Network security alarm noise reduction and triage system based on AI baseline

Abstract

The invention discloses a network security alarm noise reduction and triage system based on an AI baseline, and relates to the technical field of network security, and the system comprises an alarm collection module which collects multi-source heterogeneous network security alarm data in real time, obtains an original alarm log, carries out the standardized analysis and feature extraction of the original alarm log, and generates an alarm feature vector; the graph construction module dynamically constructs an asset knowledge graph, associates an asset identifier and a graph node in the alarm feature vector, and injects an asset context attribute, an asset business key weight and a historical threat record; and the linkage processing module is used for executing a preset processing action based on the triage instruction set linkage safety arrangement tool and recording an operation log. According to the method, the alarm feature vectors are input into the optimized AI baseline model, and cooperative reasoning is executed in combination with the asset context attributes of the asset knowledge graph, so that the accuracy and efficiency of alarm noise reduction can be remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network security alarm noise reduction and triage system based on an AI baseline. BACKGROUND

[0002] With the deep penetration of artificial intelligence technology in the field of network security, machine learning models have been widely applied in alarm analysis to identify potential threats and optimize alarm processing procedures. Among them, the model architecture based on graph neural networks and integrated decision trees has made significant progress in alarm noise reduction and triage, and can achieve preliminary threat determination through multi-source log feature extraction. At the same time, the development of asset knowledge graph technology promotes the dynamic integration of alarm and asset context, such as asset business criticality weight and historical threat record injection, enhancing the environmental perception capability. The integration of these technologies effectively supports the structured processing of alarm feature vectors and the model inference process, improving the systematization level of event handling.

[0003] However, the existing technology still has key limitations in handling private deployment scenarios: AI models usually run based on static pre-training mode and cannot adapt to dynamic environmental changes, resulting in feature weight deviation on the incremental security event sample set. Specifically, AI models lack real-time optimization mechanisms in private scenarios and cannot adjust parameters through local incremental learning to capture environment-specific false positive patterns. This deficiency limits the accuracy of alarm noise reduction and reduces the false positive filtering capability, ultimately affecting the confidence of triage decision and the fit of business environment. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a network security alarm noise reduction and triage system based on an AI baseline to solve the problem of low noise reduction accuracy and triage decision deviation caused by the inability of AI models to adapt to changes in private scenarios in network security alarm systems.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] The application provides an AI baseline-based network security alarm noise reduction and triage system, which comprises an alarm collection module, a graph construction module, a model training module, an intelligent noise reduction module and a triage decision module.

[0008] As a preferred scheme of the AI baseline-based network security alarm noise reduction and triage system, the alarm feature vector refers to a field set output after protocol analysis of the original alarm log, time stamp normalization, attack type coding and feature field vectorization conversion are performed, and a multi-dimensional structured vector containing protocol type, source Internet protocol address, destination Internet protocol address, port number and payload feature is generated.

[0009] As a preferred scheme of the AI baseline-based network security alarm noise reduction and triage system, the dynamic construction of the asset knowledge graph comprises the following steps. The initial nodes are matched with the asset identifiers in the alarm feature vector, and the operating system version and business system attribution are injected. Based on the business system attribution, the asset business criticality weight is associated, and the vulnerability exploitation records of the corresponding assets in the historical threat intelligence database are fused to generate the asset knowledge graph with security context attributes. As a preferred scheme of the AI baseline-based network security alarm noise reduction and triage system, the asset context attributes refer to the collection of static features and real-time running states of the assets registered in the configuration management database; the asset business criticality weight refers to a numerical score calculated based on the ITIL service level agreement; and the historical threat record refers to a structured storage of vulnerability exploitation event sequences in the SIEM system.

[0010]

[0011] ​As a preferred scheme of the network security alarm noise reduction and triage system based on the AI baseline, wherein the security event sample set refers to a training data set composed of alarm feature vectors and labeled data; The private scene adaptive training mechanism comprises, Load the pre-trained AI baseline model and import the labeled data in the security event sample set, and adjust the feature weight distribution of the AI baseline model according to the asset environment context label in the labeled data; An incremental learning algorithm is used to optimize the recognition parameters of the AI baseline model for the localized false positive mode, and a lightweight AI baseline model parameter version adapted to the current environment traffic mode is generated.

[0012] As a preferred scheme of the network security alarm noise reduction and triage system based on the AI baseline, wherein the AI baseline model is constructed, and the specific steps are as follows, The security event sample set is input into a graph neural network architecture for attack mode feature extraction, and the asset business criticality weight in the asset knowledge graph is combined to adjust the feature correlation degree calculation parameters; The false positive rules in the historical disposal records are converted into constraint conditions of the AI baseline model, and the AI baseline model is generated through multiple rounds of iterative training.

[0013] As a preferred scheme of the network security alarm noise reduction and triage system based on the AI baseline, wherein the confidence score value of the output noise reduction decision is calculated, and the specific steps are as follows, The alarm feature vector is input into the AI baseline model, and the asset business criticality weight in the asset knowledge graph is called as a feature enhancement factor; The integrated decision tree-based collaborative reasoning calculation is performed to generate three classification results of false positive judgment, low-value alarm screening and high-value attack identification; The confidence score value is calculated according to the probability distribution of the output layer of the AI baseline model.

[0014] As a preferred scheme of the network security alarm noise reduction and triage system based on the AI baseline, wherein the event priority score is calculated and a triage instruction set is generated, and the specific steps are as follows, The high-value attack classification result with a confidence score value exceeding a preset minimum confidence threshold is extracted, and the corresponding asset business criticality weight in the dynamic graph is weighted; The priority base is adjusted according to the confidence score value, the four-level triage confidence threshold group is matched, four-level triage labels of emergency, high, medium and low are generated, and a triage instruction set carrying disposal suggestion codes and dynamic triage decision weight parameters is output.

[0015] As a preferred scheme of the AI baseline-based network security alarm noise reduction and triage system, the preset treatment action refers to an operation sequence of Internet protocol address ban, vulnerability repair and access control policy update generated based on the treatment suggestion code in the triage instruction set.

[0016] As a preferred scheme of the AI baseline-based network security alarm noise reduction and triage system, the preset treatment action refers to an operation sequence of Internet protocol address ban, vulnerability repair and access control policy update generated based on the treatment suggestion code in the triage instruction set. The treatment suggestion code and the dynamic triage decision weight parameter in the triage instruction set are analyzed, and the asynchronous execution interface of the security orchestration tool is called according to the priority of the dynamic triage decision weight parameter; The real-time accessibility state of the target asset in the dynamic graph is verified, the preset treatment action is executed, the operation return code is captured, and the operation log is generated.

[0017] The application has the following advantages: by inputting the alarm feature vector into the optimized AI baseline model and combining the asset context attributes of the asset knowledge graph to perform collaborative reasoning, the accuracy and efficiency of alarm noise reduction can be significantly improved; by dynamically adjusting the feature influence based on the asset business criticality weight, it is ensured that the alarm of high business value assets is given priority attention, and the identification ability of the AI baseline model for key business threats is enhanced; by using the integrated decision tree architecture for collaborative calculation and the multi-round voting mechanism, the decision differences are effectively reduced and the consistency of the classification results is improved; finally, the confidence score value is generated based on the output layer probability distribution, which provides a reliable quantitative basis for alarm noise reduction, so as to efficiently screen real attack alarms and optimize the subsequent triage process. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0019] Fig. 1 The architecture diagram of the AI baseline-based network security alarm noise reduction and triage system.

[0020] Fig. 2 The flowchart of the asset knowledge graph construction.

[0021] Fig. 3 The collaborative reasoning and triage flowchart of the AI baseline model.

[0022] Fig. 4 The core flowchart of the private scenario adaptive training. DETAILED DESCRIPTION

[0023] In order to make the above objectives, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0024] In the following description, a lot of specific details are set forth in order to give a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the concept of the present application, so the present application is not limited to the specific embodiments disclosed below.

[0025] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an embodiment that is independent of or selected from other embodiments.

[0026] Reference Figs. 1-4 For one embodiment of the present application, the embodiment provides an AI baseline-based network security alarm noise reduction and triage system, comprising the following modules: S1: an alarm collection module, which collects real-time multi-source heterogeneous network security alarm data, obtains original alarm logs, performs standardized analysis and feature extraction on the original alarm logs, and generates alarm feature vectors.

[0027] Among them, the alarm feature vector refers to the field set output after protocol analysis of the original alarm log, which performs timestamp normalization, attack type coding and feature field vectorization conversion, and generates a multi-dimensional structured vector containing protocol type, source Internet protocol address, destination Internet protocol address, port number and payload features.

[0028] S1.1: Real-time collection of multi-source heterogeneous network security alarm data to obtain original alarm logs.

[0029] Specifically, network security alarm data is collected in real time from different sources such as firewalls, intrusion detection devices, security information and event management platforms, etc. A stream data ingestion mechanism is used to ensure continuous and uninterrupted network security alarm data collection process, covering original alarm logs of multiple protocols and formats.

[0030] S1.2: Standardized analysis and feature extraction of original alarm logs to generate alarm feature vectors.

[0031] Specifically, based on a pre-defined protocol template (such as HTTP, TCP or UDP), a protocol parser is used to process the original alarm log to extract key fields to form a field set.

[0032] Among them, the key fields include timestamp, protocol type, source internet protocol address, destination internet protocol address, port number, attack type and payload feature. The operation involves loading protocol specification, matching log format, splitting text into field values, and storing as field set.

[0033] Further, the timestamp field in the field set is converted into a unified time format to ensure that all timestamps are consistent and comparable. The operation includes identifying timestamp values, applying time conversion algorithms (such as converting from local time to coordinated universal time), and standardizing output as a fixed format string; Using a predefined coding table (based on common attack categories), the attack type field in the field set is mapped to an integer code. The operation includes querying the coding table, replacing the string value with the corresponding integer, and handling the default code for undefined attack types; The payload feature field in the field set is applied to the term frequency-inverse document frequency method for vectorization conversion, converting the text content into a numerical vector. Other fields such as protocol type, source internet protocol address, destination internet protocol address, and port number are directly retained or converted into numerical form; For example, the protocol type is encoded as an integer, and the IP address is converted to an integer representation. The processed timestamp field, attack type field, protocol type, source internet protocol address, destination internet protocol address, port number, and payload feature field are integrated in a fixed field order, and a fixed-dimensional multi-dimensional structured vector is generated by numerical concatenation.

[0034] S2: Graph construction module, dynamically constructs asset knowledge graph, associates asset identification in alarm feature vector with graph node, injects asset context attribute, asset business criticality weight and historical threat record.

[0035] Among them, the asset context attribute refers to the collection of static features and real-time running state registered in the configuration management database (CMDB); among them, the asset business criticality weight refers to the numerical score calculated based on the ITIL service level agreement (SLA) requirements; among them, the historical threat record refers to the structured storage of vulnerability exploitation event sequence in the SIEM system.

[0036] S2.1: Extract asset internet protocol address, open port and service type data from the configuration management database to generate initial nodes.

[0037] Specifically, access the asset registry through the standard API (such as RESTful API) of the configuration management database, and filter the records containing internet protocol address, open port and service type fields; Traverse each record, extract the Internet Protocol address, open port number and service type, discard invalid records with missing key fields, use the Internet Protocol address and port number combination as the unique node identifier, and the service type as the node attribute to generate the initial node set in the graph structure.

[0038] Example: Configuration management database record: {“Internet Protocol address”: “10.0.0.1”, “open port”: “443”, “service type”: “HTTPS”} → initial node identifier = “10.0.0.1:443”, attribute = “service type: HTTPS”.

[0039] It should be noted that the initial node refers to the data structure representation of a single asset in the graph, and the initial node set is a graph structure dataset composed of initial nodes generated by all valid asset records, and the two are the relationship between elements and containers.

[0040] S2.2: Match the initial node with the asset identifier in the alarm feature vector.

[0041] Specifically, traverse the source Internet Protocol address or destination Internet Protocol address in the alarm feature vector and perform exact matching with the Internet Protocol address of the initial node. If the matching is successful, associate the alarm feature vector with the corresponding initial node; otherwise, mark the asset identifier in the alarm feature vector as “unknown asset” and generate a temporary node to inject asset knowledge graph, while triggering real-time asset discovery process to supplement configuration management database records. The temporary node attributes include the first occurrence timestamp, associated alarm type and default asset business criticality weight (preset as the lowest value).

[0042] S2.3: After successful matching, inject operating system version and business system attribution attributes.

[0043] Specifically, query real-time asset monitoring data sources (such as terminal agents or network scanning tools) to obtain the operating system version attribute (e.g. Windows 10, Linux Kernel 5.4) of the matched node and add it to the node attribute set; access the business system configuration library, find the asset's business system (e.g. “customer relationship management system”) according to the Internet Protocol address, and inject the business system name as an attribute into the asset node.

[0044] S2.4: Based on the business system attribution attribute, associate the asset business criticality weight, and integrate the vulnerability exploitation records of the corresponding asset in the historical threat intelligence library to generate an asset knowledge graph with security context attributes.

[0045] The historical threat intelligence database refers to a collection of multi-source threat data that integrates vulnerability databases, malicious IP blacklists, and attack signature databases. Specifically, it includes structured records of CVE numbers, attack timestamps, exploitation methods, and affected asset identifiers.

[0046] Specifically, based on the business system's attribution attribute, the ITIL Service Level Agreement rule base (predefined table) is queried to obtain SLA indicators such as availability and recovery time targets for the business system corresponding to its attribution attribute; Based on the SLA index, a linear weighting formula is applied to generate the key weights of asset business. Using the Internet Protocol addresses of nodes already constructed in the asset knowledge graph as query keys, the historical threat intelligence database is retrieved to obtain structured records such as CVE numbers, attack timestamps, exploitation methods, and affected asset identifiers related to the target asset. The retrieved structured records are appended to the corresponding asset nodes as "historical threat records" attributes, ensuring that each record contains key information such as CVE number, attack timestamp, and exploitation method; The system integrates all attributes of asset nodes and outputs a graph structure with security context attributes. Asset nodes are connected through business systems or network topology. These attributes include service type, operating system version, business system affiliation, asset business criticality weight, and historical threat records.

[0047] S3: Model training module, which initiates a private scenario adaptive training mechanism and dynamically optimizes the AI ​​baseline model parameters using an incremental learning algorithm based on the current environment's security event sample set.

[0048] The security incident sample set refers to the training dataset composed of alarm feature vectors and labeled data. The labeled data includes false alarm markers, real attack type labels, and corresponding asset environment context labels.

[0049] S3.1: Load the pre-trained AI baseline model and import the labeled data from the security event sample set. Adjust the feature weight distribution of the AI ​​baseline model based on the asset environment context labels in the labeled data.

[0050] Specifically, when reading the initialized AI baseline model parameter file (such as weight matrix and bias vector) from the pre-trained model repository, the basic structure of the AI ​​baseline model must remain unchanged. Read the training dataset, which is a combination of alarm feature vectors and labeled data; Based on asset environment context tags, the system matches the asset business key weight attributes in the asset knowledge graph. For asset-related feature dimensions in the alarm feature vector, the weight values ​​are scaled proportionally according to the business key weight. The higher the key weight, the greater the influence of the relevant alarm feature vector in the AI ​​baseline model.

[0051] Example: If the business system belongs to "online payment system" (asset business criticality weight = 8.5), the weight coefficient of the corresponding asset related alarm feature vector is amplified to 1.5 times the original value; if it is "internal test system" (weight = 3.0), it is reduced to 0.8 times.

[0052] S3.2: Adopt incremental learning algorithm to optimize the recognition parameters of AI baseline model for local false alarm mode, and generate a lightweight AI baseline model parameter version adapted to the current environment traffic mode.

[0053] Specifically, samples with false alarm labels are selected from the security event sample set, and alarm feature vectors are extracted as incremental training sets to focus on learning false alarm patterns specific to the local environment (such as normal operation and maintenance traffic of a specific business system being misjudged as an attack). Further, based on the online sequence extreme learning machine method, incremental training is performed, the hidden layer parameters of the pre-trained AI baseline model are preserved, and only the output layer weight is updated; for high-frequency feature combinations in false alarm samples, such as specific protocol types and port number combinations, the influence of high-frequency feature combinations in model decision-making is reduced by reducing the numerical value of the output layer weight parameters corresponding to high-frequency feature combinations, thereby reducing similar false alarms. Freeze the hidden layer parameters, extract the optimized output layer weights and bias terms, and generate a lightweight file containing only incremental parameters to form a lightweight AI baseline model parameter version.

[0054] Preferably, the lightweight AI baseline model parameter version retains the detection capability of the original AI baseline model for new attacks while enhancing the filtering accuracy of local false alarms.

[0055] S4: Intelligent noise reduction module, input alarm feature vector into optimized AI baseline model, combined with asset context attributes of asset knowledge graph to perform collaborative reasoning, output confidence score value of noise reduction decision.

[0056] Among them, the historical disposition record refers to a set of alarm disposition cases verified by security operation personnel, and the specific historical disposition record contains false alarm feature mode, effective attack disposition method and corresponding asset environment condition annotation information.

[0057] It should be noted that the AI baseline model is constructed, and the specific steps are as follows: Input the security event sample set into the graph neural network architecture to extract attack mode features, and adjust the feature correlation degree calculation parameters combined with the asset business criticality weight in the asset knowledge graph; Specifically, input the security event sample set into the graph neural network architecture, use graph convolution operation to extract the correlation between alarm feature vectors, and form attack mode features.

[0058] Convert the false positive rules in the historical handling records into constraint conditions of the AI baseline model, and generate the AI baseline model with business environment perception capability through multiple rounds of iterative training.

[0059] Specifically, the false positive feature mode (such as "source Internet protocol address is intranet address and protocol type = HTTP") in the historical handling records is extracted and converted into a logical constraint expression. The constraint expression is injected into the graph neural network loss function as a regularization term to force the AI baseline model to learn the real environment decision rules.

[0060] Early stopping strategy is adopted to control the training rounds, and the training is terminated when the attack pattern feature recognition accuracy and the constraint condition compliance rate reach a stable state synchronously, generating the AI baseline model with business environment perception capability.

[0061] For example: 50 rounds of iterative training are performed, and the attack feature pattern recognition accuracy and the constraint condition compliance rate are optimized simultaneously. When the validation set accuracy fluctuates by less than 1% for 5 consecutive rounds, the training is terminated.

[0062] S4.1: Input the alarm feature vector into the AI baseline model, and call the asset business criticality weight in the asset knowledge graph as a feature enhancement factor.

[0063] Specifically, the alarm feature vector is transmitted to the input layer of the AI baseline model, the source Internet protocol address and the destination Internet protocol address in the alarm feature vector are identified, the asset knowledge graph nodes are matched, and the corresponding asset business criticality weight value is obtained.

[0064] When the asset business criticality weight is in a higher interval, the related feature dimension is appropriately enlarged; when the asset business criticality weight is in a lower interval, the related feature dimension is appropriately reduced; and the original feature value is maintained in other weight intervals.

[0065] It should be noted that the measurement method for determining the "higher interval" and "lower interval" of the asset business criticality weight is as follows: by analyzing historical security event data, collecting key indicators such as actual business interruption duration, customer impact range and financial loss of various assets when under attack; further, using quantile statistics method, the business criticality weight value distribution of all assets is divided into several interval segments, and the part causing the most significant business impact is selected as the higher interval, and the part causing the least impact is selected as the lower interval.

[0066] For example: when the asset business criticality weight is > 7.0, the related feature dimension is enlarged by 1.5 times; when the asset business criticality weight is < 3.0, the related feature dimension is reduced by 0.7 times; and the original feature value is maintained in other weight intervals.

[0067] S4.2: Perform collaborative inference calculation based on integrated decision tree, generate three classification results of false alarm judgment, low value alarm screening and high value attack identification.

[0068] Specifically, the enhanced alarm feature vector is distributed to the random forest composed of multiple decision trees, and each decision tree is independently operated based on different feature subsets; The decision tree group performs multiple rounds of voting: in the first stage, basic majority voting is adopted, and when the decision difference exceeds the preset difference threshold, weighted voting based on the historical performance of the decision tree is started; Among them, the preset of the difference threshold adopts a dynamic adjustment method, which is set based on the historical voting consistency of the decision tree group and the feature distribution dispersion, and the difference threshold is usually set in the interval of 10% to 20%.

[0069] Integrate all decision tree outputs to generate three classification probability distribution vectors of false alarm judgment, low value alarm and high value attack.

[0070] S4.3: Calculate the confidence score value according to the probability distribution of the output layer of the AI baseline model.

[0071] Specifically, read the three classification probability distribution vectors generated by the output layer of the AI baseline model, and identify the class with the maximum probability value as the dominant class.

[0072] Linearly map the probability value of the dominant class to a percentage score, and generate the confidence score value using the rounding rule.

[0073] S5: The triage decision module calculates the event priority score and generates the triage instruction set according to the confidence score value and the asset business criticality weight.

[0074] S5.1: Extract high value attack classification results with confidence score values exceeding the preset minimum confidence threshold, and superimpose the corresponding asset business criticality weight in the dynamic atlas for weighting.

[0075] Among them, the preset minimum confidence threshold is automatically determined by analyzing the confidence score distribution of historical high value attack alarm samples, and the statistical method is used to identify the confidence threshold between real attacks and false alarms. The optimal segmentation point that can balance the false negative and false positive risks is calculated based on the probability density function as the minimum confidence threshold.

[0076] Specifically, the alarm feature vector record is retained for high value attack identification and the confidence score value is greater than or equal to the minimum confidence threshold.

[0077] For each filtered high value attack identification alarm feature vector record, identify the target asset identifier (usually the combination of the destination Internet Protocol address and port number) in the alarm feature vector.

[0078] The target asset is used to query the current dynamically constructed asset knowledge graph, and the asset nodes in the graph are accurately matched.

[0079] It should be noted that if the matching is successful, the asset knowledge graph is updated with the latest node, and the corresponding asset business criticality weight value is directly extracted from the node attribute for subsequent weighted calculation. If it is not matched, a default asset business criticality weight value is assigned, and a real-time asset discovery process is triggered to update the asset knowledge graph. The extracted asset business criticality weight value is used as a weighting factor, and a preset weighting rule is applied to perform weighted calculation on the confidence score value of the filtered high-value attack identification alarm feature vector record, and a weighted priority base value is generated.

[0080] The preset weighting rule refers to a mathematical mapping relationship defined based on the asset business criticality weight value interval, which linearly or nonlinearly adjusts the original confidence score value according to the business importance degree.

[0081] S5.2: Adjust the priority base value according to the confidence score value, match the preset four-level triage confidence threshold group to generate emergency, high, medium and low four-level triage labels, and output the triage instruction set carrying the treatment suggestion code and dynamic triage decision weight parameter.

[0082] The preset four-level triage confidence threshold group is automatically divided based on the statistical distribution of historical event priority values, and an unsupervised clustering algorithm is used to analyze the correlation between event treatment urgency and business impact degree. The priority value range is divided into four levels of emergency, high, medium and low according to the natural clustering characteristics of the data. The four-level triage confidence threshold boundary values are generated by optimization algorithm, which ensures that each level corresponds to a data-driven response standard, and the statistical significant interval between adjacent levels is reserved to avoid level overlap.

[0083] Specifically, the weighted priority base value is received, and the priority base value corresponds to each high-value attack identification alarm feature vector record; For each record, the confidence score value is used as an adjustment factor, and a preset adjustment rule is applied to fine-tune the priority base value to generate an event priority value.

[0084] For example, the adjustment rule describes that if the confidence score value is in the high interval, the base value is slightly increased, if it is in the low interval, the base value is slightly decreased, and if it is in the middle range, the base value is kept.

[0085] The preset four-level triage confidence threshold group is obtained. The four-level triage confidence threshold group defines the boundary values for mapping continuous event priority values to four discrete triage levels of emergency, high, medium and low.

[0086] The event priority score is compared with the four triage confidence threshold groups to determine the triage level (emergency, high, medium, and low) to which the alarm feature vector record belongs.

[0087] According to the determined triage level, a preset triage level and treatment suggestion code mapping table is queried to obtain the corresponding treatment suggestion code.

[0088] It should be noted that the treatment suggestion code indicates the type of treatment action to be taken; For example, Internet Protocol address blocking, vulnerability repair, and access control policy update.

[0089] The asset business criticality weight value (reflecting business impact) and the event priority score (reflecting overall urgency) are combined as a dynamic triage decision weight parameter.

[0090] The triage level, treatment suggestion code, and dynamic triage decision weight parameter are integrated to generate a triage instruction set in a predefined data structure format (such as a JSON format key-value pair structure).

[0091] Preferably, the triage instruction set provides a triage conclusion and action guidance for each high-value attack alarm processed.

[0092] S6: Linkage treatment module, based on the triage instruction set, link the security orchestration tool to execute the preset treatment action and record the operation log.

[0093] Among them, the preset treatment action refers to the operation sequence of Internet Protocol address blocking, vulnerability repair, and access control policy update generated based on the treatment suggestion code in the triage instruction set.

[0094] S6.1: Analyze the treatment suggestion code and dynamic triage decision weight parameter in the triage instruction set, and call the asynchronous execution interface of the security orchestration tool according to the priority of the dynamic triage decision weight parameter.

[0095] Specifically, the treatment suggestion code field is extracted from the triage instruction set record.

[0096] According to the treatment suggestion code, a predefined treatment suggestion code and preset treatment action sequence mapping table is queried to obtain the corresponding preset treatment action sequence.

[0097] The dynamic triage decision weight parameter field is extracted from the triage instruction set record, and the event priority score in the dynamic triage decision weight parameter is analyzed.

[0098] The event priority score is converted into an asynchronous call priority parameter (e.g., a higher priority corresponds to a shorter execution delay tolerance time), and the asynchronous execution interface provided by the security orchestration tool is called using the converted asynchronous call priority parameter to submit the preset handling action sequence. Asynchronous execution ensures that handling action execution does not block the main process, and returns an execution task identifier for subsequent tracking.

[0099] S6.2: Verify the real-time reachability state of the target asset in the dynamic graph, execute the preset handling action, and capture the operation return code to generate an operation log containing the operation command, return code, and associated asset context.

[0100] Specifically, before executing the preset handling action sequence, the target asset identifier involved in the preset handling action sequence is identified. For example, a banned Internet Protocol address, an asset identifier with a vulnerability to be repaired, and an asset identifier with a policy to be updated.

[0101] The target asset identifier is used to query the currently dynamically constructed asset knowledge graph to obtain the real-time reachability state attribute of the asset node. The real-time reachability state attribute reflects the current online or offline state of the asset.

[0102] Verify that the real-time reachability state of the target asset identifier in the asset knowledge graph is online. Only target asset identifiers in the online state are executed with the preset handling action sequence.

[0103] If the real-time reachability state of the target asset identifier is online, the security orchestration tool executes each operation command in the preset handling action sequence; and captures the operation return code returned by the security orchestration tool after executing each operation command. The operation return code indicates operation execution success, failure, or timeout. For each executed operation command, an operation log record is generated, and the generated operation log record is persistently stored in the operation log library.

[0104] It should be noted that in the executed online operation, the operation log record contains the following fields: operation command: the specific operation command string actually executed. Return code: the operation return code returned by the security orchestration tool. Associated asset context: key attributes related to the target asset identifier extracted from the asset knowledge graph, such as business system affiliation and asset business criticality weight.

[0105] If the real-time reachability state of the target asset identifier is offline, the execution of handling actions that require real-time interaction is suspended, the operation in the preset handling action sequence that allows delayed execution is marked as a pending task, a special operation log record containing the unexecuted reason code as asset offline is generated, the complete content of the preset handling action sequence and the asset last online timestamp are recorded, the asset state monitoring process is triggered and the pending task is automatically retried when the asset recovers online, and all operation log records are persistently stored in the operation log library.

[0106] In summary, by inputting the alarm feature vector into the optimized AI baseline model and performing collaborative reasoning combined with the asset context attributes of the asset knowledge graph, the accuracy and efficiency of alarm noise reduction can be significantly improved. By dynamically adjusting the feature influence combined with the asset business criticality weight, it ensures that high business value assets are given priority attention, enhancing the AI baseline model's ability to identify key business threats. By using an integrated decision tree architecture for collaborative computing and a multi-round voting mechanism, decision disagreements are effectively reduced and the consistency of classification results is improved. Finally, based on the output layer probability distribution, a confidence score value is generated, providing a reliable quantitative basis for alarm noise reduction, thereby efficiently filtering out real attack alarms and optimizing subsequent triage processes.

[0107] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, which should be covered by the scope of the claims of the present application.

Claims

1. An AI baseline-based network security alarm noise reduction and triage system, characterized in that: Comprising, The alarm collection module collects multi-source heterogeneous network security alarm data in real time, obtains original alarm logs, performs standardized analysis and feature extraction on the original alarm logs, and generates alarm feature vectors; The graph construction module dynamically constructs an asset knowledge graph, associates asset identifiers in the alarm feature vectors with graph nodes, and injects asset context attributes, asset business criticality weights, and historical threat records; The model training module starts a private scenario adaptive training mechanism, optimizes AI baseline model parameters based on the current environment's security event sample set using an incremental learning algorithm; The intelligent noise reduction module inputs the alarm feature vectors into the optimized AI baseline model, performs collaborative reasoning combined with the asset context attributes of the asset knowledge graph, and outputs confidence score values of the noise reduction decision; The triage decision module calculates event priority scores and generates triage instruction sets based on the confidence score values and asset business criticality weights; The linkage disposal module executes preset disposal actions based on the triage instruction set and records operation logs.

2. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The alarm feature vector refers to the field set output after protocol analysis of the original alarm log, which performs timestamp normalization, attack type encoding, and feature field vectorization conversion to generate a multi-dimensional structured vector containing protocol type, source Internet protocol address, destination Internet protocol address, port number, and payload features.

3. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The asset knowledge graph is dynamically constructed, and the specific steps are as follows, Extract asset Internet protocol addresses, open ports, and service type data from the configuration management database to generate initial nodes; Match the initial nodes with the asset identifiers in the alarm feature vectors, and inject operating system version and business system attribution attributes; Based on the business system attribution attribute, associate the asset business criticality weight, and fuse the vulnerability exploitation records of the corresponding assets in the historical threat intelligence library to generate an asset knowledge graph with security context attributes.

4. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The asset context attribute refers to the collection of static features and real-time running states of assets registered in the configuration management database; the asset business criticality weight refers to a numerical score calculated based on the ITIL service level agreement requirements; the historical threat record refers to a structured storage of vulnerability exploitation event sequences in the SIEM system.

5. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The security event sample set refers to a training data set composed of alarm feature vectors and labeled data; The private scenario adaptive training mechanism includes, Load the pre-trained AI baseline model and import the labeled data in the security event sample set, adjust the feature weight distribution of the AI baseline model according to the asset environment context labels in the labeled data; Optimize the recognition parameters of the AI baseline model for the local false positive mode using an incremental learning algorithm to generate a lightweight AI baseline model parameter version adapted to the current environment traffic mode.

6. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: Construct the AI baseline model, and the specific steps are as follows, Input the security event sample set into the graph neural network architecture for attack mode feature extraction, and adjust the feature correlation calculation parameters combined with the asset business criticality weight in the asset knowledge graph; Convert the false positive rules in the historical disposal records into constraint conditions for the AI baseline model, and generate the AI baseline model through multiple rounds of iterative training.

7. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The confidence score value of the output noise reduction decision is calculated as follows, The alarm feature vector is input into the AI baseline model, and the asset business criticality weight in the asset knowledge graph is called as a feature enhancement factor; Collaborative reasoning calculation based on integrated decision tree is performed to generate three classification results of false alarm judgment, low-value alarm screening and high-value attack identification; The confidence score value is calculated according to the probability distribution of the output layer of the AI baseline model.

8. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The event priority score is calculated and the triage instruction set is generated as follows, The high-value attack classification result with a confidence score value exceeding a preset minimum confidence threshold is extracted, and the corresponding asset business criticality weight in the dynamic graph is weighted; The priority base is adjusted according to the confidence score value, and the four-level triage confidence threshold group is matched to generate four-level triage labels of emergency, high, medium and low, and the triage instruction set carrying the handling suggestion code and the dynamic triage decision weight parameter is output.

9. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The preset handling action refers to the operation sequence of Internet protocol address ban, vulnerability repair and access control policy update generated based on the handling suggestion code in the triage instruction set.

10. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The security orchestration tool is executed based on the triage instruction set to perform the preset handling action and record the operation log as follows, The handling suggestion code and the dynamic triage decision weight parameter in the triage instruction set are parsed, and the asynchronous execution interface of the security orchestration tool is called according to the priority of the dynamic triage decision weight parameter; The real-time accessibility state of the target asset in the dynamic graph is verified, the preset handling action is executed, and the operation return code is captured to generate the operation log.

Images