AI baseline-based network security alarm noise reduction and triage system

Abstract

The application discloses an AI baseline-based network security alarm noise reduction and triage system, relates to the technical field of network security, and comprises an alarm collection module, which collects multi-source heterogeneous network security alarm data in real time, obtains original alarm logs, performs standardized analysis and feature extraction on the original alarm logs, and generates alarm feature vectors; a graph construction module, which dynamically constructs an asset knowledge graph, associates asset identifiers in the alarm feature vectors with graph nodes, and injects asset context attributes, asset business criticality weights and historical threat records; and a linkage disposal module, which executes preset disposal actions based on a linkage security arrangement tool according to a triage instruction set and records operation logs. The application can significantly improve the accuracy and efficiency of alarm noise reduction by inputting the alarm feature vectors into an optimized AI baseline model and performing collaborative reasoning in combination with the asset context attributes of the asset knowledge graph.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, and in particular to a cybersecurity alarm noise reduction and triage system based on AI baselines. Background Technology

[0002] With the deep penetration of artificial intelligence technology into the cybersecurity field, machine learning models have been widely applied in alert analysis to identify potential threats and optimize alert handling processes. Among these, model architectures based on graph neural networks and ensemble decision trees have made significant progress in alert noise reduction and triage, enabling preliminary threat assessment through multi-source log feature extraction. Simultaneously, the development of asset knowledge graph technology has promoted the dynamic integration of alerts with asset context, such as injecting asset business criticality weights and historical threat records, enhancing environmental awareness. The fusion of these technologies effectively supports the structured processing of alert feature vectors and model inference processes, improving the systematization of incident handling.

[0003] However, existing technologies still have key limitations when dealing with private deployment scenarios: AI models typically operate based on static pre-training modes, which cannot adapt to dynamic environmental changes, leading to feature weight shifts on incremental security event sample sets. Specifically, AI models lack real-time optimization mechanisms for private scenarios and cannot adjust parameters through local incremental learning to capture environment-specific false alarm patterns. This deficiency limits alarm noise reduction accuracy, reduces false alarm filtering capabilities, and ultimately affects the confidence level of triage decisions and their fit with the business environment. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a network security alarm noise reduction and triage system based on AI baseline to solve the problems of low noise reduction accuracy and triage decision bias caused by the inability of AI models in network security alarm systems to adapt to changes in private scenarios.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a network security alarm noise reduction and triage system based on an AI baseline, comprising: an alarm acquisition module, which collects multi-source heterogeneous network security alarm data in real time, obtains raw alarm logs, performs standardized parsing and feature extraction on the raw alarm logs, and generates alarm feature vectors; a graph construction module, which dynamically constructs an asset knowledge graph, associates asset identifiers in the alarm feature vectors with graph nodes, and injects asset context attributes, asset business criticality weights, and historical threat records; a model training module, which initiates a private scenario adaptive training mechanism, dynamically optimizes the AI ​​baseline model parameters using an incremental learning algorithm based on the current environment's security event sample set; an intelligent noise reduction module, which inputs the alarm feature vectors into the optimized AI baseline model, performs collaborative reasoning in conjunction with the asset context attributes of the asset knowledge graph, and outputs a confidence score value for noise reduction decisions; a triage decision module, which calculates event priority scores and generates a triage instruction set based on the confidence score value and the asset business criticality weights; and a coordinated handling module, which coordinates with security orchestration tools to execute preset handling actions based on the triage instruction set and records operation logs.

[0008] As a preferred embodiment of the AI ​​baseline-based network security alarm noise reduction and triage system described in this invention, the alarm feature vector refers to the set of fields output after protocol parsing of the original alarm log, performing timestamp normalization, attack type encoding and feature field vectorization transformation to generate a multi-dimensional structured vector containing protocol type, source Internet protocol address, destination Internet protocol address, port number and payload features.

[0009] As a preferred embodiment of the AI-based network security alarm noise reduction and triage system described in this invention, the specific steps for dynamically constructing an asset knowledge graph are as follows:

[0010] Extract asset Internet Protocol addresses, open ports, and service type data from the configuration management database to generate initial nodes;

[0011] Match the initial node with the asset identifier in the alarm feature vector, and inject the operating system version and business system ownership attribute;

[0012] Based on the business system's attribution attributes and the associated asset business criticality weights, and by integrating the vulnerability exploitation records of corresponding assets in the historical threat intelligence database, an asset knowledge graph with security context attributes is generated.

[0013] As a preferred embodiment of the AI ​​baseline-based network security alarm noise reduction and triage system described in this invention, the asset context attribute refers to the set of static characteristics and real-time operating status of the asset registered in the configuration management database; the asset business criticality weight refers to the numerical score calculated based on the ITIL service level agreement requirements; and the historical threat record refers to the sequence of vulnerability exploitation events that are structured and stored in the SIEM system.

[0014] As a preferred embodiment of the AI ​​baseline-based network security alarm noise reduction and triage system described in this invention, the security event sample set refers to a training dataset composed of alarm feature vectors and labeled data.

[0015] The private scenario adaptive training mechanism includes:

[0016] Load the pre-trained AI baseline model and import the labeled data from the security event sample set. Adjust the feature weight distribution of the AI ​​baseline model according to the asset environment context labels in the labeled data.

[0017] An incremental learning algorithm is used to optimize the identification parameters of the AI ​​baseline model for localized false alarm patterns, generating a lightweight AI baseline model parameter version that adapts to the current traffic patterns.

[0018] As a preferred embodiment of the AI ​​baseline-based network security alarm noise reduction and triage system described in this invention, the specific steps for constructing the AI ​​baseline model are as follows:

[0019] The attack pattern features are extracted by inputting the security incident sample set into the graph neural network architecture, and the feature correlation calculation parameters are adjusted by combining the asset business key weights in the asset knowledge graph.

[0020] The false alarm rules in the historical processing records are converted into constraints for the AI ​​baseline model, and the AI ​​baseline model is generated through multiple rounds of iterative training.

[0021] As a preferred embodiment of the AI-based network security alarm noise reduction and triage system of the present invention, the specific steps for outputting the confidence score of the noise reduction decision are as follows:

[0022] Input the alarm feature vector into the AI ​​baseline model and call the asset business key weights in the asset knowledge graph as feature enhancement factors;

[0023] Perform collaborative reasoning computation based on ensemble decision trees to generate three-classification results: false alarm judgment, low-value alarm screening, and high-value attack identification;

[0024] The confidence score is calculated based on the probability distribution of the output layer of the AI ​​baseline model.

[0025] As a preferred embodiment of the AI-based baseline-based network security alarm noise reduction and triage system of the present invention, the specific steps for calculating event priority scores and generating triage instruction sets are as follows:

[0026] High-value attack classification results with confidence scores exceeding the preset minimum confidence threshold are extracted and weighted by overlaying the corresponding asset business key weights in the dynamic graph.

[0027] The priority base is adjusted based on the confidence score, and the four-level triage confidence threshold group is matched to generate emergency, high, medium and low triage labels. The triage instruction set carrying treatment suggestion code and dynamic triage decision weight parameters is output.

[0028] As a preferred embodiment of the AI-based network security alarm noise reduction and triage system described in this invention, the preset handling actions refer to the sequence of Internet Protocol address blocking, vulnerability repair, and access control policy update operations generated based on the handling suggestion code in the triage instruction set.

[0029] As a preferred embodiment of the AI-based network security alarm noise reduction and triage system of the present invention, the steps of executing preset handling actions and recording operation logs based on the triage instruction set in conjunction with the security orchestration tool are as follows:

[0030] The system parses the treatment suggestion code and dynamic triage decision weight parameters in the triage instruction set, and calls the asynchronous execution interface of the security orchestration tool according to the priority of the dynamic triage decision weight parameters.

[0031] Verify the real-time reachability status of the target asset in the dynamic graph, execute preset actions and capture operation return codes, and generate operation logs.

[0032] The beneficial effects of this invention are as follows: By inputting alarm feature vectors into the optimized AI baseline model and performing collaborative reasoning in conjunction with the asset context attributes of the asset knowledge graph, the accuracy and efficiency of alarm denoising can be significantly improved; by dynamically adjusting the feature influence based on the key weight of asset business, alarms of high-business-value assets are given priority attention, enhancing the AI ​​baseline model's ability to identify key business threats; by utilizing an integrated decision tree architecture for collaborative computation and a multi-round voting mechanism, decision disagreements are effectively reduced and the consistency of classification results is improved; finally, a confidence score is generated based on the output layer probability distribution, providing a reliable quantitative basis for alarm denoising, thereby efficiently screening real attack alarms and optimizing the subsequent triage process. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is an architecture diagram of a cybersecurity alarm noise reduction and triage system based on AI baselines.

[0035] Figure 2 Build a flowchart for the asset knowledge graph.

[0036] Figure 3 A flowchart for collaborative reasoning and triage of AI baseline models.

[0037] Figure 4 Core flowchart for adaptive training in private scenarios. Detailed Implementation

[0038] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0039] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0040] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0041] Reference Figures 1-4 As one embodiment of the present invention, this embodiment provides a network security alarm noise reduction and triage system based on AI baseline, including the following modules:

[0042] S1: Alarm collection module, which collects multi-source heterogeneous network security alarm data in real time, obtains raw alarm logs, performs standardized parsing and feature extraction on the raw alarm logs, and generates alarm feature vectors.

[0043] Among them, the alarm feature vector refers to the set of fields output after protocol parsing of the original alarm log. It performs timestamp normalization, attack type encoding and feature field vectorization transformation to generate a multi-dimensional structured vector containing protocol type, source Internet protocol address, destination Internet protocol address, port number and payload features.

[0044] S1.1: Collect multi-source heterogeneous network security alarm data in real time and obtain raw alarm logs.

[0045] Specifically, network security alert data is collected in real time from various sources, including firewalls, intrusion detection devices, security information, and event management platforms. A streaming data ingestion mechanism ensures continuous and uninterrupted network security alert data collection, covering raw alert logs in multiple protocols and formats.

[0046] S1.2: Standardize and parse the original alarm logs and extract features to generate alarm feature vectors.

[0047] Specifically, based on predefined protocol templates (such as HTTP, TCP, or UDP), a protocol parser is used to process the raw alarm logs and extract key fields to form a field set.

[0048] Key fields include timestamp, protocol type, source internet protocol address, destination internet protocol address, port number, attack type, and payload characteristics. The operation involves loading protocol specifications, matching log formats, splitting text into field values, and storing it as a set of fields.

[0049] Furthermore, the timestamp fields in the field set are converted to a uniform time format to ensure that all timestamps are consistent and comparable. This process includes identifying timestamp values, applying time conversion algorithms (such as converting from local time to Coordinated Universal Time), and standardizing the output into a fixed-format string.

[0050] Using a predefined encoding table (based on common attack categories), the attack type field in the field set is mapped to an integer code. Operations include querying the encoding table, replacing string values ​​with corresponding integers, and handling default codes for undefined attack types.

[0051] The payload feature fields in the field set are vectorized using the term frequency-inverse document frequency method, converting the text content into numerical vectors. Other fields, such as protocol type, source internet address, destination internet address, and port number, are either directly retained or converted to numerical form.

[0052] For example, encoding protocol types as integers and converting IP addresses to integer representations;

[0053] The timestamp field, attack type field, protocol type, source internet protocol address, destination internet protocol address, port number, and payload characteristic field are integrated and processed in a fixed field order, and then the numerical values ​​are concatenated to generate a fixed-dimensional multidimensional structured vector.

[0054] S2: Graph construction module, dynamically constructs asset knowledge graph, associates asset identifiers in alarm feature vectors with graph nodes, and injects asset context attributes, asset business criticality weights, and historical threat records.

[0055] Among them, asset context attributes refer to the set of static characteristics and real-time operating status of an asset registered in the Configuration Management Database (CMDB); asset business criticality weight refers to a numerical score calculated based on ITIL Service Level Agreement (SLA) requirements; and historical threat records refer to a sequence of vulnerability exploitation events that are structured and stored in the SIEM system.

[0056] S2.1: Extract asset Internet Protocol addresses, open ports, and service type data from the configuration management database to generate the initial node.

[0057] Specifically, the asset registry can be accessed through a standard API (such as a RESTful API) configured to manage the database, and records containing fields for Internet Protocol address, open port, and service type can be filtered.

[0058] Traverse each record, extract the Internet Protocol address, open port number, and service type, discard invalid records with missing key fields, use the combination of Internet Protocol address and port number as the unique node identifier, and the service type as the node attribute to generate the initial set of nodes in the graph structure.

[0059] Example: Configure the database record: {"Internet Protocol Address": "10.0.0.1", "Open Port": "443", "Service Type": "HTTPS"} → Initial Node Identifier = "10.0.0.1:443", Attribute = "Service Type: HTTPS".

[0060] It should be noted that an initial node refers to the data structure representation of a single asset in the graph, while the initial node set is a graph structure dataset composed of initial nodes generated from all valid asset records. The two are related as element and container.

[0061] S2.2: Match the initial node with the asset identifier in the alarm feature vector.

[0062] Specifically, the source or destination Internet Protocol (IP) addresses in the alarm feature vector are traversed and precisely matched with the IP address of the initial node. If a match is successful, the alarm feature vector is associated with the corresponding initial node; otherwise, the asset identifier in the alarm feature vector is marked as "unknown asset," and a temporary node is generated to inject into the asset knowledge graph. Simultaneously, a real-time asset discovery process is triggered to supplement the configuration management database records. The temporary node attributes include the first appearance timestamp, associated alarm type, and default asset business criticality weight (preset to the minimum value).

[0063] S2.3: After a successful match, inject the operating system version and business system ownership attributes.

[0064] Specifically, query the real-time asset monitoring data source (such as terminal agent or network scanning tool), obtain the operating system version attribute of the matching node (such as Windows 10, Linux Kernel 5.4), and add it to the node attribute set; access the business system configuration library, find the business system to which the asset belongs (such as "customer relationship management system") according to the Internet protocol address, and inject the business system name as an attribute into the asset node.

[0065] S2.4: Based on the business system's ownership attributes and the associated asset business criticality weights, and by integrating the vulnerability exploitation records of the corresponding assets in the historical threat intelligence database, an asset knowledge graph with security context attributes is generated.

[0066] The historical threat intelligence database refers to a collection of multi-source threat data that integrates vulnerability databases, malicious IP blacklists, and attack signature databases. Specifically, it includes structured records of CVE numbers, attack timestamps, exploitation methods, and affected asset identifiers.

[0067] Specifically, based on the business system's attribution attribute, the ITIL Service Level Agreement rule base (predefined table) is queried to obtain SLA indicators such as availability and recovery time targets for the business system corresponding to its attribution attribute;

[0068] Based on the SLA index, a linear weighting formula is applied to generate the key weights of asset business.

[0069] Using the Internet Protocol addresses of nodes already constructed in the asset knowledge graph as query keys, the historical threat intelligence database is retrieved to obtain structured records such as CVE numbers, attack timestamps, exploitation methods, and affected asset identifiers related to the target asset.

[0070] The retrieved structured records are appended to the corresponding asset nodes as "historical threat records" attributes, ensuring that each record contains key information such as CVE number, attack timestamp, and exploitation method;

[0071] The system integrates all attributes of asset nodes and outputs a graph structure with security context attributes. Asset nodes are connected through business systems or network topology. These attributes include service type, operating system version, business system affiliation, asset business criticality weight, and historical threat records.

[0072] S3: Model training module, which initiates a private scenario adaptive training mechanism and dynamically optimizes the AI ​​baseline model parameters using an incremental learning algorithm based on the current environment's security event sample set.

[0073] The security incident sample set refers to the training dataset composed of alarm feature vectors and labeled data. The labeled data includes false alarm markers, real attack type labels, and corresponding asset environment context labels.

[0074] S3.1: Load the pre-trained AI baseline model and import the labeled data from the security event sample set. Adjust the feature weight distribution of the AI ​​baseline model based on the asset environment context labels in the labeled data.

[0075] Specifically, when reading the initialized AI baseline model parameter file (such as weight matrix and bias vector) from the pre-trained model repository, the basic structure of the AI ​​baseline model must remain unchanged.

[0076] Read the training dataset, which is a combination of alarm feature vectors and labeled data;

[0077] Based on asset environment context tags, the system matches the asset business key weight attributes in the asset knowledge graph. For asset-related feature dimensions in the alarm feature vector, the weight values ​​are scaled proportionally according to the business key weight. The higher the key weight, the greater the influence of the relevant alarm feature vector in the AI ​​baseline model.

[0078] Example: If the business system is classified as "Online Payment System" (Asset Business Keyness Weight = 8.5), the weight coefficient of the corresponding asset-related alarm feature vector will be increased to 1.5 times the original value; if it is "Internal Testing System" (Weight = 3.0), it will be reduced to 0.8 times.

[0079] S3.2: Employ incremental learning algorithms to optimize the AI ​​baseline model's identification parameters for localized false alarm patterns, generating a lightweight AI baseline model parameter version that adapts to the current environment's traffic patterns.

[0080] Specifically, samples with false alarm labels are selected from the security event sample set, and alarm feature vectors are extracted as incremental training sets to focus on learning false alarm patterns unique to the local environment (such as normal operation and maintenance traffic of a specific business system being misjudged as an attack).

[0081] Furthermore, incremental training is performed based on the online sequence extreme learning machine method, retaining the hidden layer parameters of the pre-trained AI baseline model and only updating the output layer weights; for high-frequency feature combinations in false alarm samples, such as specific protocol type and port number combinations, the influence of high-frequency feature combinations on model decision-making is reduced by decreasing the value of the output layer weight parameters corresponding to the high-frequency feature combinations, thereby reducing similar false alarms;

[0082] Freeze the hidden layer parameters, extract the optimized output layer weights and bias terms, generate a lightweight file containing only incremental parameters, and form a lightweight AI baseline model parameter version.

[0083] The superior version of the lightweight AI baseline model parameters retains the original AI baseline model's ability to detect new attacks while enhancing the filtering accuracy of local false positives.

[0084] S4: Intelligent noise reduction module, which inputs alarm feature vectors into the optimized AI baseline model, performs collaborative reasoning in combination with asset context attributes of asset knowledge graph, and outputs confidence score of noise reduction decision.

[0085] Among them, historical handling records refer to a collection of alarm handling cases verified by security operations personnel. Specifically, historical handling records include false alarm characteristic patterns, effective attack handling methods, and corresponding asset environment conditions.

[0086] It should be noted that the specific steps for building an AI baseline model are as follows:

[0087] The attack pattern features are extracted by inputting the security incident sample set into the graph neural network architecture, and the feature correlation calculation parameters are adjusted by combining the asset business key weights in the asset knowledge graph.

[0088] Specifically, the security event sample set is input into a graph neural network architecture, and graph convolution operations are used to extract the correlation between alarm feature vectors to form attack pattern features.

[0089] The false alarm rules in historical processing records are converted into constraints for the AI ​​baseline model, and an AI baseline model that integrates business environment perception capabilities is generated through multiple rounds of iterative training.

[0090] Specifically, false alarm feature patterns (such as "source Internet protocol address is an internal network address and protocol type = HTTP") are extracted from historical processing records and converted into logical constraint expressions. These constraint expressions are then injected into the graph neural network loss function as regularization terms, forcing the AI ​​baseline model to learn decision rules for real-world environments.

[0091] An early stop strategy is adopted to control the number of training rounds. Training is terminated when the accuracy of attack pattern feature recognition and the compliance rate with constraint conditions reach a stable state, thereby generating an AI baseline model that integrates business environment perception capabilities.

[0092] For example, perform 50 rounds of iterative training, optimizing both the accuracy of attack feature pattern recognition and the constraint compliance rate in each round. Training is terminated when the validation set accuracy fluctuates by less than 1% for five consecutive rounds.

[0093] S4.1: Input the alarm feature vector into the AI ​​baseline model and call the asset business key weights in the asset knowledge graph as feature enhancement factors.

[0094] Specifically, the alarm feature vector is fed into the input layer of the AI ​​baseline model to identify the source Internet Protocol address and destination Internet Protocol address in the alarm feature vector, match the asset knowledge graph node, and obtain the corresponding asset business key weight value.

[0095] When the key weight of asset business is in a high range, the relevant feature dimensions should be appropriately increased; when the key weight of asset business is in a low range, the relevant feature dimensions should be appropriately decreased; other weight ranges should maintain the original feature values.

[0096] It should be noted that the measurement method for determining the "higher interval" and "lower interval" of the asset business criticality weight is as follows: By analyzing historical security incident data, key indicators such as the actual business interruption duration, customer impact scope, and financial losses caused by attacks on various assets are collected; furthermore, the quantile statistical method is used to divide the distribution of the business criticality weight values ​​of all assets into several intervals, and the part that causes the most significant impact on business is selected as the higher interval, and the part that has the least impact is selected as the lower interval.

[0097] For example, when the asset business key weight is >7.0, the relevant feature dimension is increased by 1.5 times; when the asset business key weight is <3.0, the relevant feature dimension is reduced by 0.7 times; other weight ranges maintain the original feature values.

[0098] S4.2: Perform collaborative reasoning computation based on ensemble decision tree to generate three-classification results: false alarm judgment, low-value alarm screening, and high-value attack identification.

[0099] Specifically, the enhanced alarm feature vectors are distributed to a random forest composed of multiple decision trees, and each decision tree performs independent operations based on a different feature subset;

[0100] The decision tree group conducts multiple rounds of voting: the first stage adopts basic majority voting, and when the decision disagreement exceeds the preset disagreement threshold, weighted voting based on the historical performance of the decision tree is initiated;

[0101] The divergence threshold is preset using a dynamic adjustment method, based on the historical voting consistency and feature distribution dispersion of the decision tree group. The divergence threshold is usually set in the range of 10% to 20%.

[0102] By combining the outputs of all decision trees, a three-class probability distribution vector is generated for false positives, low-value alerts, and high-value attacks.

[0103] S4.3: Calculate the confidence score based on the probability distribution of the output layer of the AI ​​baseline model.

[0104] Specifically, the three-class probability distribution vector generated by the output layer of the AI ​​baseline model is read, and the class with the highest probability value is identified as the dominant class.

[0105] The probability values ​​of the dominant category are linearly mapped to a percentage score, and confidence scores are generated using rounding rules.

[0106] S5: Triage decision module, which calculates event priority scores and generates triage instruction sets based on confidence scores and asset business criticality weights.

[0107] S5.1: Extract the classification results of high-value attacks whose confidence scores exceed the preset minimum confidence threshold, and weight them by overlaying the corresponding asset business key weights in the dynamic graph.

[0108] The preset minimum confidence threshold is automatically determined by analyzing the confidence score distribution of historical high-value attack alarm samples. Statistical methods are used to identify the boundary characteristics between real attacks and false alarms in terms of confidence. The optimal split point that can balance the risks of missed and false alarms is calculated based on the probability density function as the minimum confidence threshold.

[0109] Specifically, retain alarm feature vector records where the three-class probability distribution vector is identified as a high-value attack and the confidence score is greater than or equal to the minimum confidence threshold.

[0110] For each high-value attack identification alert feature vector record that passes the filter, identify the target asset identifier (usually a combination of the destination Internet Protocol address and port number) in the alert feature vector.

[0111] Use the target asset identifier to query the currently dynamically constructed asset knowledge graph and accurately match the asset nodes in the graph.

[0112] It should be noted that if a match is successful, the asset knowledge graph is now updated with the latest node, and the corresponding asset business key weight value is directly extracted from the node attributes for subsequent weighted calculations. If no match is found, a preset default asset business key weight value is assigned, and the real-time asset discovery process is triggered to update the asset knowledge graph. The extracted asset business key weight value is used as a weighting factor, and a preset weighting rule is applied to calculate the confidence score value recorded in the high-value attack identification alarm feature vector that has passed the filtering, generating a weighted priority base value.

[0113] The preset weighting rule refers to a calculation method that adjusts the original confidence score value linearly or non-linearly according to the importance of the business based on a predefined mathematical mapping relationship between the key weight values ​​of the asset business.

[0114] S5.2: Adjust the priority base number according to the confidence score, match the preset four-level triage confidence threshold group to generate four-level triage labels of emergency, high, medium and low, and output a triage instruction set carrying treatment suggestion code and dynamic triage decision weight parameters.

[0115] The preset four-level triage confidence threshold group is automatically divided based on the statistical distribution of historical event priority scores. An unsupervised clustering algorithm is used to analyze the correlation between the urgency of event handling and the degree of business impact, dividing the priority score range into four levels: urgent, high, medium, and low, according to the natural clustering characteristics of the data. The boundary values ​​of the four-level triage confidence threshold are calculated and generated through an optimization algorithm to ensure that each level corresponds to a data-driven response standard, and that statistically significant intervals are maintained between adjacent levels of the four-level triage confidence threshold to avoid level overlap.

[0116] Specifically, the weighted priority base value is received, and the priority base value corresponds to the feature vector record of each high-value attack identification alarm;

[0117] For each record, the confidence score is used as an adjustment factor, and a preset adjustment rule is applied to fine-tune the priority base value to generate an event priority score.

[0118] Example, rule description for adjustment: If the confidence score is in the high range, slightly increase the base value; if it is in the low range, slightly decrease the base value; if it is in the middle range, keep the base value.

[0119] Obtain the preset four-level triage confidence threshold group. The four-level triage confidence threshold group defines the boundary values ​​that map continuous event priority scores to four discrete triage levels: urgent, high, medium, and low.

[0120] The event priority score is matched and compared with the four-level triage confidence threshold group to determine the triage level (urgent, high, medium and low) to which the alarm feature vector record belongs.

[0121] Based on the determined triage level, query the preset triage level and treatment suggestion code mapping table to obtain the corresponding treatment suggestion code.

[0122] It should be noted that the action recommendation code indicates the type of action to be taken;

[0123] For example, blocking Internet Protocol addresses, patching vulnerabilities, and updating access control policies.

[0124] The asset business keyness weight value (reflecting business impact) and event priority score (reflecting overall urgency) are combined as the weight parameters for dynamic triage decision-making.

[0125] Integrate triage levels, treatment suggestion codes, and dynamic triage decision weight parameters, and assemble them into a triage instruction set according to a predefined data structure format (such as a JSON key-value pair structure).

[0126] Ideally, the triage instruction set provides triage conclusions and action guidelines for each high-value attack alert processed.

[0127] S6: Linked treatment module, which executes preset treatment actions and records operation logs based on the triage instruction set linked safety orchestration tool.

[0128] Among them, the preset handling actions refer to the sequence of Internet Protocol address blocking, vulnerability patching, and access control policy update operations generated based on the handling suggestion code in the triage instruction set.

[0129] S6.1: Parse the treatment suggestion code and dynamic triage decision weight parameters in the triage instruction set, and call the asynchronous execution interface of the security orchestration tool according to the priority of the dynamic triage decision weight parameters.

[0130] Specifically, the treatment suggestion code field is extracted from the triage instruction set record.

[0131] Based on the handling suggestion code, query the predefined handling suggestion code and preset handling action sequence mapping table to obtain the corresponding preset handling action sequence.

[0132] Extract the dynamic triage decision weight parameter field from the triage instruction set record, and parse the event priority score in the dynamic triage decision weight parameter.

[0133] The event priority score is converted into an asynchronous call priority parameter (e.g., higher priority corresponds to a shorter execution latency tolerance time). Using the converted asynchronous call priority parameter, the asynchronous execution interface provided by the security orchestration tool is invoked to submit a preset sequence of actions. Asynchronous execution ensures that the execution of actions does not block the main process and returns an execution task identifier for subsequent tracking.

[0134] S6.2: Verify the real-time reachability status of the target asset in the dynamic graph, execute the preset disposal action and capture the operation return code, and generate an operation log containing the operation command, return code and associated asset context.

[0135] Specifically, before executing the preset action sequence, the identifiers of the target assets involved in the preset action sequence are identified. For example, the identifiers of blocked Internet Protocol addresses, assets with vulnerabilities to be patched, and assets with policies to be updated.

[0136] Use the target asset identifier to query the dynamically constructed asset knowledge graph and obtain the real-time reachability status attribute of the asset node. The real-time reachability status attribute reflects the asset's current online or offline status.

[0137] Verify that the target asset identifier's real-time reachability status in the asset knowledge graph is online. Only execute the preset action sequence for target assets that are online.

[0138] If the target asset's real-time reachability status is online, the security orchestration tool executes each operation command in the preset action sequence; it captures the operation return code returned after executing each operation command. The operation return code indicates whether the operation was successful, failed, or timed out. For each executed operation command, an operation log record is generated and persistently stored in the operation log repository.

[0139] It should be noted that in the online operations that have been executed, the operation log records include the following fields: Operation Command: The specific operation command string actually executed. Return Code: The operation return code returned by the security orchestration tool. Associated Asset Context: Key attributes related to the target asset identifier extracted from the asset knowledge graph, such as business system affiliation and asset business criticality weight.

[0140] If the real-time reachability status of the target asset is offline, the execution of the disposal actions that require real-time interaction will be suspended. The operations in the preset disposal action sequence that are allowed to be delayed will be marked as pending tasks. A special operation log record containing the reason code that the asset is offline will be generated. At the same time, the complete content of the preset disposal action sequence and the asset's last online timestamp will be recorded. The asset status monitoring process will be triggered and the pending tasks will be automatically retried when the asset is restored to online status. All operation log records will be persistently stored in the operation log library.

[0141] In summary, this invention significantly improves the accuracy and efficiency of alarm denoising by inputting alarm feature vectors into an optimized AI baseline model and performing collaborative reasoning based on asset context attributes from an asset knowledge graph. It dynamically adjusts feature influence based on asset business criticality weights to ensure that alarms from high-value assets receive priority attention, enhancing the AI ​​baseline model's ability to identify critical business threats. The use of an integrated decision tree architecture for collaborative computation and multi-round voting effectively reduces decision disagreements and improves the consistency of classification results. Finally, it generates confidence scores based on the output layer probability distribution, providing reliable quantitative evidence for alarm denoising, thereby efficiently screening real attack alarms and optimizing subsequent triage processes.

[0142] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An AI baseline-based network security alarm noise reduction and triage system, characterized in that: Comprising, The alarm collection module collects multi-source heterogeneous network security alarm data in real time, obtains original alarm logs, performs standardized analysis and feature extraction on the original alarm logs, and generates alarm feature vectors; The graph construction module dynamically constructs an asset knowledge graph, associates asset identifiers in the alarm feature vectors with graph nodes, and injects asset context attributes, asset business criticality weights, and historical threat records; The model training module starts a private scenario adaptive training mechanism, optimizes AI baseline model parameters based on the current environment's security event sample set using incremental learning algorithms; The intelligent noise reduction module inputs the alarm feature vectors into the optimized AI baseline model, performs collaborative reasoning combined with the asset context attributes of the asset knowledge graph, and outputs confidence score values of the noise reduction decision, as follows, Input the security event sample set into the graph neural network architecture to extract attack mode features, and adjust the feature correlation degree calculation parameters combined with the asset business criticality weights in the asset knowledge graph; Convert the false alarm rules in the historical disposition records into constraint conditions for the AI baseline model, and generate the AI baseline model through multiple rounds of iterative training; The triage decision module calculates the event priority score and generates a triage instruction set based on the confidence score value and the asset business criticality weight, as follows, Extract high-value attack classification results with confidence score values exceeding the preset minimum confidence threshold, superimpose the corresponding asset business criticality weights in the dynamic graph, query the current dynamically constructed asset knowledge graph using the target asset identifier, accurately match the asset nodes in the graph, if a match is found, the asset knowledge graph is updated with the latest node, and the corresponding asset business criticality weight value is directly extracted from the node attributes for subsequent weighted calculation; if no match is found, a default asset business criticality weight value is assigned, and a real-time asset discovery process is triggered to update the asset knowledge graph; Use the extracted asset business criticality weight value as a weighting factor, apply the preset weighting rules, and perform weighted calculation on the confidence score values of the filtered high-value attack identification alarm feature vector records to generate a weighted priority base value; Adjust the priority base according to the confidence score value, match the preset four-level triage confidence threshold set to generate emergency, high, medium, and low four-level triage labels, and output a triage instruction set carrying disposition suggestion codes and dynamic triage decision weight parameters; The linkage disposition module executes the preset disposition actions based on the triage instruction set and records the operation logs.

2. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The alarm feature vector refers to the field set output after protocol analysis of the original alarm log, which performs timestamp normalization, attack type encoding, and feature field vectorization conversion to generate a multi-dimensional structured vector containing protocol type, source Internet protocol address, destination Internet protocol address, port number, and payload features.

3. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: Dynamically construct the asset knowledge graph as follows, Extract asset Internet protocol addresses, open ports, and service type data from the configuration management database to generate initial nodes; Match the initial nodes with the asset identifiers in the alarm feature vectors, and inject operating system version and business system attribution attributes; The asset business criticality weight is associated with the asset based on the business system attribution, and the vulnerability utilization record of the corresponding asset in the historical threat intelligence library is fused to generate an asset knowledge graph with security context attributes.

4. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The asset context attributes refer to the collection of static features and real-time running states of the asset registered in the configuration management database; the asset business criticality weight refers to a numerical score calculated based on the ITIL service level agreement requirements; and the historical threat record refers to a vulnerability utilization event sequence stored in the SIEM system.

5. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The security event sample set refers to a training data set composed of alarm feature vectors and labeled data; The private scene adaptive training mechanism includes, loading a pre-trained AI baseline model and importing labeled data in the security event sample set, adjusting the feature weight distribution of the AI baseline model according to the asset environment context label in the labeled data; using an incremental learning algorithm to optimize the recognition parameters of the AI baseline model for the localized false alarm mode, and generating a lightweight AI baseline model parameter version adapted to the current environment traffic mode.

6. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The confidence score value of the output noise reduction decision is as follows, inputting the alarm feature vector into the AI baseline model, calling the asset business criticality weight in the asset knowledge graph as a feature enhancement factor; performing collaborative reasoning calculation based on an integrated decision tree to generate three classification results of false alarm judgment, low-value alarm filtering and high-value attack identification; calculating the confidence score value according to the probability distribution of the output layer of the AI baseline model.

7. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The preset disposal action refers to an operation sequence of Internet protocol address ban, vulnerability repair and access control policy update generated based on the disposal suggestion code in the triage instruction set.

8. The AI baseline based network security alert noise reduction and triage system of claim 1, wherein: The security orchestration tool executes the preset disposal action based on the triage instruction set and records the operation log, and the specific steps are as follows, analyzing the disposal suggestion code and dynamic triage decision weight parameters in the triage instruction set, and calling the asynchronous execution interface of the security orchestration tool according to the priority of the dynamic triage decision weight parameters; verifying the real-time accessibility state of the target asset in the dynamic graph, executing the preset disposal action and capturing the operation return code, and generating the operation log.

Images