Intrusion detection alert noise reduction and priority dynamic sorting method

Abstract

The application discloses an intrusion detection alarm noise reduction and priority dynamic sorting method, and belongs to the technical field of network security, comprising the following steps: acquiring multi-source original alarm data, performing standardization processing, and obtaining a standard alarm data set; performing deduplication processing on the standard alarm data set to obtain a simplified alarm data set; introducing an attention mechanism into a pre-trained large language model, encoding the simplified alarm data set, and obtaining a high-dimensional semantic vector; constructing a noise recognition model based on a binary classification model; inputting the high-dimensional semantic vector into the trained noise recognition model to recognize effective noise alarms; constructing a multi-dimensional scoring model to sort the priorities of the recognized effective noise alarms, and obtaining corresponding priority sorting results. The application not only greatly improves the alarm processing efficiency and decision accuracy, but also reduces the artificial intervention cost, supports high-concurrency and high-availability enterprise-level application requirements, and has a wide application prospect and popularization value.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network security, and particularly relates to an intrusion detection alarm noise reduction and priority dynamic sorting method. BACKGROUND

[0002] With the diversification and complexity of network attack means, Intrusion Detection System (IDS) plays an important role in enterprise network security protection. However, in practical application, IDS usually generates a large amount of alarm information, which contains a large number of redundant, false alarms or low priority alarms, bringing a great workload to the security team. Traditional alarm processing methods mainly rely on rule matching, statistical analysis and other means, but these methods are difficult to effectively deal with the current complex network security environment.

[0003] Firstly, the traditional method has obvious shortcomings in alarm noise reduction. Due to the lack of understanding ability of alarm context, these methods cannot accurately distinguish between effective alarms and noise. For example, some alarms may be frequently triggered due to fluctuations in network environment, but in fact they do not constitute a threat. In addition, the efficiency of alarm deduplication and merging is low, especially in large-scale network environment, the number of repeated alarms may account for more than 60% of the total alarm amount.

[0004] Secondly, the existing method also faces many challenges in priority sorting. The current priority sorting is mostly based on static rules or simple feature weight allocation, which cannot dynamically adapt to complex network environment and attack scenarios. For example, some low threat level alarms may become potential threats due to their high relevance with other alarms. In addition, the lack of time sensitivity analysis may lead to the failure to respond to high-risk events in a timely manner.

[0005] Furthermore, the high cost of manual intervention is another problem to be solved. The security team needs to spend a lot of time manually screening and analyzing alarms, which reduces the response efficiency. Manual intervention not only consumes time, but also easily introduces subjective bias, affecting the accuracy of decision-making.

[0006] In view of the above problems in the prior art, it is urgent to propose an intrusion detection alarm noise reduction and priority dynamic sorting method. SUMMARY

[0007] To solve the above technical problems, the present application proposes an intrusion detection alarm noise reduction and priority dynamic sorting method, which combines Large Language Model (LLM) technology to intelligently process massive alarm data, realizes efficient noise reduction and dynamic priority sorting, and significantly improves the efficiency of security operation, to solve the above problems existing in the prior art.

[0008] To achieve the above object, the application provides an intrusion detection alarm noise reduction and priority dynamic sorting method, comprising the following steps:

[0009] Obtain multi-source original alarm data and perform standardization processing to obtain a standard alarm data set;

[0010] Perform deduplication processing on the standard alarm data set to obtain a simplified alarm data set;

[0011] Introduce an attention mechanism into a pre-trained large language model, encode the simplified alarm data set to obtain a high-dimensional semantic vector;

[0012] Construct a noise recognition model based on a binary classification model and perform training;

[0013] Input the high-dimensional semantic vector into the trained noise recognition model to identify effective noise alarms;

[0014] Construct a multi-dimensional scoring model to sort the priorities of the identified effective noise alarms to obtain corresponding priority sorting results.

[0015] Optionally, the process of obtaining multi-source original alarm data and performing standardization processing to obtain a standard alarm data set comprises:

[0016] Uniformly convert the time stamps of the multi-source original alarm data into international standard time format, convert the Internet protocol addresses into classless inter-domain routing representation, perform classification coding on the protocol type field, and introduce a data verification mechanism to ensure the integrity of the data in the transmission process through hash value comparison and field integrity check.

[0017] Optionally, the process of performing deduplication processing on the standard alarm data set to obtain a simplified alarm data set comprises:

[0018] For completely repeated alarm records in the standard alarm data set, rule matching is used for removal;

[0019] For similar alarm records in the standard alarm data set, cosine similarity and Jaccard similarity coefficient are used to calculate the intersection and union ratio between similar alarm records, and when the intersection and union ratio exceeds a preset threshold, similar alarm records are combined into one record.

[0020] Optionally, the process of constructing a noise recognition model based on a binary classification model and performing training comprises:

[0021] Firstly, the noise recognition model is trained by introducing a regularization coefficient, and then the trained model is subjected to adversarial training by adding perturbation, and finally the trained noise recognition model is obtained.

[0022] Optionally, a multi-dimensional scoring model is constructed to prioritize the identified effective noise alarms, and the process of obtaining the corresponding priority ranking result includes:

[0023] The threat level, influence range, context relevance, and time sensitivity are selected as the scoring dimensions, and weights are assigned to each scoring dimension to complete the construction of the multi-dimensional scoring model; the effective noise alarms are prioritized based on the multi-dimensional scoring model to obtain an initial ranking result; the weight distribution of the multi-dimensional scoring model is dynamically adjusted through deep reinforcement learning to optimize the initial ranking result and obtain a final priority ranking result.

[0024] Optionally, it also includes constructing an interactive dashboard to display the time distribution, geographical distribution, and priority ranking result of the effective noise alarms.

[0025] The present application also proposes an alarm noise reduction and priority dynamic sorting system for large-scale intrusion detection, which is used to implement the method, and the system includes:

[0026] A data acquisition module is used to acquire multi-source original alarm data and perform standardization processing to obtain a standard alarm data set;

[0027] A data processing module is used to perform deduplication processing on the standard alarm data set to obtain a simplified alarm data set;

[0028] A data encoding module is used to introduce an attention mechanism in a pre-trained large language model to encode the simplified alarm data set to obtain a high-dimensional semantic vector;

[0029] A noise identification module is used to construct a noise identification model based on a binary classification model and perform training, input the high-dimensional semantic vector into the trained noise identification model, and identify effective noise alarms;

[0030] A multi-dimensional scoring module is used to construct a multi-dimensional scoring model to prioritize the identified effective noise alarms and obtain the corresponding priority ranking result.

[0031] The present application also proposes a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to realize the steps of the method.

[0032] The present application also proposes a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to realize the steps of the method.

[0033] The present application also proposes a computer program product including a computer program, wherein the computer program is executed by a processor to realize the steps of the method.

[0034] Compared with the prior art, the present application has the following advantages and technical effects:

[0035] The present application significantly reduces redundant alarms through standardized data formats and deduplication strategies; utilizes large language models to generate high-dimensional semantic vectors and combines attention mechanisms to accurately capture the implicit relationships between alarms; through a multi-dimensional scoring model and a deep reinforcement learning algorithm, dynamic weight adjustment is achieved to ensure that high-risk events are responded to in a timely manner; at the same time, with the help of a knowledge graph and a visualization interface, an intuitive threat view and intelligent recommendation function are provided for the security team. The overall solution not only significantly improves alarm processing efficiency and decision-making accuracy, but also reduces manual intervention costs, supports high-concurrency and high-availability enterprise-level application requirements, and has a wide range of application prospects and promotional value. BRIEF DESCRIPTION OF DRAWINGS

[0036] The accompanying drawings, which form a part of this application, are intended to provide further understanding of the application and are incorporated herein in their entirety, and the illustrative embodiments of the application and their description serve to explain the application. The drawings in the accompanying drawings are as follows:

[0037] Figure 1 is a system architecture diagram of an embodiment of the present application;

[0038] Figure 2 is an alarm noise reduction flowchart of an embodiment of the present application;

[0039] Figure 3 is a multi-dimensional scoring model structure diagram of an embodiment of the present application;

[0040] Figure 4 is a knowledge graph application example diagram of an embodiment of the present application. DETAILED DESCRIPTION

[0041] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0042] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0043] Embodiment one

[0044] As shown in Figures 1-2 The present embodiment provides an intrusion detection alarm noise reduction and priority dynamic sorting method, wherein:

[0045] Figure 1The overall architecture of the system is shown, including the module division and mutual relationship of the data acquisition layer, data processing layer, analysis decision layer and user interaction layer. The figure clearly describes the functional positioning and data flow path of each module.

[0046] Figure 2 The specific steps from data preprocessing to noise identification are described, including data standardization, deduplication strategy, semantic vector generation and training process of noise identification model.

[0047] The method specifically comprises the following steps:

[0048] Obtain multi-source original alarm data and perform standardization processing to obtain a standard alarm data set;

[0049] Perform deduplication processing on the standard alarm data set to obtain a simplified alarm data set;

[0050] Introduce an attention mechanism in a pre-trained large language model, encode the simplified alarm data set to obtain a high-dimensional semantic vector;

[0051] Construct a noise identification model based on a binary classification model and train it;

[0052] Input the high-dimensional semantic vector into the trained noise identification model to identify effective noise alarms;

[0053] Construct a multi-dimensional scoring model to prioritize the identified effective noise alarms and obtain the corresponding priority ranking results.

[0054] The process of obtaining multi-source original alarm data and performing standardization processing to obtain a standard alarm data set can include:

[0055] Convert the timestamps of multi-source original alarm data into international standard time format, convert internet protocol addresses into classless inter-domain routing representation, perform classification coding on protocol type fields, and introduce a data verification mechanism to ensure data integrity during transmission through hash value comparison and field integrity check.

[0056] As a specific implementation, the alarm data comes from the enterprise's internally deployed intrusion detection system (IDS), security information and event management (SIEM) platform, firewall log and terminal detection and response (EDR) system. The data formats include common formats such as JSON, CSV and Syslog, and support multiple protocols such as HTTP, MQTT and Kafka for data transmission.

[0057] Field mapping and format conversion of data from different sources is the first step of data standardization. For example, unify the timestamp to ISO 8601 standard format (YYYY-MM-DDTHH:mm:ssZ), and convert the IP address to CIDR notation. Define a common data structure Store alarm information:

[0058] ;

[0059] wherein, represents a timestamp, represents a source IP, represents a target IP, represents a protocol type, represents an attack feature description. To ensure data consistency, the embodiment also introduces a data verification mechanism to prevent errors during data transmission through hash value comparison and field integrity check.

[0060] The process of implementing the standard alarm data set to obtain a simplified alarm data set includes:

[0061] For completely repeated alarm records in the standard alarm data set, rule matching is used to remove; for similar alarm records in the standard alarm data set, cosine similarity and Jaccard similarity coefficient are used to calculate the intersection and union ratio between similar alarm records, and when the intersection and union ratio exceeds a preset threshold, similar alarm records are combined into one record.

[0062] As a specific embodiment, assume that an enterprise generates about 100,000 original alarms in a day, of which about 30% are repeated alarms and 20% are noise alarms. Therefore, the data deduplication strategy is an important link in the noise reduction process.

[0063] The deduplication strategy first removes completely repeated alarm records based on rule matching. For alarms with high similarity, in addition to using cosine similarity, Jaccard similarity coefficient can also be introduced to calculate the intersection and union ratio of two alarm sets :

[0064] ;

[0065] If , it is considered that the two alarms are repeated records.

[0066] For text fields such as "attack feature description", use Levenshtein distance to judge similarity:

[0067] ;

[0068] If , the two texts are considered similar.

[0069] Further, missing field completion is also an important part of data preprocessing. For the missing timestamp field , the linear interpolation method is used to estimate:

[0070] ;

[0071] where and are the nearest time points before and after the missing timestamp. For missing numerical fields such as threat level, K-Nearest Neighbors (KNN) algorithm is used for prediction:

[0072] ;

[0073] where is the number of neighbors, is the field value of the th neighbor.

[0074] The process of introducing attention mechanism into the pre-trained large language model to encode the reduced alarm data set and obtain high-dimensional semantic vectors includes:

[0075] Semantic vector generation is the core step of alarm noise reduction. In order to improve the expression ability of semantic vectors, pre-trained large language models (such as GPT-4 or BERT) are used to encode alarm descriptions to generate high-dimensional semantic vectors. In order to improve the expression ability, attention mechanism (Attention Mechanism) is introduced to weight the importance of different words and generate more accurate semantic vectors :

[0076] ;

[0077] where is the attention weight of the th word, n is the number of words, is the corresponding word vector. The calculation formula of attention weight is as follows:

[0078] ;

[0079] where is the relevance score of the th word, is the relevance score of the th word, and exp() is the exponential function.

[0080] To further enhance the model's generalization ability, this embodiment also introduces transfer learning technology, using a pre-trained large language model (such as GPT-4 or BERT) as the base model and fine-tuning it on specific tasks.

[0081] A feasible process for constructing and training a noise recognition model based on a binary classification model includes:

[0082] The noise recognition model is first trained by introducing a regularization coefficient, and then adversarial training is performed again by adding perturbations based on the results of the first training, finally obtaining the trained noise recognition model.

[0083] As a specific implementation method, constructing a noise recognition model is a crucial step in the noise reduction process. This embodiment constructs a noise recognition model based on a binary classification model (such as logistic regression or SVM), identifying valid noise alarms based on semantic vectors and other features (such as threat level and frequency of occurrence). A regularization term is introduced during model training to prevent overfitting, and the loss function is:

[0084] ;

[0085] in, For loss function, This is the weight vector of the model. For bias terms, The total number of training samples. For the first The index of each training sample. For the first The true labels of each training sample For the first The feature vectors of each training sample For the model to predict the first The probability that a sample is a positive class. The regularization coefficient is . Weight vector of Norm squared.

[0086] Furthermore, adversarial training is used to enhance model robustness by adding perturbations during training. From the input data, the trained noise recognition model is finally obtained:

[0087] ;

[0088] in, For the input data after adding perturbation, The original input data, The amplitude of the disturbance. ( ) is a symbol function, is a loss function the gradient of the input data , is a loss function.

[0089] The process of implementing a multi-dimensional scoring model to prioritize the identified effective noise alerts includes:

[0090] Selecting threat level, impact range, context relevance, and time sensitivity as scoring dimensions, and assigning weights to each scoring dimension to complete the construction of the multi-dimensional scoring model; based on the multi-dimensional scoring model, the effective noise alerts are prioritized to obtain an initial sorting result; the weight distribution of the multi-dimensional scoring model is dynamically adjusted through deep reinforcement learning, and the initial sorting result is optimized to obtain the final priority sorting result. Figure 3 The components of the multi-dimensional scoring model and its weight adjustment mechanism are shown, and the role of the deep reinforcement learning algorithm in dynamically adjusting the weights is highlighted.

[0091] As a specific implementation, the present embodiment defines a multi-dimensional scoring model that considers the following four dimensions:

[0092] Threat level: threat severity derived from historical data analysis;

[0093] Impact range: importance and coverage of the attacked assets;

[0094] Context relevance: correlation between alerts calculated using semantic vectors generated by large language models;

[0095] Time sensitivity: based on the time distribution of the occurrence of the alert and the attack window period;

[0096] The weight distribution formula is:

[0097] ;

[0098] wherein, is the comprehensive score, is the weight of each dimension, is the weight of each scoring dimension, is the threat level score, is the impact range score, is the context relevance score, is the time sensitivity score.

[0099] The reinforcement learning optimization weight adjustment is the core of dynamic prioritization. The embodiment adjusts the weight dynamically through deep reinforcement learning (DRL). The state space , action space and reward function are defined as follows:

[0100] The state space includes the priority distribution of the current alarm, historical data feedback, etc.

[0101] The action space includes actions to adjust the weight of each dimension;

[0102] The reward function is defined as:

[0103] ;

[0104] Wherein, is the total reward value, is the performance improvement value after the th weight adjustment, is the total number of weight adjustments.

[0105] The deep Q-network (DQN) is used for policy optimization, and the objective function is:

[0106] ;

[0107] Wherein, is the loss function, is the parameter of the current Q network, is the parameter of the target network, is the discount factor, is the current state, is the action taken in state , is the immediate reward obtained after executing action , is the next state transferred after executing action , is the value estimate of the current Q network taking action in state , is the Q value estimate of the target network taking action in state , is the maximum Q value estimate of the target network for all possible actions in state . ​To sample an experience sample from an experience replay pool The expectation of the experience sample.

[0108] The method can be implemented, and further includes constructing an interactive dashboard based on which a time distribution, a geographical distribution and a priority ranking result of the effective noise alarm are displayed.

[0109] As a specific embodiment, the embodiment designs an interactive dashboard to display real-time distribution and priority ranking results of the alarm. The dashboard includes the following modules:

[0110] Alarm list module: display alarm information according to priority, support keyword search and filtering function.

[0111] Timeline view module: display the time distribution of alarm occurrence in the form of time axis, facilitate to find abnormal period.

[0112] Heat map module: display the geographical distribution of the alarm, help to identify high-risk areas.

[0113] Use ECharts or D3.js to realize dynamic chart rendering, ensure the smoothness and scalability of the interface.

[0114] Further, in order to enhance the user experience, the embodiment also introduces voice interaction function, the user can query specific alarm or execute operation through voice instruction.

[0115] Further, it also includes intelligent recommendation function, the intelligent recommendation function enhances the accuracy of the recommendation system by introducing knowledge graph (Knowledge Graph). Figure 4 It describes how the knowledge graph associates the alarm with other related information (such as vulnerability database, asset list, etc.), and generates accurate disposal suggestions. The graph shows the core role of the knowledge graph in the intelligent recommendation function.

[0116] By constructing the knowledge graph in the field of network security, the alarm is associated with other related information such as vulnerability database, asset list, etc., to generate more accurate disposal suggestions. The formal description of the recommendation strategy is as follows:

[0117] ;

[0118] Wherein, is the recommendation result, is the set of effective alarms, is the reasoning function based on the knowledge graph.

[0119] The embodiment can be implemented, and proposes an alarm noise reduction and priority dynamic sorting method for large-scale intrusion detection systems. By combining large language model (LLM) technology, an intelligent and efficient alarm processing framework is constructed. The method optimizes the key links in the traditional alarm processing process from data preprocessing, semantic analysis, noise identification to dynamic priority sorting.

[0120] The embodiment significantly improves the efficiency and accuracy of network security operations by combining large language model (LLM) technology and advanced machine learning algorithms. In enterprise network security protection, intrusion detection systems (IDS) often generate a large number of redundant, false or low-priority alarm information, which not only increases the workload of the security team, but also may cause high-risk events to be ignored. To solve this problem, the embodiment significantly reduces the number of invalid alarms through intelligent noise reduction technology, thereby laying a foundation for subsequent processing.

[0121] Specifically, the embodiment uses data preprocessing, semantic analysis and noise identification steps to effectively reduce the alarm density. Experimental results show that after noise reduction processing, the proportion of effective alarms is increased from 10% of the original data to 70%, significantly improving the efficiency of alarm processing. In addition, through cosine similarity, Jaccard coefficient and edit distance methods, duplicate and similar alarms are removed, further reducing the number of redundant alarms and significantly reducing the work pressure of the security team. The noise-reduced alarm data is not only more refined, but also provides higher quality input for subsequent priority sorting.

[0122] In terms of alarm priority sorting, traditional methods are mostly based on static rules or simple feature weight allocation, which are difficult to dynamically adapt to complex network environments and attack scenarios. The embodiment introduces a multi-dimensional scoring model, which considers threat level, impact range, context relevance and time sensitivity, etc. to ensure comprehensive evaluation of the importance of each alarm. At the same time, through deep reinforcement learning (DRL), the weights of each dimension are dynamically adjusted, so that the system can continuously optimize the priority sorting strategy according to the real-time network state and historical data feedback. Compared with the traditional static rule method, the accuracy of the priority sorting model is improved by 17% to 92%, ensuring that high-risk events can be responded in a timely manner. This dynamic adaptability makes the system more reliable in the face of diversified attacks.

[0123] To further enhance the accuracy of decision-making, this embodiment makes full use of the powerful semantic understanding and context reasoning capabilities of large language models, and deeply excavates the implicit relationships between alerts. For example, seemingly independent alerts may belong to the same attack chain. This correlation analysis helps the security team more accurately identify potential threats and avoid missing critical information. By weighting the importance of different words through attention mechanisms, more accurate semantic vectors are generated, further enhancing the model's generalization and expression capabilities. In addition, adversarial training and regularization techniques enhance the robustness of the noise identification model, making it more stable in the face of diverse attacks, thereby improving the overall accuracy of decision-making.

[0124] In practical applications, this embodiment greatly reduces the need for human intervention through automated noise reduction and intelligent recommendation functions. User feedback shows that the work efficiency of security analysts has increased by about 40%. Specifically, the intelligent recommendation strategies generated by LLM assist the security team in quickly developing disposal solutions, thereby improving the overall efficiency of security operations. In addition, by reducing false positive rates, this embodiment reduces resource waste caused by false positives, further optimizing operating costs. This efficient and automated processing method provides strong support for enterprise network security operations.

[0125] Embodiment Two

[0126] Based on the same overall inventive concept, the present application also provides an alert noise reduction and priority dynamic sorting system for large-scale intrusion detection. The system provided by the present application is described below, and the system described below can be referred to each other corresponding to the method described above, which comprises:

[0127] A data acquisition module is configured to acquire multi-source original alert data and perform standardization processing to obtain a standard alert data set;

[0128] A data processing module is configured to perform deduplication processing on the standard alert data set to obtain a simplified alert data set;

[0129] A data encoding module is configured to introduce an attention mechanism in a pre-trained large language model and encode the simplified alert data set to obtain a high-dimensional semantic vector;

[0130] A noise identification module is configured to construct a noise identification model based on a binary classification model and perform training, input the high-dimensional semantic vector into the trained noise identification model, and identify effective noise alerts;

[0131] A multi-dimensional scoring module is configured to construct a multi-dimensional scoring model, perform priority sorting on the identified effective noise alerts, and obtain corresponding priority sorting results.

[0132] It should be understood that the alarm noise reduction and priority dynamic sorting system for large-scale intrusion detection provided by the embodiments of the present application has all the advantages of the method provided by the above embodiments.

[0133] Embodiment three

[0134] The embodiment also discloses a computer device, comprising a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to realize the steps of the method in the embodiment one.

[0135] Embodiment four

[0136] The embodiment also discloses a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the steps of the method in the embodiment one.

[0137] Embodiment five

[0138] The embodiment also discloses a computer program product, which comprises a computer program, and the computer program is executed by a processor to realize the steps of the method in the embodiment one.

[0139] The above is only the preferred specific implementation of the present application, but the protection scope of the present application is not limited to this, any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An intrusion detection alert noise reduction and priority dynamic ordering method, characterized in that, The method comprises the following steps: obtaining a multi-source original alarm data set and performing standardization processing to obtain a standard alarm data set; performing deduplication processing on the standard alarm data set to obtain a simplified alarm data set; introducing an attention mechanism into a pre-trained large language model, encoding the simplified alarm data set to obtain a high-dimensional semantic vector; constructing a noise recognition model based on a binary classification model and training the noise recognition model; inputting the high-dimensional semantic vector into the trained noise recognition model to identify effective noise alarms; constructing a multi-dimensional scoring model to prioritize the identified effective noise alarms to obtain a corresponding priority ranking result; The process of constructing a noise recognition model based on a binary classification model and training the noise recognition model comprises: first training the noise recognition model by introducing a regularization coefficient, then performing adversarial training again by adding perturbations on the results of the first training, and finally obtaining the trained noise recognition model; The process of constructing a multi-dimensional scoring model to prioritize the identified effective noise alarms to obtain a corresponding priority ranking result comprises: selecting threat level, impact range, context relevance and time sensitivity as scoring dimensions, and assigning weights to each scoring dimension to complete the construction of the multi-dimensional scoring model; based on the multi-dimensional scoring model, the effective noise alarms are prioritized to obtain an initial ranking result; the weight distribution of the multi-dimensional scoring model is dynamically adjusted through deep reinforcement learning, and the initial ranking result is optimized to obtain the final priority ranking result.

2. The method of claim 1, wherein The process of obtaining a multi-source original alarm data set and performing standardization processing to obtain a standard alarm data set comprises: unifying the timestamps of the multi-source original alarm data into international standard time format, converting the Internet protocol addresses into classless inter-domain routing representation, performing classification coding on the protocol type field, and introducing a data verification mechanism to ensure the integrity of the data during transmission through hash value comparison and field integrity check.

3. The method of claim 1, wherein The process of performing deduplication processing on the standard alarm data set to obtain a simplified alarm data set comprises: for completely repeated alarm records in the standard alarm data set, rule matching is used to remove them; for similar alarm records in the standard alarm data set, cosine similarity and Jaccard similarity coefficient are used to calculate the intersection and union ratio between similar alarm records, and when the intersection and union ratio exceeds a preset threshold, similar alarm records are combined into one record.

4. The method of claim 1, further comprising: constructing an interactive dashboard to display the time distribution, geographical distribution and priority ranking result of the effective noise alarms based on the interactive dashboard.

5. An alarm noise reduction and dynamic priority ranking system for large-scale intrusion detection, characterized in that, The system for implementing the method of any one of claims 1-4 comprises: a data acquisition module for obtaining a multi-source original alarm data set and performing standardization processing to obtain a standard alarm data set; a data processing module for performing deduplication processing on the standard alarm data set to obtain a simplified alarm data set; A data encoding module is configured to introduce an attention mechanism in a pre-trained large language model, encode the reduced alarm data set, and obtain a high-dimensional semantic vector. A noise identification module is configured to construct a noise identification model based on a binary classification model, train the noise identification model, input the high-dimensional semantic vector into the trained noise identification model, and identify effective noise alarms. A multi-dimensional scoring module is configured to construct a multi-dimensional scoring model, prioritize the identified effective noise alarms, and obtain corresponding priority ranking results.

6. A computer apparatus comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program, when executed by the processor, causes the processor to perform the method of any one of claims 1 to 5. The processor executes the computer program to implement the steps of the method of any one of claims 1-4.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the steps of the method of any one of claims 1-4.

8. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-4.

Images