause false alarms of alarm events, the server performs security level detection on the alarm operation contained in the process tree information based on the false alarm operation to obtain a detection result.

[0126] That is, in the optional embodiment, there are 15 cases in which the server performs security level detection on the process tree information by using the process feature set.

[0127] If the process feature set includes the process behavior, the server can perform security level detection on the process behavior contained in the process tree information based on the preset alarm rule and the process behavior to obtain a detection result; if the process feature set includes the process startup path, the server can perform security level detection on the process startup path contained in the process tree information based on the process startup path to obtain a detection result; if the process feature set includes the process signature organization, the server can perform security level detection on the process signature organization contained in the process tree information based on the process signature organization to obtain a detection result; if the process feature set includes the false alarm operation prone to cause false alarms of alarm events, the server can perform security level detection on the alarm operation contained in the process tree information based on the false alarm operation to obtain a detection result.

[0128] In this way, by implementing the optional embodiment, the security detection on the process tree information can be conveniently and accurately implemented by using the process feature set, which is suitable for many scenes.

[0129] In an embodiment of the present application, the process tree information can also be subjected to at least one of the following security level detections:

[0130] Security level detection is performed on the use parameter contained in the process tree information to obtain a detection result.

[0131] Security level detection is performed on the calling relationship between processes contained in the process tree information to obtain a detection result.

[0132] That is, in the optional embodiment, the server can directly perform security level detection on the process tree information, i.e., without relying on the process feature set; specifically, security level detection can be performed on the use parameter contained in the process tree information to obtain a detection result, and / or security level detection can be performed on the calling relationship between processes contained in the process tree information to obtain a detection result.

[0133] Among them, the parameters used in the optional embodiment refer to process call parameters, that is, parameters passed to the process when starting the process, which can affect the behavior and execution path of the process, and these parameters can include file paths, command line parameters, environment variables, etc. Some malware may use specific parameters to perform malicious operations, such as passing malicious code, executing system commands, etc.

[0134] Among them, the call relationship between processes in the optional embodiment refers to the hierarchy of running processes in the operating system. By analyzing the call relationship of the process tree, the dependency relationship between processes, the communication method, and the starting path of the process can be understood.

[0135] In this way, by implementing the optional embodiment, the use of parameters and / or inter-process call relationships can conveniently and accurately achieve security detection of process tree information, which is suitable for many scenarios.

[0136] S402, generating a false alarm preliminary evaluation result for the alarm event based on the detection result.

[0137] In the embodiment of the application, the server uses the process feature set to detect the security level of the process tree information to obtain the detection result, and then generates a false alarm preliminary evaluation result for the alarm event based on the detection result.

[0138] In an embodiment of the application, the detection result can be multiple.

[0139] For ease of understanding, in the optional embodiment, the process feature set includes process behavior, process startup path, process signature organization, and false alarm operation prone to cause false alarms of the alarm event. Then, the server uses the preset alarm rule and the process behavior to detect the security level of the process behavior contained in the process tree information to obtain the detection result, uses the process startup path to detect the security level of the process startup path contained in the process tree information to obtain the detection result, uses the process signature organization to detect the security level of the process signature organization contained in the process tree information to obtain the detection result, and uses the false alarm operation to detect the security level of the alarm operation contained in the process tree information to obtain the detection result. Thus, four detection results are obtained.

[0140] In this way, by implementing the optional embodiment, the process feature set is used to perform security detection of the process tree information from multiple angles, greatly improving the accuracy of security detection, and further improving the accuracy of alarm management.

[0141] Correspondingly, the process of generating a false alarm preliminary evaluation result for the alarm event based on the detection result in S402 can include:

[0142] If there are a first preset number of detection results with a security level higher than the preset security level threshold in the plurality of detection results, a preliminary evaluation result is generated to represent that the false alarm probability of the alarm event is greater than the preset probability threshold.

[0143] If there are a second preset number of detection results with a security level lower than the preset security level threshold in the plurality of detection results, a preliminary evaluation result is generated to represent that the false alarm probability of the alarm event is less than or equal to the preset probability threshold.

[0144] In optional embodiments, the detection result representing a security level higher than the preset security level threshold means that the detection result represents higher security, and the preliminary evaluation result representing that the false alarm probability of the alarm event is less than or equal to the preset probability threshold means that the alarm event is more likely to be a false alarm; that is, if the server detects that more detection results in the plurality of detection results represent higher security, a false alarm preliminary evaluation result is generated, which represents that the alarm event is more likely to be a false alarm.

[0145] In optional embodiments, the detection result representing a security level lower than the preset security level threshold means that the detection result represents lower security, and the preliminary evaluation result representing that the false alarm probability of the alarm event is less than or equal to the preset probability threshold means that the alarm event is less likely to be a false alarm; that is, if the server detects that more detection results in the plurality of detection results represent lower security, a false alarm preliminary evaluation result is generated, which represents that the alarm event is less likely to be a false alarm.

[0146] It should be clear that the first preset number and the second preset number can be the same or different, and in actual applications, the first preset number and the second preset number can be flexibly set, and a more granular false alarm preliminary evaluation result can be generated under different settings. The foregoing examples only illustrate two cases of false alarm preliminary evaluation results.

[0147] It can be understood that generating a false alarm preliminary evaluation result for the alarm event based on the detection result by the research model (see the following description) is a relatively subjective judgment process, and it is difficult to directly judge from a quantitative perspective (for example, more detection results are not quantitative words).

[0148] Specifically, in some cases, when most of the detection results represent high safety and a small part of the detection results represent low safety, a false alarm preliminary evaluation result with a large possibility of false alarm of the alarm event can be obtained (i.e., the small part of the detection results does not substantially affect safety, and the small part of the detection results representing low safety can be caused by code errors, power failures, etc., and does not involve major safety problems), or a false alarm preliminary evaluation result with a small possibility of false alarm of the alarm event can be obtained (i.e., the small part of the detection results substantially affects safety, and the small part of the detection results representing low safety can involve major safety problems, such as a process that should not involve registry modification operations but involves registry modification operations, even if other detection results represent high safety, a real attack can exist at this time).

[0149] In this way, by implementing the optional embodiment, the detection result can be used to simply and accurately generate a false alarm preliminary evaluation result for the alarm event, which is suitable for many scenes.

[0150] S403, generating investigation direction information for the alarm event based on the detection result and the alarm data.

[0151] In the embodiments of the application, the server detects the process tree information using the process feature set to obtain the detection result, and then generates the investigation direction information for the alarm event based on the detection result and the alarm data.

[0152] In an embodiment of the application, the detection result can be multiple.

[0153] For ease of understanding, in the optional embodiment, the process feature set includes process behavior, process startup path, process signature organization, and false alarm operation that can easily cause false alarms of the alarm event. Then, the server detects the process behavior contained in the process tree information using the preset alarm rule and the process behavior to obtain the detection result, detects the process startup path contained in the process tree information using the process startup path to obtain the detection result, detects the process signature organization contained in the process tree information using the process signature organization to obtain the detection result, and detects the alarm operation contained in the process tree information using the false alarm operation to obtain the detection result. Thus, four detection results are obtained.

[0154] In this way, by implementing the optional embodiment, the process feature set is used to perform security detection on the process tree information from multiple angles, which greatly improves the accuracy of security detection and further improves the accuracy of alarm management.

[0155] Correspondingly, the process of generating the investigation direction information for the alarm event based on the detection result and the alarm data in S403 can include:

[0156] If the security levels of all the detection results in the plurality of detection results are higher than the preset security level threshold, the alarm data is parsed to obtain a deep detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the deep detection direction.

[0157] If there is at least one detection result with a security level lower than the preset security level threshold in the plurality of detection results, the alarm data and the at least one detection result are parsed to obtain a deep detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the deep detection direction.

[0158] In optional embodiments, the detection result representing that the security level is higher than the preset security level threshold means that the detection result represents higher security; that is, if the server detects that all the detection results in the plurality of detection results represent higher security, the alarm data can be directly parsed to obtain a deep detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the deep detection direction.

[0159] For example, taking the foregoing example, assuming that the four detection results all represent higher security, the server can only parse the alarm data to obtain the investigation direction information for the alarm event.

[0160] In optional embodiments, the detection result representing that the security level is lower than the preset security level threshold means that the detection result represents lower security; if the server detects that there is at least one detection result with lower security in the plurality of detection results, the alarm data and the at least one detection result can be parsed at the same time to obtain a deep detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the deep detection direction.

[0161] For example, taking the foregoing example, assuming that any one or more of the four detection results represent lower security, the server can parse the alarm data and the any one or more detection results at the same time to obtain the investigation direction information for the alarm event.

[0162] In this way, by implementing the optional embodiments, the investigation direction information for the alarm event can be conveniently and accurately generated by using the detection results and the alarm data, which is suitable for many scenarios.

[0163] It should be noted that, Figure 4 S402 and S403 can be executed in any order or in parallel, and Figure 4 For details of S201 to S202, S204 to S205, please refer to Figure 2The S201 to S202, S204 to S205 are shown, and details are not repeated here.

[0164] In the embodiments of the present application, the process feature set is used to detect the security level of the process tree information, so that the investigation direction information and the preliminary evaluation result of false alarm for the alarm event can be obtained simply and accurately, thereby providing strong support for subsequent processing.

[0165] In an embodiment of the present application, another alarm management method is provided, which can be executed by the server 102. As shown in the figure, the alarm management method can include S501 to S502, S201 to S203, and S205. Figure 5

[0166] S501 to S502 are described in detail as follows:

[0167] S501, generating agent invocation code matched with the investigation direction indicated by the investigation direction information.

[0168] In the embodiments of the present application, the server obtains the investigation direction information for the alarm event, and then generates the agent invocation code matched with the investigation direction indicated by the investigation direction information, that is, automatically generates the agent invocation code matched with the investigation direction indicated by the investigation direction information.

[0169] In an embodiment of the present application, the investigation direction information includes a plurality of investigation questions.

[0170] For example, the investigation direction information includes investigation questions 1-3, where the investigation question 1 is the investigation for direction 1, the investigation question 2 is the investigation for direction 2, and the investigation question 3 is the investigation for direction 3. In actual applications, the number of investigation questions can be flexibly adjusted according to specific application scenarios.

[0171] Correspondingly, the process of generating the agent invocation code matched with the investigation direction indicated by the investigation direction information in S501 can include:

[0172] For each investigation question, the question content corresponding to the investigation question and the tool identification information required to solve the investigation question are generated, and the question content and the tool identification information are taken as the parameters of the agent invocation code to be generated, and the agent invocation code matched with the investigation question is generated based on the parameters.

[0173] That is, in the optional embodiment, the server generates, for each investigation question, the question content corresponding to the investigation question and the tool identification information required to solve the investigation question, and takes the question content and the tool identification information as the parameters of the agent invocation code to be generated, and then generates the agent invocation code matched with the investigation question by using the parameters. ​

[0174] For example, as an example, the agent call code 1 matched with the investigation question 1 is generated, the agent call code 2 matched with the investigation question 2 is generated, and the agent call code 3 matched with the investigation question 3 is generated.

[0175] In optional embodiments, the question content refers to a task target to be completed, and the generated task target can be answered by using similar "yes" / "no", "exist" / "non-existent".

[0176] In optional embodiments, the tool identification information refers to a specific tool required to complete the task target, and the tool identification information is used to uniquely identify the tool. For example, the tool identification information includes but is not limited to "query process list", "query malware list", "ask operation and maintenance personnel", and "ask host person in charge".

[0177] In other embodiments, the server can also generate the data type of the return value, such as bool type, for each investigation question, and also use it as a parameter of the agent call code to be generated.

[0178] For example, the format of the agent call code is as follows:

[0179] agent(<tool name>, <task target>) -> bool;

[0180] Specifically, agent ("query malware", "is there APIFox_Setup.exe related malware?"), wherein "query malware" is the tool name, and "is there APIFox_Setup.exe related malware?" is the task target.

[0181] In this way, by implementing the optional embodiments, the agent call code matched with the investigation question can be generated simply and accurately by using the investigation question, which is suitable for many scenarios.

[0182] S502, the agent implementation code is called by the agent call code to run the agent implementation code to obtain the forensic result.

[0183] In the embodiments of the present application, the server generates the agent call code matched with the investigation direction indicated by the investigation direction information, and then calls the agent implementation code by the agent call code, so as to run the agent implementation code to obtain the forensic result.

[0184] For example, as an example, the agent calling code 1 calls the agent implementation code 1 to obtain the forensics result 1 for the investigation question 1, the agent calling code 2 calls the agent implementation code 2 to obtain the forensics result 2 for the investigation question 2, and the agent calling code 3 calls the agent implementation code 3 to obtain the forensics result 3 for the investigation question 3.

[0185] In an embodiment of the present application, the process of calling the agent implementation code by the agent calling code in S502 to run the agent implementation code to obtain the forensics result can include:

[0186] Combining the agent calling code and the agent implementation code to generate a code item;

[0187] Starting the code item in the sandbox to call the agent implementation code in the sandbox by the agent calling code in the sandbox to obtain the forensics result.

[0188] That is, in the optional embodiment, the server combines the agent calling code and the agent implementation code to generate a code item, and then starts the code item in the sandbox to call the agent implementation code in the sandbox by the agent calling code in the sandbox to obtain the forensics result.

[0189] In this way, by implementing the optional embodiment, since the sandbox has the characteristics of security, isolation, resource usage control, and can simulate different environments, the reliability of the forensics result obtained by investigating and forensics in the sandbox is high.

[0190] It should be clear that in other embodiments, the code item can also be started in the sandbox, for example, the investigation and forensics can be implemented in a remote calling manner to obtain the forensics result, which is more flexible. In actual application, the investigation and forensics manner can be flexibly adjusted according to the specific application scene.

[0191] It should be noted that, Figure 5 The detailed introduction of S201 to S203 and S205 is described in detail in the foregoing description of the method for investigating and forensics. Figure 2 The detailed introduction of S201 to S203 and S205 is described in detail in the foregoing description of the method for investigating and forensics.

[0192] In the embodiment of the present application, the investigation direction expressed in natural language is first generated into an agent calling code, and the agent calling code is used to call the agent implementation code, so that the forensics result can be accurately obtained, the illusion problem caused by directly calling the agent implementation code due to the investigation direction expressed in natural language (there may be ambiguity in understanding, such as inconsistency of context, forgetting key information, etc.) is avoided, the accuracy of the investigation and forensics is improved, and the accuracy of the alarm management is improved.

[0193] In an embodiment of the present application, another alarm management method is provided, which can be executed by the server 102. As shown in FIG. 6, the alarm management method can include S601-S602, S201-S204. Figure 6

[0194] In the embodiment of the present application, the evidence results are multiple. For example, in the aforementioned example, the proxy implementation code 1 is invoked by the proxy calling code 1 to obtain the evidence result 1 for the investigation question 1, the proxy implementation code 2 is invoked by the proxy calling code 2 to obtain the evidence result 2 for the investigation question 2, and the proxy implementation code 3 is invoked by the proxy calling code 3 to obtain the evidence result 3 for the investigation question 3. Thus, three evidence results are obtained.

[0195] S601-S602 are described in detail as follows:

[0196] S601, if there is at least one evidence result in the multiple evidence results for representing that the alarm event is triggered by an attack, and the preliminary false alarm evaluation result is that the false alarm probability of the alarm event is less than or equal to the preset probability threshold, an evaluation result for representing that the alarm event is not false alarm is obtained.

[0197] In the embodiment of the present application, if the server detects that any one or more evidence results in the multiple evidence results represent that the alarm event is triggered by an attack (i.e., the alarm event is caused by a real attack), and the preliminary false alarm evaluation result is that the alarm event is less likely to be false alarm, a final evaluation result that the alarm event is not false alarm is generated.

[0198] For example, in the aforementioned example, any one or more evidence results in the three evidence results represent that the alarm event is triggered by an attack, and the preliminary false alarm evaluation result is that the alarm event is less likely to be false alarm. At this time, the final evaluation result obtained by the server is that the alarm event is not false alarm.

[0199] S602, if there is no evidence result in the multiple evidence results for representing that the alarm event is triggered by an attack, and the preliminary false alarm evaluation result is that the false alarm probability of the alarm event is greater than the preset probability threshold, an evaluation result for representing that the alarm event is false alarm is obtained.

[0200] In the embodiment of the present application, if the server detects that there is no evidence result in the multiple evidence results for representing that the alarm event is triggered by an attack (i.e., the alarm event is caused by a real attack), and the preliminary false alarm evaluation result is that the alarm event is more likely to be false alarm, a final evaluation result that the alarm event is false alarm is generated.

[0201] For example, in the aforementioned example, there is no evidence result in the three evidence results for representing that the alarm event is triggered by an attack, and the preliminary false alarm evaluation result is that the alarm event is more likely to be false alarm. At this time, the final evaluation result obtained by the server is that the alarm event is false alarm.​

[0202] It should be noted that, Figure 6 For detailed introduction of S201 to S204 shown in Figure 2 S201 to S204 shown in the foregoing embodiment, details are not repeated here.

[0203] In the embodiment of the application, the false alarm preliminary evaluation result and the plurality of forensic results are utilized to accurately obtain the false alarm final evaluation result for the alarm event, thereby providing strong support for subsequent corresponding security management measures based on the real false alarm situation of the alarm event, and guaranteeing network security.

[0204] In an embodiment of the application, another alarm management method is provided, which can be executed by the server 102. As Figure 7 shown, the alarm management method can include S701 to S703, S201 to S202.

[0205] S701 to S703 are described in detail as follows:

[0206] S701, input the process feature set and the process tree information into the display interface corresponding to the investigation model, so as to obtain the investigation direction information and the false alarm preliminary evaluation result for the alarm event output by the investigation model in the display interface through the investigation model based on the process feature set for the process tree information.

[0207] In the embodiment of the application, the server obtains the process feature set matched with the process tree information, and then inputs the process feature set and the process tree information into the display interface corresponding to the investigation model, so as to obtain the investigation direction information and the false alarm preliminary evaluation result for the alarm event output by the investigation model in the display interface through the investigation model based on the process feature set for the process tree information.

[0208] S702, investigate and collect evidence from the investigation direction indicated by the investigation direction information through the investigation model, to obtain the forensic result output by the investigation model in the display interface.

[0209] In the embodiment of the application, the server obtains the investigation direction information and the false alarm preliminary evaluation result for the alarm event output by the investigation model in the display interface, and then investigates and collects evidence from the investigation direction indicated by the investigation direction information through the investigation model again, to obtain the forensic result output by the investigation model in the display interface.

[0210] S703, obtain the false alarm evaluation result for the alarm event output by the investigation model in the display interface through the investigation model based on the forensic result and the false alarm preliminary evaluation result.

[0211] The server obtains the forensic result output by the investigation model in the display interface in the embodiment of the application, and then obtains the false alarm evaluation result of the alarm event output by the investigation model in the display interface based on the forensic result and the false alarm preliminary evaluation result through the investigation model again.

[0212] That is, the server in the embodiment of the application implements the investigation of the alarm event and the final false alarm evaluation result by using the investigation model, and the investigation model visualizes the results obtained at each step, thereby facilitating relevant staff (for example, a network security administrator) to view, etc. The specific processing process of the investigation model is described in the foregoing embodiment, which will not be described here.

[0213] For ease of understanding, please refer to Figure 8A and Figure 8B for the schematic diagram of the visualization. As shown in FIG. 8, 801 is the related content output by the investigation model for analyzing and processing the process tree information by using the process feature set, 802 is the false alarm preliminary evaluation result of the alarm event output by the investigation model, 803 is the cause explanation of the false alarm preliminary evaluation result output by the investigation model, 804 is the investigation direction information of the alarm event output by the investigation model, 805 is the forensic result matched with the investigation direction information output by the investigation model, and 806 is the false alarm evaluation result of the alarm event output by the investigation model.

[0214] The investigation model in the embodiment of the application includes the following implementation manners:

[0215] Implementation manner 1: a closed-source large language model (LLM) is used as the investigation model, for example, a closed-source commercial large language model GPT4, GPT3.5, etc. is used as the investigation model. It can be understood that the closed-source commercial large language model already has certain network security expert knowledge and can analyze the triggered alarm event. The investigation model corresponding to this implementation manner has a relatively simple process.

[0216] Implementation manner 2: a large language model is independently trained to obtain the investigation model, that is, the training of the large language model starts from 0. Specifically, according to the alarm event triggered and the judgment scene, the preparation of the training corpus is completed, and the training of the large language model is completed by using the training corpus. The investigation model corresponding to this implementation manner is more accurate, and the judgment effect of the investigation model is good.

[0217] In implementation 3, the open source large language model is reinforced to obtain the investigation model, that is, based on the existing open source large language model, the ability to determine whether the event is a false alarm is enhanced through fine-tuning. Optionally, the open source large language model with a parameter scale of about 2B can be used for reinforcement training. It has been verified through experiments that the investigation model obtained by using the open source large language model with a parameter scale of about 2B for reinforcement training has similar effect as the investigation model obtained by using the open source large language model with a parameter scale of about 7B for reinforcement training, and both can achieve good investigation effect. Since the parameter scale of about 2B is small and the reasoning speed is fast, the throughput and investigation efficiency are greatly improved, and the parameter scale of about 2B has low requirements for hardware facilities (such as a graphics card), and the pressure and cost of private deployment are low.

[0218] For ease of understanding, please refer to Figure 9 , which is a schematic diagram of the above three implementation manners. As shown in Figure 9 , implementation 1 uses a closed source large language model (referred to as a closed source large model) GPT4, GPT3.5, etc. as the investigation model; implementation 3 uses an open source large language model (referred to as an open source large model) to obtain the investigation model (also referred to as an alarm investigation large model) through reinforcement training, for example, the reinforcement can be performed through pre-training, knowledge injection, fine-tuning, artificial alignment, etc.; and implementation 2 uses an independently trained large language model (referred to as a large model) to obtain the investigation model. It can be understood that the computing power requirement and training difficulty of implementation 1, implementation 3, and implementation 2 gradually increase, and in actual application, a suitable implementation manner can be selected according to the application scene requirement.

[0219] In an embodiment of the present application, the server obtains the investigation model through reinforcement training based on an open source large language model. As shown in Figure 10 , the triggered alarm event is input into the investigation model, the investigation model obtains and interprets the triggered alarm event, then performs automatic investigation, and finally outputs the investigation conclusion (i.e., the false alarm evaluation result for the triggered alarm event).

[0220] It should be noted that Figure 7 , the detailed introduction of S201 to S202 is described in Figure 2 , S201 to S202, which will not be described here.

[0221] In the embodiment of the present application, the investigation model is used to automatically complete the entire process from alarm interpretation to investigation, which greatly improves the efficiency of alarm management, and the accuracy of alarm management is higher.

[0222] The specific scene of the embodiment of the present application is described in detail as follows:

[0223] Please refer to Figure 11 ,Figure 11 is a flowchart of an alarm management method shown by an embodiment of the present application.

[0224] As shown in Figure 11 , the alarm management method at least includes S1101 to S1108, which are described in detail as follows:

[0225] S1101, if a triggering alarm event is detected, process tree information is acquired from alarm data corresponding to the alarm event.

[0226] In the embodiment of the present application, the EDR device detects whether an alarm event is triggered or reported in real time, and when the alarm event is detected, the alarm data corresponding to the alarm event can be acquired. Illustratively, the alarm data corresponding to the alarm event can be acquired from the front end or can be acquired from the back end (for example, whether there is an uninvestigated alarm event in the Kafka message queue is detected).

[0227] In the embodiment of the present application, the alarm data generated by the EDR device is a relatively complex data structure, and some redundant information can also be stored, so in order to facilitate subsequent investigation of the large language model, the original alarm data can be converted and processed by a preset template, thereby obtaining converted and processed alarm data.

[0228] Illustratively, the original alarm data is converted to:

[0229] The asset information triggering the alarm is as follows:

[0230] - Hostname:...

[0231] - IP address:...

[0232] ...

[0233] The event triggering the alarm is as follows:

[0234] - Time:...

[0235] - Malicious process:...

[0236] ...

[0237] The process tree triggering the alarm is as follows:

[0238] - Process 1...

[0239] - Path:...

[0240] - Command line:...

[0241] - Process PID:...

[0242] - Signature source:...

[0243] - Process 2...

[0244] …

[0245] The rule for triggering the alarm is as follows: …

[0246] S1102, extract process identification information from the process tree information, and select a process feature set matching the process identification information from a plurality of process feature sets corresponding to the processes respectively; wherein the process feature set includes at least one of process function, process behavior, process startup path, process signature organization, and false positive operation prone to cause false positives of alarm events.

[0247] In an embodiment of the present application, a plurality of process names are extracted from the process tree information; for example, the number [process 1 name, process 2 name, …].

[0248] In an embodiment of the present application, the process of selecting a process feature set matching the process identification information from a plurality of process feature sets corresponding to the processes respectively in S1102 can include: comparing the extracted process names with the process names corresponding to the plurality of processes respectively, and taking the process corresponding to the process name that passes the comparison as a target process; selecting the process feature set corresponding to the target process from a plurality of process feature sets corresponding to the processes respectively.

[0249] That is, in the optional embodiment, the keyword (i.e. process name) is used to search the process feature library (also known as process behavior database, which contains a plurality of process feature sets corresponding to the processes respectively, the same below) for high search efficiency. The process feature library is described in the foregoing embodiments and will not be repeated here.

[0250] In an embodiment of the present application, the process of selecting a process feature set matching the process identification information from a plurality of process feature sets corresponding to the processes respectively in S1102 can include: performing vector conversion processing on the extracted process identification information to obtain a first vector, and performing vector conversion processing on the process identification information corresponding to the plurality of processes respectively to obtain a plurality of second vectors; calculating the correlation degree between the first vector and each second vector; taking the process corresponding to the second vector with a correlation degree greater than a preset correlation degree threshold as a target process; and selecting the process feature set corresponding to the target process from a plurality of process feature sets corresponding to the processes respectively.

[0251] That is, in the optional embodiment, the semantic is used to search the process feature library for high search accuracy. The process feature library is described in the foregoing embodiments and will not be repeated here.

[0252] Exemplarily, the selected process feature set is as follows:

[0253] The process chrome.exe may come from the software Google Chrome, which belongs to the category of web browsers. Google Chrome is a web browser developed by Google, used for accessing internet content, with features such as speed, security, stability, etc.

[0254] The information of the process chrome.exe is as follows:

[0255] - Main function: browser main process, responsible for the startup of the browser, management of plugins and extensions,

[0256] - Common behavior: starting sub-processes, loading plugins, rendering web pages, handling user input,

[0257] - Start path: C:\Program Files(x86)\Google\Chrome\Application\chrome.exe,

[0258] - Signature organization: Google LLC,

[0259] - Possible false positives: frequent network connection requests, downloading executable files, modifying system settings, etc. may be falsely reported as malicious behavior.

[0260] S1103, based on the process feature set, the security level of the process tree information is detected, and the detection result is obtained.

[0261] In the embodiment of the application, the process feature set and the alarm data are used as the input of the investigation model, i.e. the process feature set and the alarm data are input into the investigation model, so that the investigation model uses the process feature set to detect the security level of the process tree information in the alarm data, and obtains the detection result.

[0262] In an embodiment of the application, the process of S1103 based on the process feature set to detect the security level of the process tree information and obtain the detection result can include: if the process feature set includes process behavior, based on the preset alarm rule and the process behavior, the security level of the process behavior contained in the process tree information is detected, and the detection result is obtained; if the process feature set includes the process startup path, based on the process startup path, the security level of the process startup path contained in the process tree information is detected, and the detection result is obtained; if the process feature set includes the process signature organization, based on the process signature organization, the security level of the process signature organization contained in the process tree information is detected, and the detection result is obtained; if the process feature set includes the false positive operation that can easily cause false positives of alarm events, based on the false positive operation, the security level of the alarm operation contained in the process tree information is detected, and the detection result is obtained.

[0263] In an embodiment of the present application, the process tree information can also include: a security level detection of the use parameters contained in the process tree information, to obtain a detection result; and / or a security level detection of the calling relationship between the processes contained in the process tree information, to obtain a detection result.

[0264] That is, in the optional embodiment, the process tree information is analyzed from multiple angles, including but not limited to process behavior, process startup path, process signature organization, process false positive operation, process use parameter, and calling relationship between processes.

[0265] For example, as shown in FIG. 6, the API Fox process has a high security level in terms of startup path, signature organization, use parameter, and other information, and the triggered alarm rule "persistent: registry and startup folder" is also likely to be the normal behavior of API Fox, and it is a commonly used development tool, and the possibility of being misidentified as malicious behavior is high. Figure 8A

[0266] S1104, generating a false positive preliminary evaluation result for the alarm event based on the detection result.

[0267] In an embodiment of the present application, the detection result is multiple; the process of generating a false positive preliminary evaluation result for the alarm event based on the detection result in S1104 can include: if there are a first preset number of detection results with a security level higher than a preset security level threshold in the multiple detection results, generating a preliminary evaluation result for representing that the false positive probability of the alarm event is greater than a preset probability threshold; if there are a second preset number of detection results with a security level lower than the preset security level threshold in the multiple detection results, generating a preliminary evaluation result for representing that the false positive probability of the alarm event is less than or equal to the preset probability threshold.

[0268] The false positive preliminary evaluation result in the embodiment of the present application includes four cases: case 1, the false positive probability is very small; case 2, the false positive probability is medium and small; case 3, the false positive probability is medium and large; and case 4, the false positive probability is very large.

[0269] Continuing the foregoing example, since the security is high from multiple angles, as shown in FIG. 6, the obtained false positive preliminary evaluation result is that the false positive probability is very large. Furthermore, a cause explanation of the false positive preliminary evaluation result is also given, so as to briefly summarize the false positive preliminary evaluation result to help the network security administrator (such as an operation and maintenance personnel) understand the analysis process. Figure 8A

[0270] ​​It can be understood that the false preliminary evaluation result is a relatively subjective evaluation result obtained by the investigation model by analyzing the process tree information using the process feature set. Next, the investigation model investigates from the establishment conditions of the opposite case, thereby obtaining a more accurate evaluation result.

[0271] S1105, generating investigation direction information for the alarm event based on the detection result and the alarm data.

[0272] In an embodiment of the present application, the detection result is multiple; the process of generating the investigation direction information for the alarm event based on the detection result and the alarm data in S1105 can include: if the security level of all detection results in the multiple detection results is higher than the preset security level threshold, the alarm data is analyzed and processed to obtain an in-depth detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the in-depth detection direction; if there is at least one detection result with a security level lower than the preset security level threshold in the multiple detection results, the alarm data and the at least one detection result are analyzed and processed to obtain an in-depth detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the in-depth detection direction.

[0273] It can be understood that if the false preliminary evaluation result is likely to be false, it can be given under what circumstances the alarm event is caused by a real attack. Similarly, if the false preliminary evaluation result is less likely to be false, it can be given under what circumstances the alarm is caused by a false alarm.

[0274] As shown in the foregoing example, Figure 8A Since the investigation model considers that the false alarm possibility is high, it is given that what conditions are real attacks, for example, API Fox has been marked as malware, the digital signature does not match, there are other abnormal network activities, etc.

[0275] S1106, generating agent invocation code matching the investigation direction indicated by the investigation direction information.

[0276] In an embodiment of the present application, the investigation direction information includes multiple investigation questions; the process of generating the agent invocation code matching the investigation direction indicated by the investigation direction information in S1106 can include: for each investigation question, generating question content corresponding to the investigation question and tool identification information required to be used to solve the investigation question, and taking the question content and the tool identification information as parameters of the agent invocation code to be generated, and generating the agent invocation code matching the investigation question based on the parameters.

[0277] As shown in the foregoing example, Figure 8AAs shown, taking the investigation question "If APIFox_Setup.exe has been marked as malware by EDR, it may indicate the presence of a malware infection" as an example, the investigation model converts the investigation question expressed in natural language into the agent invocation code as follows:

[0278] agent(“query malware”, “Is there malware related to APIFox_Setup.exe?”);

[0279] The complete agent invocation code is as follows:

[0280] def analyze_alert():

[0281] # Step 1: Query malware, whether the APIFox_Setup.exe in the alert is a marked malware

[0282] if agent(“query malware”, “Is there malware related to APIFox_Setup.exe?”):

[0283] return “real attack”

[0284] # Step 2: …

[0285] In this way, by implementing the optional embodiment, the investigation question expressed in natural language is first generated into the agent invocation code, which can avoid the illusion problem caused by the investigation question expressed in natural language (there may be ambiguities in understanding, such as inconsistency in context, forgetting key information, etc.), thereby improving the accuracy of forensic investigation.

[0286] Optionally, in order to avoid interference with the execution of the agent invocation code by other output content before and after the code, the investigation model can use separators such as “ <start> ”，" <end>to facilitate subsequent extraction.

[0287] S1107, the agent calling code calls the agent implementation code to run the agent implementation code to obtain the forensic result.

[0288] In an embodiment of the present application, the process of calling the agent implementation code by the agent calling code in S1107 to run the agent implementation code to obtain the forensic result can include: combining the agent calling code and the agent implementation code to generate a code item; starting the code item in a sandbox to call the agent implementation code located in the sandbox through the agent calling code located in the sandbox to obtain the forensic result.

[0289] That is, in the optional embodiment, the investigation model extracts the code content (called the calling code of LLM Agent) from the complete agent calling code through the regular expression, and at the same time combines it with the agent implementation code (called the implementation code of LLM Agent, i.e. agent function) to obtain a code item and run it in a Python sandbox.

[0290] As shown in the foregoing example, Figure 8B As shown in the foregoing example,

[0291] S1108, based on the forensic result and the preliminary false alarm evaluation result, generate a false alarm evaluation result for the alarm event.

[0292] In an embodiment of the present application, the forensic result is multiple; the process of generating a false alarm evaluation result for the alarm event based on the forensic result and the preliminary false alarm evaluation result in S1108 can include: if there is at least one forensic result in the multiple forensic results for representing that the alarm event is triggered by an attack, and the preliminary false alarm evaluation result is that the false alarm probability of the alarm event is less than or equal to a preset probability threshold, then an evaluation result for representing that the alarm event is not false alarm is obtained; if there is no forensic result in the multiple forensic results for representing that the alarm event is triggered by an attack, and the preliminary false alarm evaluation result is that the false alarm probability of the alarm event is greater than the preset probability threshold, then an evaluation result for representing that the alarm event is false alarm is obtained.

[0293] That is, in the optional embodiment, multiple forensic results (i.e. multiple True or False) are obtained as the LLM Agent investigates, so that the final false alarm evaluation result is obtained according to the preliminary false alarm evaluation result and the multiple forensic results.

[0294] As shown in the foregoing example, Figure 8B As shown, the false alarm evaluation result for the alarm event is false alarm.

[0295] It should be noted that, Figure 11 For detailed introduction of S1101 to S1108 in the above embodiment, please refer to the foregoing embodiment introduction, which will not be repeated here.

[0296] The embodiments of the present application have at least the following beneficial effects:

[0297] (1) High accuracy: the alarm analysis utilizes a more comprehensive and accurate process feature set matched with the process tree information, and the final evaluation result relies on real investigation and evidence, so the accuracy of alarm management is greatly improved.

[0298] (2) High efficiency: the alarm analysis uses the investigation model, the entire process is highly automated, greatly reduces human dependence, and can process a large number of alarm analysis in a short time, so the efficiency of alarm management is greatly improved.

[0299] (3) Strong professionalism: since the investigation model has security expert knowledge, the alarm analysis process is more professional and the standard is more unified compared to security operation personnel with uneven levels.

[0300] (4) Strong interpretability: since the investigation model interprets and displays alarm data in natural language, the entire process is transparent and open, and has strong interpretability.

[0301] (5) Low cost: since the investigation model has security expert knowledge, it reduces the dependence on high recruitment cost experts, greatly reducing the cost of alarm management.

[0302] (6) Low use threshold: since the alarm analysis uses the investigation model, security operation personnel do not need to master very professional security technology, and security operation personnel with ordinary security technology can participate in corresponding security management.

[0303] Figure 12 is a block diagram of an alarm management device shown in an embodiment of the present application. As Figure 12 shown, the device includes:

[0304] The first acquisition module 1201 is configured to acquire process tree information from alarm data corresponding to the alarm event if a trigger alarm event is detected.

[0305] The second acquisition module 1202 is configured to acquire a process feature set matched with the process tree information.

[0306] The analysis module 1203 is configured to analyze the process tree information based on the process feature set, to obtain investigation direction information and a preliminary false alarm evaluation result for the alarm event;

[0307] The evidence collection module 1204 is configured to collect evidence from the investigation direction indicated by the investigation direction information, to obtain an evidence collection result;

[0308] The generation module 1205 is configured to generate a false alarm evaluation result for the alarm event based on the evidence collection result and the preliminary false alarm evaluation result.

[0309] In an embodiment of the present application, based on the foregoing scheme, the second acquisition module 1202 is specifically configured to:

[0310] extract process identification information from the process tree information;

[0311] select a process feature set corresponding to the target process from a plurality of process feature sets corresponding to a plurality of processes; wherein the process feature set includes at least one of process function, process behavior, process startup path, process signature organization, and false alarm operation prone to cause false alarms of the alarm event.

[0312] In an embodiment of the present application, based on the foregoing scheme, the process identification information includes a process name; the second acquisition module 1202 is further specifically configured to:

[0313] compare the extracted process name with process names corresponding to a plurality of processes respectively, and take a process corresponding to a process name that passes the comparison as a target process;

[0314] select a process feature set corresponding to the target process from a plurality of process feature sets corresponding to a plurality of processes.

[0315] In an embodiment of the present application, based on the foregoing scheme, the second acquisition module 1202 is further specifically configured to:

[0316] perform vector conversion processing on the extracted process identification information to obtain a first vector, and perform vector conversion processing on process identification information corresponding to a plurality of processes respectively to obtain a plurality of second vectors;

[0317] calculate a correlation degree between the first vector and each second vector;

[0318] take a process corresponding to a second vector with a correlation degree greater than a preset correlation degree threshold as a target process;

[0319] select a process feature set corresponding to the target process from a plurality of process feature sets corresponding to a plurality of processes.

[0320] In an embodiment of the present application, based on the foregoing scheme, the analysis module 1203 is specifically configured to:

[0321] perform security level detection on the process tree information based on the process feature set, to obtain a detection result;

[0322] generate a preliminary evaluation result of false alarm for the alarm event based on the detection result, and generate investigation direction information for the alarm event based on the detection result and the alarm data.

[0323] In an embodiment of the present application, based on the foregoing scheme, the analysis module 1203 is further specifically configured to:

[0324] if the process feature set includes process behavior, perform security level detection on the process behavior contained in the process tree information based on a preset alarm rule and the process behavior, to obtain a detection result;

[0325] if the process feature set includes process startup path, perform security level detection on the process startup path contained in the process tree information based on the process startup path, to obtain a detection result;

[0326] if the process feature set includes process signature organization, perform security level detection on the process signature organization contained in the process tree information based on the process signature organization, to obtain a detection result;

[0327] if the process feature set includes false alarm operation of the process that is prone to cause false alarm of the alarm event, perform security level detection on the alarm operation contained in the process tree information based on the false alarm operation, to obtain a detection result.

[0328] In an embodiment of the present application, based on the foregoing scheme, the analysis module 1203 is further specifically configured to:

[0329] perform at least one of the following security level detection on the process tree information:

[0330] perform security level detection on the usage parameter contained in the process tree information, to obtain a detection result;

[0331] perform security level detection on the calling relationship between processes contained in the process tree information, to obtain a detection result.

[0332] In an embodiment of the present application, based on the foregoing scheme, the detection result is multiple; the analysis module 1203 is further specifically configured to:

[0333] if there are a first preset number of detection results with security level higher than a preset security level threshold in the multiple detection results, generate a preliminary evaluation result representing that the false alarm probability of the alarm event is greater than a preset probability threshold.

[0334] If there are a second preset number of detection results with a security level lower than a preset security level threshold in the plurality of detection results, a preliminary evaluation result is generated to indicate that the false positive probability of the alarm event is less than or equal to the preset probability threshold.

[0335] In an embodiment of the present application, based on the foregoing scheme, the detection result is a plurality; the analysis module 1203 is further specifically configured to:

[0336] If all the security levels of the plurality of detection results are higher than the preset security level threshold, the alarm data is analyzed to obtain a deep detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the deep detection direction.

[0337] If there is at least one detection result with a security level lower than the preset security level threshold in the plurality of detection results, the alarm data and the at least one detection result are analyzed to obtain a deep detection direction of the alarm event triggered by the attack, and the investigation direction information for the alarm event is generated based on the deep detection direction.

[0338] In an embodiment of the present application, based on the foregoing scheme, the evidence collection module 1204 is specifically configured to:

[0339] Generate the agent calling code matching the investigation direction indicated by the investigation direction information;

[0340] Call the agent implementation code through the agent calling code to run the agent implementation code to obtain the evidence collection result.

[0341] In an embodiment of the present application, based on the foregoing scheme, the investigation direction information includes a plurality of investigation questions; the evidence collection module 1204 is further specifically configured to:

[0342] For each investigation question, generate the question content corresponding to the investigation question and the tool identification information required to solve the investigation question, and take the question content and the tool identification information as the parameters of the agent calling code to be generated, and generate the agent calling code matching the investigation question based on the parameters.

[0343] In an embodiment of the present application, based on the foregoing scheme, the evidence collection module 1204 is further specifically configured to:

[0344] Combine the agent calling code and the agent implementation code to generate a code project;

[0345] start the code item in a sandbox to call proxy implementation code located in the sandbox by proxy calling code located in the sandbox, to obtain a forensics result.

[0346] In an embodiment of the present application, based on the foregoing scheme, the forensics result is multiple; the generating module 1205 is specifically configured to:

[0347] If there is at least one forensics result in the multiple forensics results for representing that the alarm event is triggered by an attack, and the false alarm preliminary evaluation result is that the false alarm probability of the alarm event is less than or equal to a preset probability threshold, an evaluation result for representing that the alarm event is not false alarm is obtained;

[0348] If there is no forensics result in the multiple forensics results for representing that the alarm event is triggered by an attack, and the false alarm preliminary evaluation result is that the false alarm probability of the alarm event is greater than the preset probability threshold, an evaluation result for representing that the alarm event is false alarm is obtained.

[0349] In an embodiment of the present application, based on the foregoing scheme, the analyzing module 1203 is specifically configured to:

[0350] input the process feature set and the process tree information into a display interface corresponding to the investigation model, to analyze and process the process tree information based on the process feature set by the investigation model, to obtain investigation direction information and a false alarm preliminary evaluation result for the alarm event output by the investigation model in the display interface;

[0351] In an embodiment of the present application, based on the foregoing scheme, the forensics module 1204 is specifically configured to:

[0352] investigate and forensics from the investigation direction indicated by the investigation direction information by the investigation model, to obtain a forensics result output by the investigation model in the display interface;

[0353] In an embodiment of the present application, based on the foregoing scheme, the generating module 1205 is specifically configured to:

[0354] obtain a false alarm evaluation result for the alarm event output by the investigation model in the display interface by the investigation model based on the forensics result and the false alarm preliminary evaluation result.

[0355] It should be noted that the apparatus provided in the foregoing embodiments and the method provided in the foregoing embodiments belong to the same concept, and the specific manner in which each module and unit performs operations has been described in detail in the method embodiments.

[0356] Embodiments of the present application also provide an electronic device, comprising: one or more processors; a memory for storing one or more programs, which, when executed by the one or more processors, cause the electronic device to implement the preceding alarm management method.

[0357] Figure 13 is a structural schematic diagram of a computer system of an electronic device suitable for implementing embodiments of the present application.

[0358] It should be noted that, Figure 13 The computer system 1300 of the electronic device shown is only an example and should not impose any limitation on the functions and use range of embodiments of the present application.

[0359] As Figure 13 shown, the computer system 1300 includes a central processing unit (CPU) 1301, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1302 or programs loaded from a storage portion 1308 into a random access memory (RAM) 1303, such as performing the methods in the above embodiments. In the RAM 1303, various programs and data required for system operation are also stored. The CPU 1301, the ROM 1302, and the RAM 1303 are connected to each other through a bus 1304. An input / output (I / O) interface 1305 is also connected to the bus 1304.

[0360] The following components are connected to the I / O interface 1305: an input portion 1306 including a keyboard, a mouse, and the like; an output portion 1307 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage portion 1308 including a hard disk, and the like; and a communication portion 1309 including a network interface card such as a LAN (Local Area Network) card, a modem, and the like. The communication portion 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to the I / O interface 1305 as necessary. A removable recording medium 1311 such as a magnetic disk, an optical disc, a magneto-optical disc, a semiconductor memory, and the like is attached to the drive 1310 as necessary, so that a computer program read therefrom is installed in the storage portion 1308 as necessary.

[0361] In particular, according to embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising computer programs for executing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication section 1309, and / or installed from the detachable medium 1311. When the computer program is executed by the central processing unit (CPU) 1301, various functions defined in the system of the present application are executed.

[0362] It should be noted that the computer readable medium shown in embodiments of the present application can be a computer readable signal medium or a computer readable storage medium or any combination thereof. The computer readable medium may, for example, be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination thereof. More specific examples of the computer readable medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, the computer readable medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal that propagates in a baseband or as part of a carrier wave, in which the computer readable computer program is carried. Such a propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can transmit, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. The computer program contained in the computer readable medium can be transmitted in any suitable medium, including but not limited to wireless, wired, or the like, or any suitable combination thereof.

[0363] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowcharts, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0364] The units described in the embodiments of the present application can be implemented by software, or by hardware, or by a combination of software and hardware. The units described can be located in a single processor, or can be distributed over a plurality of processors.

[0365] Another aspect of the present application provides a computer readable medium having stored computer program, which, when executed by a processor, implements the alarm management method as described above. The computer readable medium can be included in the electronic device as described in the embodiments above, or can exist separately and not be assembled into the electronic device.

[0366] Another aspect of the present application provides a computer program product or computer program, which includes computer instructions. The computer instructions are stored in a computer readable medium. A processor of a computer device reads the computer instructions from the computer readable medium, and the processor executes the computer instructions, so that the computer device executes the alarm management method provided in the embodiments above.

[0367] The above merely describes preferred exemplary embodiments of the present application, but is not intended to limit the implementation of the present application. Those skilled in the art can easily make corresponding modifications or variations according to the main idea and spirit of the present application, and the protection scope of the present application should be subject to the protection scope required by the claims.< / end> < / start>

Claims

1. An alarm management method characterized by, The method comprises the following steps: If a trigger alarm event is detected, process tree information is obtained from alarm data corresponding to the alarm event; A process feature set matching the process tree information is obtained; The process tree information is analyzed based on the process feature set to obtain investigation direction information and a preliminary false alarm evaluation result for the alarm event; Investigation evidence is collected from the investigation direction indicated by the investigation direction information to obtain a collection result; Based on the collection result and the preliminary false alarm evaluation result, a false alarm evaluation result for the alarm event is generated.

2. The method of claim 1, wherein, The process feature set matching the process tree information is obtained by: Extracting process identification information from the process tree information; Selecting a process feature set matching the process identification information from process feature sets corresponding to multiple processes; wherein the process feature set includes at least one of process function, process behavior, process startup path, process signature organization, and false alarm operation prone to cause false alarms.

3. The method of claim 2, wherein, The process identification information includes a process name; the process feature set matching the process identification information is selected from process feature sets corresponding to multiple processes by: Comparing the extracted process name with process names corresponding to multiple processes, and taking the process corresponding to the process name that passes the comparison as a target process; Selecting a process feature set corresponding to the target process from process feature sets corresponding to multiple processes.

4. The method of claim 2, wherein, The process feature set corresponding to the target process is selected from process feature sets corresponding to multiple processes by: Performing vector conversion processing on the extracted process identification information to obtain a first vector, and performing vector conversion processing on process identification information corresponding to multiple processes to obtain multiple second vectors; Calculating the correlation degree between the first vector and each second vector; Taking the process corresponding to the second vector with a correlation degree greater than a preset correlation degree threshold as a target process; Selecting a process feature set corresponding to the target process from process feature sets corresponding to multiple processes.

5. The method of claim 1, wherein, The process tree information is analyzed based on the process feature set to obtain investigation direction information and a preliminary false alarm evaluation result for the alarm event by: Performing security level detection on the process tree information based on the process feature set to obtain a detection result; Generating a preliminary false alarm evaluation result for the alarm event based on the detection result; and Generating investigation direction information for the alarm event based on the detection result and the alarm data.

6. The method of claim 5, wherein, The security level detection on the process tree information based on the process feature set to obtain a detection result comprises: If the process feature set includes process behavior, performing security level detection on the process behavior contained in the process tree information based on a preset alarm rule and the process behavior to obtain a detection result; If the process feature set includes a process startup path, performing security level detection on the process startup path contained in the process tree information based on the process startup path to obtain a detection result; If the process feature set includes a process signature organization, a security level detection is performed on a process signature organization contained in the process tree information based on the process signature organization, and a detection result is obtained; If the process feature set includes a false alarm operation that can easily cause a false alarm of an alarm event, a security level detection is performed on an alarm operation contained in the process tree information based on the false alarm operation, and a detection result is obtained.

7. The method of claim 6, wherein, The method further includes: At least one of the following security level detections is performed on the process tree information: A security level detection is performed on a use parameter contained in the process tree information, and a detection result is obtained; A security level detection is performed on a calling relationship between processes contained in the process tree information, and a detection result is obtained.

8. The method of claim 5, wherein, The detection results are multiple; the generation of a false alarm preliminary evaluation result for the alarm event based on the detection results includes: If there are a first preset number of detection results with a security level higher than a preset security level threshold in the multiple detection results, a preliminary evaluation result is generated to represent that a false alarm probability of the alarm event is greater than a preset probability threshold; If there are a second preset number of detection results with a security level lower than a preset security level threshold in the multiple detection results, a preliminary evaluation result is generated to represent that a false alarm probability of the alarm event is less than or equal to the preset probability threshold.

9. The method of claim 5, wherein, The detection results are multiple; the generation of investigation direction information for the alarm event based on the detection results and the alarm data includes: If the security level of all detection results in the multiple detection results is higher than a preset security level threshold, the alarm data is parsed to obtain a deep detection direction triggered by an attack of the alarm event, and investigation direction information for the alarm event is generated based on the deep detection direction; If there is at least one detection result with a security level lower than a preset security level threshold in the multiple detection results, the alarm data and the at least one detection result are parsed to obtain a deep detection direction triggered by an attack of the alarm event, and investigation direction information for the alarm event is generated based on the deep detection direction.

10. The method of claim 1, wherein, The investigation and evidence collection from the investigation direction indicated by the investigation direction information include: Generating agent calling code matched with the investigation direction indicated by the investigation direction information; Calling agent implementation code through the agent calling code to run the agent implementation code to obtain an evidence collection result.

11. The method of claim 10, wherein, The investigation direction information includes multiple investigation questions; the generation of agent calling code matched with the investigation direction indicated by the investigation direction information includes: For each investigation question, the question content corresponding to the investigation question and the tool identification information required to solve the investigation question are generated, and the question content and the tool identification information are taken as parameters of the agent calling code to be generated, and agent calling code matched with the investigation question is generated based on the parameters.

12. The method of claim 10, wherein, The calling agent implementation code through the agent calling code to run the agent implementation code to obtain an evidence collection result includes: Combining the agent calling code and the agent implementation code to generate a code item; Starting the code item in a sandbox to call the agent implementation code in the sandbox through the agent calling code in the sandbox to obtain a forensics result.

13. The method of claim 1, wherein, The forensics result is multiple; the false alarm evaluation result for the alarm event is generated based on the forensics result and the false alarm preliminary evaluation result, including: If there is at least one forensics result in the multiple forensics results for representing that the alarm event is triggered by an attack, and the false alarm preliminary evaluation result is that the false alarm probability of the alarm event is less than or equal to a preset probability threshold, an evaluation result for representing that the alarm event is not false alarm is obtained; If there is no forensics result in the multiple forensics results for representing that the alarm event is triggered by an attack, and the false alarm preliminary evaluation result is that the false alarm probability of the alarm event is greater than the preset probability threshold, an evaluation result for representing that the alarm event is false alarm is obtained.

14. An alarm management apparatus characterized by comprising: Including: The first acquisition module is configured to acquire process tree information from alarm data corresponding to the alarm event if it is detected that the alarm event is triggered; The second acquisition module is configured to acquire a process feature set matched with the process tree information; The analysis module is configured to analyze and process the process tree information based on the process feature set to obtain investigation direction information and a false alarm preliminary evaluation result for the alarm event; The forensics module is configured to investigate and forensics from the investigation direction indicated by the investigation direction information to obtain a forensics result; The generation module is configured to generate a false alarm evaluation result for the alarm event based on the forensics result and the false alarm preliminary evaluation result.

15. An electronic device, comprising: Including: One or more processors; Memory for storing one or more programs, when the one or more programs are executed by the electronic device, the electronic device implements the alarm management method as claimed in any one of claims 1 to 13.

16. A computer readable medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the alarm management method as claimed in any one of claims 1 to 13.

17. A computer program product comprising computer instructions, characterized in that, The computer program is executed by the processor to implement the alarm management method as claimed in any one of claims 1 to 13. The computer program is executed by the processor to implement the alarm management method as claimed in any one of claims 1 to 13.

Images