Network security alarm method and device, electronic equipment and storage medium

Abstract

The invention provides a network security alarm method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining security logs, configuration information and asset importance levels of all security equipment in a network; performing association analysis on the configuration information, and determining attack surface data of each IP point in the network; performing noise reduction and correlation analysis on the security log to obtain processed log information, matching the processed log information with a preset feature library, and filtering alarms of normal service features and alarms of misreported attack features to obtain filtered alarm data; inputting the attack surface data, the asset importance level and the alarm data into a large language model to generate an alarm priority sequence; and executing an automatic response based on the alarm data, the alarm priority sequence and a configured response script. According to the invention, the problem of high false alarm rate of network security alarm in the prior art can be solved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a network security alarm method, device, electronic device, and storage medium. Background Technology

[0002] For existing SIEM (Security Information and Event Management) systems, such as network security situation awareness systems, security logs from security devices and systems within the network, including firewalls, intrusion detection systems, and WAFs (Web Application Firewalls), need to be centrally stored, comprehensively processed, and correlated to generate security event alerts. The core principle is to detect logs based on preset static rules (such as signature matching and threshold judgment). When log characteristics match the rules, an alert is triggered, and the logs are typically initially categorized according to simple fields (such as alert level).

[0003] Existing technologies suffer from a high false alarm rate: they rely too heavily on static rules and are difficult to adapt to complex and ever-changing network environments and business scenarios. For example, they may misjudge special character requests for normal business as attacks, resulting in a large number of invalid alarms. Summary of the Invention

[0004] In view of this, it is necessary to provide a network security alarm method, device, electronic device and storage medium to solve the technical problem of high false alarm rate of network security alarms in the prior art.

[0005] To address the aforementioned problems, in a first aspect, the present invention provides a network security alert method, comprising: Obtain security logs, configuration information, and asset importance levels of each security device within the network; The configuration information is analyzed to determine the attack surface data of each IP point in the network. The security logs are denoised and correlated to obtain processed log information. The processed log information is then matched with a preset feature library to filter out alarms with normal business characteristics and false alarms with attack characteristics, resulting in filtered alarm data. The attack surface data, the asset importance level, and the alarm data are input into a large language model to generate an alarm priority order. Based on the alarm data, the alarm priority order, and the configured response script, an automated response is executed.

[0006] In one possible implementation, the step of performing correlation analysis on the configuration information to determine the attack surface data of each IP point in the network includes: The configuration information is analyzed to determine the interface network segment of each IP point in the network; Based on the interface network segment, traverse all network security devices to construct a logical network topology based on security policies; Based on the logical network topology diagram, the attack surface data of each IP point in the network is determined.

[0007] In one possible implementation, the entire network of security devices is traversed based on the interface network segment to construct a logical network topology map based on security policies, including: If two IP addresses share the same network segment, determine that the security devices corresponding to the two IP addresses are directly connected. By traversing all directly connected security devices within the network and combining them with the aforementioned security policies, a logical network topology based on the security policies is constructed.

[0008] In one possible implementation, based on the logical network topology, the attack surface data of each IP point in the network is determined, including: Based on the logical network topology diagram, determine the logical connection relationships and access control relationships of network objects; Based on the logical connection relationship and access control relationship, the external access path of the network host is determined; Determine the security control nodes traversed by the externally exposed path, and determine the attack surface data of each IP point in the network based on the security control nodes; or, determine the attack range of each IP node based on the externally exposed path, and determine the attack surface data of each IP point in the network based on the attack range of each IP node. The attack range includes the attackable range and the range that can be attacked.

[0009] In one possible implementation, the security log is subjected to noise reduction and correlation analysis to obtain processed log information, including: The security logs are input into the trained Transformer model to obtain anomaly scores for the security logs; Filter security logs with anomaly scores below a preset threshold to obtain filtered security logs; Perform correlation analysis on the filtered security logs to obtain the processed log information; The Transformer model is trained based on historical normal logs and attack logs.

[0010] In one possible implementation, the filtered security logs are subjected to correlation analysis to obtain processed log information, including: The node similarity of the filtered security logs is calculated based on graph neural networks. The filtered security logs are merged and deduplicated based on the node similarity to obtain the processed log information.

[0011] In one possible implementation, the alarm priority order includes, in sequence: low priority alarms, medium priority alarms, and high priority alarms; Based on the alarm data, the alarm priority order, and the configured response script, execute an automated response, including: For low-priority alerts, based on the configuration of the response script, log and report generation operations are performed. Based on the configuration of the response script, prioritize the alarm and trigger the isolation of suspicious connections; Based on the configured response script, high-priority alerts are blocked from attack sources, and data backup operations are performed.

[0012] Secondly, the present invention also provides a network security alarm device, comprising: The data acquisition module is used to acquire security logs, configuration information, and asset importance levels of various security devices within the network; The first data analysis module is used to perform correlation analysis on the configuration information to determine the attack surface data of each IP point in the network; The second data analysis module is used to perform noise reduction and correlation analysis on the security logs to obtain processed log information, and to match the processed log information with a preset feature library to filter out alarms with normal business characteristics and false alarms with attack characteristics, thereby obtaining filtered alarm data. The alarm sorting module is used to input the attack surface data, the asset importance level and the alarm data into the large language model to generate an alarm priority order; An automatic response module is used to execute an automated response based on the alarm data, the alarm priority order, and the configured response script.

[0013] Thirdly, the present invention also provides an electronic device, including a memory and a processor, wherein, The memory is used to store programs; The processor, coupled to the memory, is configured to execute the program stored in the memory to implement the steps of the network security alert method as described in any of the preceding claims.

[0014] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the network security alert method as described in any of the preceding claims.

[0015] The beneficial effects of the above implementation are as follows: The network security alarm method, device, electronic device, and storage medium provided by this invention determine the attack surface data of each IP point in the network by performing correlation analysis on the configuration information of each security device in the network; perform noise reduction and correlation analysis on the security logs of each security device in the network to obtain alarm data; input the attack surface data, the asset importance level, and the alarm data into a large language model to generate an alarm priority order; and execute an automated response based on the alarm data, the alarm priority order, and the configured response script. This invention reduces reliance on static rules by performing correlation analysis on the configuration information and security logs of security devices, and combines an alarm filtering mechanism to filter out normal business feature alarms and false attack feature alarms in the processed log information through feature library matching. The filtered alarms are invalid alarms, thus retaining valid alarm data, reducing the false alarm rate, and prioritizing alarms to ensure that high-priority alarms are processed first, thereby improving the accuracy of identifying important alarms and solving the technical problem of high false alarm rate in existing network security alarms. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of an embodiment of the network security alert method provided by the present invention; Figure 2 A flowchart of another embodiment of the network security alert method provided by the present invention; Figure 3 A schematic block diagram of an embodiment of the network security alarm device provided by the present invention; Figure 4 A schematic diagram of an embodiment of the electronic device provided by the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0019] In the description of the embodiments of this application, unless otherwise stated, "a plurality of" means two or more.

[0020] In this embodiment of the invention, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, apparatus, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such process, method, product or device.

[0021] The naming or numbering of steps in the embodiments of the present invention does not mean that the steps in the method flow must be executed in the time / logical order indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effect can be achieved.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] This invention provides a network security alarm method, device, electronic device, and storage medium, which are described below.

[0024] This invention provides a network security alert method. This method can be implemented by executing an application on a network server or by executing an application on a network terminal, such as a gateway or other similar device. Figure 1 As shown, the method includes: S101. Obtain the security logs, configuration information, and asset importance levels of each security device within the network.

[0025] It's understandable that security devices can be firewalls, switching and routing devices, and configuration information can include routing information, interface information, ARP tables, security policies, etc. An ARP table is a cache table that stores the mapping relationship between IP addresses (Internet Protocol addresses) and MAC addresses (physical addresses), used to implement dynamic resolution of logical addresses to physical addresses in network communication. Assets can refer to valuable content stored in network devices, or they can be hardware devices themselves.

[0026] S102. Perform correlation analysis on the configuration information to determine the attack surface data of each IP point in the network.

[0027] Understandably, by performing correlation analysis on the configuration information, the attackable and vulnerable ranges of all IP addresses in the network can be determined, thus forming attack surface data.

[0028] S103. Perform noise reduction and correlation analysis on the security log to obtain processed log information, and match the processed log information with a preset feature library to filter out alarms with normal business characteristics and false alarms with attack characteristics, thereby obtaining filtered alarm data.

[0029] Understandably, noise reduction of security logs aims to filter out invalid logs and retain valid ones, while correlation analysis aims to deduplicat security logs. The security logs that have undergone noise reduction and correlation analysis are matched against a signature database, which includes a database containing attack signatures and a database containing normal business signatures. This yields preliminary alert data. This preliminary alert data is then filtered to obtain the final alert data. Alerts for normal business signatures are false alarms triggered by legitimate business characteristics, while false attack signature alerts are alerts generated due to incorrectly identified attack signatures.

[0030] S104. Input the attack surface data, the asset importance level, and the alarm data into the large language model to generate an alarm priority order.

[0031] Understandably, the large language model is a neural network model. Low-priority alerts can be issued when there are minor anomalies in non-core assets, medium-priority alerts can be issued when there are suspicious anomalies in core assets, and high-priority alerts can be issued when there is a clear attack on core assets.

[0032] S105. Based on the alarm data, the alarm priority order, and the configured response script, execute an automated response.

[0033] It is understood that this invention optimizes the processing method of network security alarms by integrating attack surface analysis, large language models, and Security Orchestration Automation and Response (SOAR) technologies. It is applicable to security information and event management (SIEM), such as security event alarm optimization scenarios in situational awareness systems. The aim is to reduce the false alarm rate, achieve effective deduplication and priority sorting of alarms, and realize automated alarm processing.

[0034] In some embodiments, the network security alert method provided by the present invention operates as follows: Data Acquisition Phase: Collect security logs, configuration information, and asset information from various security devices (firewalls, switches, routers, etc.) within the network. Configuration information includes routing information, interface information, ARP tables, security policies, etc.

[0035] Attack surface calculation phase: Based on the collected configuration information, correlation analysis is performed to dynamically calculate the attack surface (attack or attacked range) of each IP in the network, and the importance level of the assets is calculated at the same time.

[0036] Log preprocessing stage: The machine learning model, context awareness, logical reasoning and task planning capabilities in the big language model artificial intelligence technology are used to reduce noise and deduplication of logs. The logs of different devices are correlated and analyzed through graph neural networks to obtain alarm information.

[0037] Alarm filtering and priority ranking stage: The pre-processed alarm information is filtered based on known judgment methods. Then, based on factors such as attack surface range and asset importance, the alarms are filtered and prioritized using the contextual analysis and logical reasoning capabilities of the large language model. The priorities can be divided into high, medium and low.

[0038] Automated response phase: The SOAR system automatically responds to alarms of different priorities based on preset static scripts. It can also generate dynamic scripts by combining the reasoning capabilities of large language models to complete the automated response to alarms and feed the results back to the situational awareness system.

[0039] In some embodiments, the step of performing correlation analysis on the configuration information to determine the attack surface data of each IP point in the network includes: The configuration information is analyzed to determine the interface network segment of each IP point in the network; Based on the interface network segment, traverse all network security devices to construct a logical network topology based on security policies; Based on the logical network topology diagram, the attack surface data of each IP point in the network is determined.

[0040] Understandably, by reading the configuration information (routing information, interface information, ARP tables, security policies, etc.) of devices such as firewalls and routers, a policy-based logical network topology can be constructed. Through this network security infrastructure analysis and visualization, network administrators can clearly see the distribution of core business assets within the network, the logical connections and access control relationships between business systems and network objects, thereby determining the attack surface data for each IP point in the network.

[0041] In some embodiments, traversing all network security devices based on the interface network segment to construct a logical network topology based on security policies includes: If two IP addresses share the same network segment, determine that the security devices corresponding to the two IP addresses are directly connected. By traversing all directly connected security devices within the network and combining them with the aforementioned security policies, a logical network topology based on the security policies is constructed.

[0042] Understandably, by parsing the interface network segments of each node, if two nodes have interfaces on the same network segment, these two devices are directly connected through that network segment. This process is repeated across all devices in the network to obtain the network connection relationships of all devices. Combined with the allow / deny rules in the security policy, a policy-based logical network topology can be constructed.

[0043] In some embodiments, based on the logical network topology, determining the attack surface data of each IP point in the network includes: Based on the logical network topology diagram, determine the logical connection relationships and access control relationships of network objects; Based on the logical connection relationship and access control relationship, the external access path of the network host is determined; Determine the security control nodes traversed by the externally exposed path, and determine the attack surface data of each IP point in the network based on the security control nodes; or, determine the attack range of each IP node based on the externally exposed path, and determine the attack surface data of each IP point in the network based on the attack range of each IP node. The attack range includes the attackable range and the range that can be attacked.

[0044] Understandably, by analyzing the logical connection and access control relationships between the host business system and all network objects, the system's external access paths can be presented, showing which security control nodes each path passes through. The attack surface can also be calculated by determining the attackable or attack-initiated range of each IP node. The attack surface range is quantified into a value from 0 to 10, with larger values ​​indicating a larger range. Attack surface data is updated every 5 minutes and sent to the alarm priority ranking module.

[0045] In some embodiments, the security logs are subjected to noise reduction and correlation analysis to obtain processed log information, including: The security logs are input into the trained Transformer model to obtain anomaly scores for the security logs; Filter security logs with anomaly scores below a preset threshold to obtain filtered security logs; Perform correlation analysis on the filtered security logs to obtain the processed log information; The Transformer model is trained based on historical normal logs and attack logs.

[0046] Understandably, the Transformer model is a deep learning model based on a self-attention mechanism. The machine learning model based on the Transformer model is used to reduce noise in the logs. The model learns normal behavior patterns by training on a large number of historical normal logs and attack logs, and scores the input logs for anomalies. Logs with scores lower than a preset threshold (such as 0.3) are judged as invalid logs and filtered out.

[0047] In some embodiments, correlation analysis is performed on the filtered security logs to obtain processed log information, including: The node similarity of the filtered security logs is calculated based on graph neural networks. The filtered security logs are merged and deduplicated based on the node similarity to obtain the processed log information.

[0048] Understandably, a graph neural network is used to construct a log association graph, with fields such as IP, port, and time in the logs as node attributes. Duplicate or similar logs are identified through node similarity calculation, and then merged and deduplicated.

[0049] In some embodiments, the alarm priority order includes, in sequence: low priority alarms, medium priority alarms, and high priority alarms; Based on the alarm data, the alarm priority order, and the configured response script, execute an automated response, including: For low-priority alerts, based on the configuration of the response script, log and report generation operations are performed. Based on the configuration of the response script, prioritize the alarm and trigger the isolation of suspicious connections; Based on the configured response script, high-priority alerts are blocked from attack sources, and data backup operations are performed.

[0050] Understandably, the configured response scripts automatically log and generate reports for low-priority alerts (such as minor anomalies in non-core assets); automatically isolate suspicious connections and notify security analysts for medium-priority alerts (such as suspicious anomalies in core assets); and automatically initiate emergency response procedures, including blocking the attack source and backing up data, for high-priority alerts (such as explicit attacks on core assets). The relevant data results are then output to the situational awareness system's visualization interface.

[0051] In some embodiments, the network security alert method provided by the present invention refers to... Figure 2 , Figure 2 The modules are connected sequentially via a data transmission interface, and the specific implementation method is as follows: 1. Data Acquisition Module Deployment: Bypass deployment, without changing the original network structure, collects firewall access control policies, router routing table information, alarm logs of various security and network devices, and server system logs in real time. The collection frequency can be flexibly set according to the network scale and security objectives, such as once per minute. The data format is uniformly converted to JSON format and then sent to the attack surface calculation module.

[0052] 2. Attack Surface Calculation Module Implementation: By reading the configuration information (routing information, interface information, ARP table, security policies, etc.) of devices such as firewalls and routers, the module parses the interface network segments of each node. If two nodes have interfaces on the same network segment, these two devices are directly connected through that network segment. This process is repeated across all network devices to obtain the network connection relationships of all devices. Combined with the allow / deny rules in the security policies, a policy-based logical network topology map can be constructed. Through this network security infrastructure analysis and visualization, network administrators can clearly see the distribution of core business assets in the network, and the logical connections and access control relationships between business systems and network objects. By analyzing the logical connection relationships and access control relationships between host business systems and all network objects, the module presents the external access paths of host business systems and shows which security control nodes each path passes through. It can also calculate the attack surface by calculating the range within which each IP node can be attacked or launch an attack. The attack surface range is quantified into a value from 0 to 10, with a larger value indicating a larger range. The attack surface data is updated every 5 minutes and sent to the alarm priority sorting module.

[0053] 3. Implementation of the log preprocessing module: A machine learning model based on the Transformer model is used to denoise the logs. The model learns normal behavior patterns by training on a large number of historical normal logs and attack logs. It scores the input logs for anomalies and filters out logs with scores below a preset threshold (such as 0.3).

[0054] A log association graph is constructed using a graph neural network. Fields such as IP, port, and time in the logs are used as node attributes. Duplicate or similar logs are identified by calculating node similarity and then merged to remove duplicates.

[0055] The processed log data is sent to the SOAR module.

[0056] Alarm filtering unit: Pre-defined known attack signature database and normal business signature database. Pre-processed log data is matched against these databases to filter out alarms matching normal business characteristics and attack signature alarms that are clearly false alarms. The filtered alarm data is then sent to the alarm priority sorting module.

[0057] The alarm priority ranking module implements the following: It receives the attack surface quantification value from the attack surface calculation module and the filtered alarm data from the SOAR module. It uses a large language model (such as a model based on the DeepSeek architecture, fine-tuned with data from the cybersecurity field) to perform contextual correlation analysis. It calculates the alarm priority score by combining the attack surface quantification value (weight 60%), asset importance score (weight 30%), and attack type threat level (weight 10%). A score ≥8 is high priority, 5-7 is medium priority, and ≤4 is low priority. The ranking results are output to the SOAR module in real time.

[0058] 4. SOAR module implementation: Automated Response Unit: Configures response scripts to automatically log and generate reports for low-priority alarms (such as minor anomalies of non-core assets); automatically triggers isolation of suspicious connections and notifies security analysts for medium-priority alarms (such as suspicious anomalies of core assets); and automatically initiates emergency response procedures, including blocking the attack source and backing up data, for high-priority alarms (such as explicit attacks on core assets). Relevant data results are output to the situational awareness system's visualization interface.

[0059] The functions of each module in the above facts can be summarized as follows: Data acquisition module: responsible for collecting security logs, configuration information including security policies, and asset information, and transmitting the data to the attack surface calculation module and the log preprocessing module.

[0060] Attack surface calculation module: Receives security policies and other data from the data acquisition module, performs correlation analysis to calculate the attack surface, and transmits the results to the alarm priority sorting module.

[0061] Large-scale AI (Artificial Intelligence) Threat Detection Module: Receives security logs from the data acquisition module, uses machine learning models and graph neural networks for noise reduction, deduplication, and correlation analysis to complete log preprocessing and obtain alarm data.

[0062] Alarm Priority Sorting Module: Receives attack surface data from the attack surface calculation module and filtered alarm data from the large model AI threat detection module. Combines asset priority sorting and large language model analysis to form alarm handling suggestions, i.e. alarm priority order, and outputs the alarm priority order result. Transmits the processed data and handling suggestions to the SOAR module.

[0063] The SOAR Automated Response and Handling Module receives data and handling suggestions from the large-scale AI threat detection module, and executes automated responses based on the sorting results, combined with preset static scripts and AI-based dynamic scripts.

[0064] Compared with the prior art, the present invention has the following advantages: Significantly reduced false alarm rate: By using deep learning models and graph neural network correlation analysis based on large language model artificial intelligence technology, the reliance on static rules is reduced. Combined with the alarm filtering mechanism, invalid alarms are effectively identified and eliminated. The false alarm rate has been reduced by more than 60% in actual tests.

[0065] Achieve efficient deduplication: Machine learning-driven log clustering and noise reduction processing can accurately identify duplicate and similar alarms, reducing the daily alarm volume by more than 50%.

[0066] Precise priority ranking: Based on dynamic assessment of attack surface and asset importance, combined with contextual analysis of large language models, high-priority alarms are ensured to be processed first, and the accuracy of important alarm identification is improved to over 95%.

[0067] Improved processing efficiency: SOAR's script-driven response and integration with third-party tools significantly reduce manual intervention, increasing alarm processing speed by more than 70%, enabling the system to effectively handle massive alarms.

[0068] Highly adaptable: Through dynamic calculation of the attack surface and continuous optimization of machine learning models, it can adapt to constantly changing network environments and attack methods, and has good scalability and practicality.

[0069] like Figure 3 As shown, the present invention also provides a network security alarm device 300, comprising: The data acquisition module 301 is used to acquire the security logs, configuration information, and asset importance levels of each security device in the network; The first data analysis module 302 is used to perform correlation analysis on the configuration information to determine the attack surface data of each IP point in the network. The second data analysis module 303 is used to perform noise reduction and correlation analysis on the security logs to obtain processed log information, and to match the processed log information with a preset feature library to filter out alarms with normal business features and false alarms with attack features to obtain filtered alarm data. The alarm sorting module 304 is used to input the attack surface data, the asset importance level and the alarm data into the large language model to generate an alarm priority order; The automatic response module 305 is used to execute an automated response based on the alarm data, the alarm priority order, and the configured response script.

[0070] The network security alarm device provided in the above embodiments can implement the technical solutions described in the above network security alarm method embodiments. The specific implementation principles of each module or unit can be found in the corresponding content in the above network security alarm method embodiments, and will not be repeated here.

[0071] like Figure 4 As shown, the present invention also provides an electronic device 400. The electronic device 400 includes a processor 401, a memory 402, and a display 403. Figure 4 Only some components of the electronic device 400 are shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

[0072] In some embodiments, memory 402 may be an internal storage unit of electronic device 400, such as a hard disk or memory of electronic device 400. In other embodiments, memory 402 may also be an external storage device of electronic device 400, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on electronic device 400.

[0073] Furthermore, the memory 402 may include both internal storage units of the electronic device 400 and external storage devices. The memory 402 is used to store application software and various types of data installed on the electronic device 400.

[0074] In some embodiments, processor 401 may be a central processing unit (CPU), microprocessor, or other data processing chip, used to run program code stored in memory 402 or process data, such as the network security alarm method of the present invention.

[0075] In some embodiments, display 403 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. Display 403 is used to display information from electronic device 400 and to display a visual user interface. Components 401-403 of electronic device 400 communicate with each other via a system bus.

[0076] In some embodiments of the present invention, when the processor 401 executes the network security alert program in the memory 402, the following steps may be implemented: Obtain security logs, configuration information, and asset importance levels of each security device within the network; The configuration information is analyzed to determine the attack surface data of each IP point in the network. The security logs are denoised and correlated to obtain processed log information. The processed log information is then matched with a preset feature library to filter out alarms with normal business characteristics and false alarms with attack characteristics, resulting in filtered alarm data. The attack surface data, the asset importance level, and the alarm data are input into a large language model to generate an alarm priority order. Based on the alarm data, the alarm priority order, and the configured response script, an automated response is executed.

[0077] It should be understood that when the processor 401 executes the network security alarm program in the memory 402, in addition to the functions mentioned above, it can also perform other functions, as detailed in the description of the corresponding method embodiments above.

[0078] Furthermore, the embodiments of the present invention do not specifically limit the type of electronic device 400 mentioned. Electronic device 400 can be a mobile phone, tablet computer, personal digital assistant (PDA), wearable device, laptop computer, or other portable electronic device. Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices running iOS, Android, Microsoft, or other operating systems. The aforementioned portable electronic device can also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, electronic device 400 may not be a portable electronic device, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0079] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the network security alert methods provided by the above methods, the method comprising: Obtain security logs, configuration information, and asset importance levels of each security device within the network; The configuration information is analyzed to determine the attack surface data of each IP point in the network. The security logs are denoised and correlated to obtain processed log information. The processed log information is then matched with a preset feature library to filter out alarms with normal business characteristics and false alarms with attack characteristics, resulting in filtered alarm data. The attack surface data, the asset importance level, and the alarm data are input into a large language model to generate an alarm priority order. Based on the alarm data, the alarm priority order, and the configured response script, an automated response is executed.

[0080] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0081] The network security alarm method, device, electronic device, and storage medium provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A cyber-security alerting method, characterized by, include: Obtain security logs, configuration information, and asset importance levels of each security device within the network; The configuration information is analyzed to determine the attack surface data of each IP point in the network. The security logs are denoised and correlated to obtain processed log information. The processed log information is then matched with a preset feature library to filter out alarms with normal business characteristics and false alarms with attack characteristics, resulting in filtered alarm data. The attack surface data, the asset importance level, and the alarm data are input into a large language model to generate an alarm priority order. Based on the alarm data, the alarm priority order, and the configured response script, an automated response is executed.

2. The cyber-security alerting method of claim 1, wherein, The step of performing correlation analysis on the configuration information to determine the attack surface data of each IP point in the network includes: The configuration information is analyzed to determine the interface network segment of each IP point in the network; Based on the interface network segment, traverse all network security devices to construct a logical network topology based on security policies; Based on the logical network topology diagram, the attack surface data of each IP point in the network is determined.

3. The cyber-security alerting method of claim 2, wherein, Based on the aforementioned interface network segment, all security devices in the network are traversed to construct a logical network topology map based on security policies, including: If two IP addresses share the same network segment, determine that the security devices corresponding to the two IP addresses are directly connected. By traversing all directly connected security devices within the network and combining them with the aforementioned security policies, a logical network topology based on the security policies is constructed.

4. The cyber-security alerting method of claim 2, wherein, Based on the logical network topology, the attack surface data of each IP point in the network is determined, including: Based on the logical network topology diagram, determine the logical connection relationships and access control relationships of network objects; Based on the logical connection relationship and access control relationship, the external access path of the network host is determined; Determine the security control nodes traversed by the externally exposed path, and determine the attack surface data of each IP point in the network based on the security control nodes; or, determine the attack range of each IP node based on the externally exposed path, and determine the attack surface data of each IP point in the network based on the attack range of each IP node. The attack range includes the attackable range and the range that can be attacked.

5. The cyber-security alerting method of claim 1, wherein, The security logs are subjected to noise reduction and correlation analysis to obtain processed log information, including: The security logs are input into the trained Transformer model to obtain anomaly scores for the security logs; Filter security logs with anomaly scores below a preset threshold to obtain filtered security logs; Perform correlation analysis on the filtered security logs to obtain the processed log information; The Transformer model is trained based on historical normal logs and attack logs.

6. The cyber-security alerting method of claim 5, wherein, The filtered security logs are correlated to obtain the processed log information, including: The node similarity of the filtered security logs is calculated based on graph neural networks. The filtered security logs are merged and deduplicated based on the node similarity to obtain the processed log information.

7. The cyber-security alerting method of any of claims 1-6, wherein, The alarm priority order includes, in order: low priority alarms, medium priority alarms, and high priority alarms; Based on the alarm data, the alarm priority order, and the configured response script, execute an automated response, including: For low-priority alerts, based on the configuration of the response script, log and report generation operations are performed. Based on the configuration of the response script, prioritize the alarm and trigger the isolation of suspicious connections; Based on the configured response script, high-priority alerts are blocked from attack sources, and data backup operations are performed.

8. A network security alerting device characterized by, include: The data acquisition module is used to acquire security logs, configuration information, and asset importance levels of various security devices within the network; The first data analysis module is used to perform correlation analysis on the configuration information to determine the attack surface data of each IP point in the network; The second data analysis module is used to perform noise reduction and correlation analysis on the security logs to obtain processed log information, and to match the processed log information with a preset feature library to filter out alarms with normal business characteristics and false alarms with attack characteristics, thereby obtaining filtered alarm data. The alarm sorting module is used to input the attack surface data, the asset importance level and the alarm data into the large language model to generate an alarm priority order; An automatic response module is used to execute an automated response based on the alarm data, the alarm priority order, and the configured response script.

9. An electronic device, comprising: Including memory and processor, among which, The memory is used to store programs; The processor, coupled to the memory, is configured to execute the program stored in the memory to implement the steps of the network security alert method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the network security alert method as described in any one of claims 1 to 7.

Images