Alarm aggregation method and device, computer device and readable storage medium

Abstract

The application discloses an alarm aggregation method and device, computer equipment and a readable storage medium. The method comprises the following steps: acquiring a plurality of alarm data; calculating the attention weight of each text element in the text feature in alarm similarity determination; dividing core text elements and non-core text elements in each text element, and adjusting the attention weight of the core text elements according to a preset adjustment coefficient to obtain the adjusted attention weight; based on the adjusted attention weight and the attention weight of the non-core text elements, performing aggregation processing on the text elements of the alarm data to obtain a text semantic vector of the alarm data; performing fusion processing based on the text semantic vector, behavior features and asset features to obtain a fusion feature of the alarm data; and based on the fusion feature of each alarm data, performing aggregation processing on all the alarm data to obtain an aggregation result. The accuracy of alarm aggregation can be effectively improved.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to an alarm aggregation method, apparatus, and computer equipment. Background Technology

[0002] In existing network security protection systems, enterprises typically deploy security devices such as firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and web application firewalls (WAF) from different vendors. These devices continuously report security alerts during operation to reflect potential attacks, vulnerability exploits, or abnormal access. However, due to differences in the detection logic, alert formats, and naming conventions of each device, the same attack event is often reported multiple times by multiple devices in different formats, resulting in a large number of redundant alerts. This situation causes the number of alerts to balloon, requiring analysts to manually sift through thousands of alerts and aggregate similar alerts, which is not only inefficient but also prone to false positives or false negatives.

[0003] In existing technologies, rule-based alarm aggregation methods are commonly used to reduce the number of alarms. This involves setting matching conditions for fixed fields (such as source IP, target IP, attack type, etc.) to determine whether two alarms belong to the same event. This method is simple to implement but has obvious limitations: on the one hand, the naming or description of fields varies across different devices, making it difficult to unify the rules; on the other hand, when attack descriptions are synonymous or differ in expression, it is easy to fail to aggregate or aggregate incorrectly.

[0004] Therefore, how to provide an alarm aggregation method that can effectively improve the accuracy of alarm aggregation has become an urgent problem to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide an alarm aggregation method, apparatus, computer equipment, and readable storage medium to address the aforementioned technical problems and solve the problem of low accuracy in traditional alarm aggregation.

[0006] An alarm aggregation method, the method comprising:

[0007] Acquire multiple alarm data, which correspond to behavioral characteristics, asset characteristics, and text characteristics;

[0008] Calculate the attention weight of each text element in the text features in the alarm similarity determination;

[0009] Core text elements and non-core text elements are divided among the various text elements, and the attention weight of the core text elements is adjusted according to a preset adjustment coefficient to obtain the adjusted attention weight.

[0010] Based on the adjusted attention weights and the attention weights of the non-core text elements, the text elements of the alarm data are aggregated to obtain the text semantic vector of the alarm data.

[0011] The alarm data is obtained by fusing the text semantic vector, the behavioral features, and the asset features.

[0012] Based on the fusion characteristics of each alarm data, all the alarm data are aggregated to obtain an aggregation result.

[0013] Optionally, before acquiring multiple alarm data, the method further includes:

[0014] Multiple alarm messages are acquired, and each alarm message has a corresponding message format;

[0015] Based on the information format of each alarm message, determine the parsing rules for each alarm message;

[0016] The alarm information is parsed based on the parsing rules to obtain the initial alarm data;

[0017] The initial alarm data is processed by field mapping based on a preset mapping table to obtain the alarm data.

[0018] Based on the alarm data, feature extraction processing is performed to obtain the behavioral features, asset features, and text features of the alarm data.

[0019] Optionally, the feature extraction process based on the alarm data to obtain the behavioral features, asset features, and text features of the alarm data includes:

[0020] Based on preset mapping rules, the alarm data is subjected to structured feature extraction processing to obtain initial asset features and initial behavior features.

[0021] Based on the text content in the alarm data, extract initial text features;

[0022] The initial asset features, initial behavioral features, and initial text features are formatted to obtain the behavioral features, asset features, and text features.

[0023] Optionally, calculating the attention weight of each text element in the text features for alarm similarity determination includes:

[0024] Calculate the cosine similarity between every two of the text elements;

[0025] Max pooling is performed based on the cosine similarity to obtain at least one optimal matching pair, wherein the optimal matching pair includes two of the text elements.

[0026] Input all the optimal matching pairs into a preset recurrent neural network model to obtain the hidden state of each text element;

[0027] The attention weight of each text element is calculated based on the hidden state.

[0028] Optionally, the aggregation process for all the alarm data based on the fusion features of each alarm data to obtain the aggregation result includes:

[0029] Calculate the similarity between the fused features of any two of the alarm data;

[0030] Based on the similarity and the preset similarity threshold, it is determined whether the two alarm data are aggregable alarm data;

[0031] Among all the alarm data, the alarm data that is determined to be aggregable is merged to obtain the aggregation result.

[0032] Optionally, after aggregating all the alarm data based on the fusion features of each alarm data to obtain the aggregation result, the method further includes:

[0033] Obtain the evaluation results of the aggregation results;

[0034] Based on the evaluation results, the preset adjustment coefficient is optimized.

[0035] Optionally, optimizing the preset adjustment coefficient based on the evaluation result includes:

[0036] When the evaluation result indicates missed merging, the preset adjustment coefficient is increased;

[0037] When the evaluation result indicates an incorrect merging, the preset adjustment coefficient is reduced.

[0038] An alarm aggregation device, the device comprising:

[0039] The first acquisition module is used to acquire multiple alarm data, which correspond to behavioral features, asset features and text features;

[0040] The first calculation module is used to calculate the attention weight of each text element in the text features in the alarm similarity determination;

[0041] The first adjustment module is used to distinguish core text elements and non-core text elements among various text elements, and adjust the attention weight of the core text elements according to the preset adjustment coefficient to obtain the adjusted attention weight.

[0042] The first aggregation module is used to aggregate the text elements of the alarm data based on the adjusted attention weights and the attention weights of the non-core text elements to obtain the text semantic vector of the alarm data.

[0043] The first fusion module is used to perform fusion processing based on the text semantic vector, the behavioral features and the asset features to obtain the fusion features of the alarm data;

[0044] The second aggregation module is used to aggregate all the alarm data based on the fusion characteristics of each alarm data to obtain the aggregation result.

[0045] A computer device includes a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor implements the alarm aggregation method described above when executing the computer-readable instructions.

[0046] A readable storage medium having computer-readable instructions stored thereon, which, when executed by a processor, implement the above-described alarm aggregation method.

[0047] The above alarm aggregation method acquires multiple alarm data, which correspond to behavioral features, asset features, and text features; calculates the attention weight of each text element in the text features for alarm similarity determination; divides each text element into core text elements and non-core text elements, and adjusts the attention weight of the core text elements according to a preset adjustment coefficient to obtain the adjusted attention weight; based on the adjusted attention weight and the attention weight of the non-core text elements, aggregates the text elements of the alarm data to obtain the text semantic vector of the alarm data; performs fusion processing based on the text semantic vector, the behavioral features, and the asset features to obtain the fused features of the alarm data; and aggregates all the alarm data based on the fused features of each alarm data to obtain the aggregation result. Based on a comprehensive analysis of alarm data including behavioral, asset, and textual features, an attention weighting mechanism is used to identify the importance of different textual elements in the aggregation decision. By adjusting the weights of core textual elements, the aggregation strategy is adaptively optimized, thereby effectively improving the accuracy of similar alarm identification in multi-device and multi-format alarm environments, reducing false and missed aggregations, significantly improving the accuracy and reliability of alarm aggregation, and reducing the analysis burden on security operations personnel. Attached Figure Description

[0048] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart illustrating an alarm aggregation method in one embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram of the alarm aggregation device in one embodiment of the present invention;

[0051] Figure 3 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] In one embodiment, such as Figure 1 As shown, an alarm aggregation method is provided, including the following steps:

[0054] 101. Obtain multiple alarm data.

[0055] In this embodiment of the invention, raw alarm information can be received from security devices, log platforms, or security management systems from different manufacturers. This alarm data may be in various formats, such as JSON, Syslog, or CSV. Each alarm data entry contains several information fields that reflect the characteristics of an attack or abnormal behavior. To facilitate subsequent unified processing, this alarm data is parsed and its fields are aligned to ensure structural consistency across alarm data from different sources.

[0056] In alarm data, behavioral features can be used to describe the dynamic attributes of attack behavior, such as the attack source IP address, attack port, attack type, attack time, and attack frequency, to reflect the attacker's behavioral characteristics; asset features are used to represent the static attributes of the attacked object, such as the asset's public IP address, internal IP address, asset type, business system to which it belongs, and operating system version; text features mainly include event name, attack description, payload, threat type, impact, and handling suggestions, etc. This information is mostly unstructured natural language description, used to reflect the semantic content of the alarm.

[0057] For example, in a web application attack scenario, different devices might report different alerts with descriptions such as "SQL injection attack," "suspected database injection," and "database statement anomaly." In this case, behavioral characteristics could record the attack source IP as 192.168.10.12 and the target port as 80; asset characteristics could record the attacked asset ID as server-001 and the operating system as Linux; while text characteristics would include the event name "Web application SQL injection attack" and the payload content "unionselect user()." By uniformly acquiring and organizing these multi-dimensional characteristics, complete and standardized input data can be provided for subsequent aggregation calculations.

[0058] 102. Calculate the attention weight of each text element in the text features in the alarm similarity determination.

[0059] In this embodiment of the invention, after obtaining the text features of each alarm data, fine-grained analysis can be performed on each text element in the text features to identify the importance of different elements in alarm similarity determination.

[0060] Specifically, text features often include various semantic elements such as event name, threat type, event description, payload content, impact, and remediation recommendations. Different elements contribute differently to the semantic similarity between alerts. For example, the event name and payload often directly reflect the essence of the attack type, while remediation recommendations reflect more security operations measures and have a weaker semantic connection to the attack itself.

[0061] Therefore, attention weights for each text element can be calculated based on a semantic model to quantify the contribution of each element in similarity determination. The specific steps are as follows: First, each text element is encoded as a semantic vector; then, the cosine similarity between any two text elements is calculated to measure their semantic similarity; next, max pooling is used to extract the optimal matching pair, reflecting the most representative semantic association between alerts; finally, the optimal matching vector is input into a recurrent neural network (e.g., a GRU model) to obtain the hidden state of each element, and its attention score is calculated accordingly. A higher attention score indicates greater importance of the element in similarity alert determination.

[0062] For example, if two alerts both contain "SQL injection" in their event names, but one payload is "unionselect user()" and the other is "or 1=1", the model will determine that the payload and the event name have a high degree of semantic consistency, and the corresponding attention weight will be assigned a higher value. For text like "handling suggestions," because it has a lower correlation with the attack type, it can be automatically assigned a lower weight.

[0063] Through a dynamic weight allocation mechanism, key semantic elements can be automatically identified, avoiding the problems of false or missed clustering in traditional fixed keyword matching, thereby significantly improving the accuracy of alarm similarity determination.

[0064] 103. Divide the text elements into core text elements and non-core text elements, and adjust the attention weight of the core text elements according to the preset adjustment coefficient to obtain the adjusted attention weight.

[0065] In this embodiment of the invention, after obtaining the initial attention weights of each text element, the text elements can be divided into core text elements and non-core text elements based on a preset element classification rule. Core text elements are used to represent key clues of attack semantics, and typically include, but are not limited to, event names, payloads, and threat types; non-core text elements are used to supplement context and handling information, and typically include event descriptions, harm impacts, and handling suggestions.

[0066] The segmentation can be accomplished through static configuration or by maintaining categories based on historical aggregation performance. A simple implementation is to mark the event name, payload, and threat type as the core set, while other text elements are designated as non-core elements by default. After segmentation, the attention weights of the core text elements are amplified or reduced according to preset adjustment coefficients to obtain adjusted attention weights; non-core text elements are not amplified and their initial attention weights remain unchanged.

[0067] To avoid weight imbalances caused by abnormally high weights for individual core elements, the adjustment process can limit the maximum and minimum amplification values ​​(e.g., setting upper and lower bounds), and perform a normalization after all element weights have been adjusted to keep the total weight stable, facilitating subsequent weighted aggregation calculations. In the case of missing elements, such as an alarm lacking a payload, only the actual core elements are adjusted in weight; missing elements are not included in the calculation, thus ensuring the executability and robustness of the weighting process.

[0068] For example, if the first alert's text elements include the event name "Web Application SQL Injection Attack," the payload "union select 1,user()," the threat type "SQL Injection Attack," and the event description "A request was made to / web / login.php," while the second alert includes the event name "Suspected Database Injection," the payload "or 1=1," the threat type "SQL Injection," and the event description "Abnormal access occurred on target port 80," then after the initial attention calculation, the system classifies the event name, payload, and threat type as core text elements, and the event description as a non-core text element. Subsequently, the attention weight of the core text elements is amplified according to a preset adjustment coefficient, for example, the weight of the event name and payload is appropriately increased, while the weight of the event description remains unchanged. Through this processing, the similarity of the "event name" and "payload" between the two alerts will contribute more to the final similarity score, and the differences in the event descriptions will not excessively affect the aggregation judgment, thus making the aggregation result more focused on the key semantic signals that can identify "similar attacks."

[0069] It is understandable that the information modules in the alarm text features have varying degrees of importance. To amplify the weight of key information modules, semantic relevance constraints are added. A relevance coefficient for the core information module (i.e., the preset adjustment coefficient mentioned above) can be defined:

[0070] in Representative query alarm With candidate alerts Similarity of the same core information modules (i.e. core text elements) in the data, where query alarms and candidate alarms can be any two alarm data; It is a series of weighting coefficients (i.e., adjustment coefficients corresponding to each core text element) that can adjust the relevance of different information modules. For example, let... This will improve The weight of the information module represented.

[0071] By introducing a relevance coefficient, the attention weights of the core information modules are adjusted:

[0072]

[0073] in It is the balance coefficient. Example: Let... , This is the core module. If... This indicates that the core modules are highly similar. Its weight will increase significantly.

[0074] 104. Based on the adjusted attention weights and the attention weights of non-core text elements, the text elements of the alarm data are aggregated to obtain the text semantic vector of the alarm data.

[0075] In this embodiment of the invention, a weighted aggregation can be performed on all text elements of each alarm to form a unified semantic representation of the alarm. Specifically, after adjusting the weights of core and non-core elements, the adjusted weights of the core elements and the original weights of the non-core elements are included in the same normalization process, making the sum of the weights of all elements equal to 1. Then, the corresponding text elements are weighted and summed according to their weights to obtain the text semantic vector of the alarm. This aggregation is a representation generation process within a single alarm; non-core elements are not excluded but participate in the aggregation with lower weights to retain contextual information that helps distinguish scenarios. When an element is missing, the weights are re-normalized according to the actual elements present, and the aggregation is completed, thereby ensuring numerical stability and process robustness.

[0076] For example, the text elements of an alert include "Event Name," "Payload," "Threat Type," and "Event Description," with initial attention weights of 0.35, 0.30, 0.15, and 0.20, respectively. After amplifying the core elements (Event Name, Payload, Threat Type) according to preset adjustment coefficients, temporary weights of 0.42, 0.39, 0.18, and 0.20 are obtained. To ensure comparability, the four weights are normalized (the sum is approximately 1.19), resulting in final weights of approximately 0.35, 0.33, 0.15, and 0.17. Subsequently, the semantic expression of each element is weighted and summed using the above weights to obtain the text semantic vector of the alert.

[0077] 105. Based on the text semantic vector, behavioral features and asset features, the fusion processing is performed to obtain the fused features of the alarm data.

[0078] In this embodiment of the invention, after obtaining the text semantic vector of each alarm, the vector can be fused with the corresponding behavioral features and asset features to construct a fused feature that comprehensively reflects the alarm semantics, attack behavior, and target asset characteristics. This fusion process takes into account both the stability of structured features and the semantic expressive power of text features.

[0079] Specifically, behavioral characteristics can include the attack source IP, destination IP, port number, attack time, number of attacks, and duration, while asset characteristics can include asset ID, asset type, operating system version, and internal / public network address. These structured characteristics are typically represented numerically or through enumeration encoding, such as converting IPv4 addresses to 32-bit integers, mapping ports to service categories, and mapping asset types to discrete numbers, thus facilitating vectorized calculations.

[0080] During the fusion process, the dimensions of various features can be unified first through feature standardization, and then fusion can be carried out by feature splicing or multi-layer neural network mapping.

[0081] Specifically, one possible implementation is to concatenate the text semantic vector and the structured feature vector dimensionally and input them into a fully connected network. A nonlinear transformation is then used to obtain fused features, thereby achieving cross-modal information interaction and weight adaptation within the feature space. These fused features can be viewed as a holistic encoding of alarm semantics, behavioral patterns, and target attributes, providing a unified metric space for subsequent similarity calculations.

[0082] For example, in a typical intrusion detection scenario, the attack source IP is "123.123.123.123", the target asset type is "Web server", and the event text semantics contain the phrase "SQL injection". The system will input the text semantic vector along with behavioral and asset characteristics such as "attack source IP numerical encoding", "asset type = 2 (Web server)", and "attack port = 80 (HTTP service)" into the fusion model, and output the fused feature vector of the alarm.

[0083] In this way, the fused features can simultaneously reflect semantic and structural information, making similar attacks more similar in multidimensional space, while irrelevant alarms are effectively distinguished.

[0084] 106. Based on the fusion characteristics of each alarm data, aggregate all alarm data to obtain the aggregate result.

[0085] In this embodiment of the invention, after generating the fusion features of each alarm data, similarity calculation and aggregation processing can be performed on the fusion features of all alarm data to identify alarm sets belonging to the same attack event.

[0086] Specifically, firstly, for each pair of alerts, the similarity between their fused features is calculated. The similarity can be measured by cosine similarity, Euclidean distance, or weighted similarity, which measures the overall similarity between the two alerts at the semantic, behavioral, and asset levels.

[0087] Subsequently, the calculated similarity is compared with a preset similarity threshold. When the similarity is higher than the threshold, the two alarms are determined to belong to the same type of event, which is an alarm that can be aggregated; if it is lower than the threshold, the two are considered to be unrelated.

[0088] After all alarm pairs have been compared, aggregable alarms can be merged to generate an aggregated result. This merging process can be implemented in various ways, such as using clustering algorithms (e.g., hierarchical clustering, density clustering, or graph-based connectivity aggregation) to group highly similar alarms into the same category and calculate representative characteristics of that category, such as average attack time, primary attack source IP, and cumulative attack count. For multiple aggregated alarms, a unified alarm summary can be output to reduce the number of alarms and highlight critical security events.

[0089] By using the above methods, duplicate and semantically overlapping alarms can be effectively eliminated from alarm data of multiple vendors and multiple types of devices, significantly reducing the analysis burden caused by alarm storms.

[0090] For example, if three alerts from different security devices are described as "Web application SQL injection attack", "suspected database injection behavior" and "detected abnormal access to SQL statements targeting the web server", and the similarity calculation results between their fusion features all exceed the preset threshold of 0.85, then these three alerts can be automatically determined to belong to the same event and merged into a single aggregate alert "Web application SQL injection attack event". The unified result summarizes the attack source, target IP and time interval information, achieving semantic-level aggregation across devices.

[0091] In this embodiment of the invention, multiple alarm data are acquired, and the alarm data corresponds to behavioral features, asset features, and text features; the attention weight of each text element in the text features is calculated in alarm similarity determination; core text elements and non-core text elements are divided into each text element, and the attention weight of the core text elements is adjusted according to a preset adjustment coefficient to obtain the adjusted attention weight; based on the adjusted attention weight and the attention weight of the non-core text elements, the text elements of the alarm data are aggregated to obtain the text semantic vector of the alarm data; based on the text semantic vector, the behavioral features, and the asset features, a fusion process is performed to obtain the fusion feature of the alarm data; based on the fusion feature of each alarm data, all the alarm data are aggregated to obtain the aggregation result. Based on a comprehensive analysis of alarm data including behavioral, asset, and textual features, an attention weighting mechanism is used to identify the importance of different textual elements in the aggregation decision. By adjusting the weights of core textual elements, the aggregation strategy is adaptively optimized, thereby effectively improving the accuracy of similar alarm identification in multi-device and multi-format alarm environments, reducing false and missed aggregations, significantly improving the accuracy and reliability of alarm aggregation, and reducing the analysis burden on security operations personnel.

[0092] It is understood that in the specific implementation of this application, data related to alarm data, behavioral characteristics, asset characteristics, text characteristics, alarm information, etc. are involved. When the embodiments in this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0093] Optionally, before acquiring multiple alarm data, multiple alarm messages can be acquired, each with a corresponding information format; based on the information format of each alarm message, a parsing rule for each alarm message is determined; the corresponding alarm message is parsed based on the parsing rule to obtain initial alarm data; the initial alarm data is mapped to fields based on a preset mapping table to obtain alarm data; and feature extraction is performed on the alarm data to obtain the behavioral features, asset features, and text features of the alarm data.

[0094] In this embodiment of the invention, multiple original alarm messages can be received first. Each message has its own information format identifier or its specific format type can be identified by heuristic rules, such as JSON, Syslog, or CSV separated by commas / tabs.

[0095] For each alarm message, the corresponding parsing rules are determined based on the identified format: for JSON, key-value parsing is used directly; for Syslog, the timestamp, source / destination address, and event text are extracted using regular expression templates; for CSV, delimiters and column header mappings are used to locate fields.

[0096] After parsing, the initial alarm data is obtained, but the field names of different vendors are inconsistent. Therefore, the system performs field mapping according to the preset mapping table, unifying synonymous fields such as "src-ip / SourceIP / sourceAddress" into "attack source IP", unifying "dst-ip / TargetIP" into "target IP", and unifying "eventName / attackType" into "event name", thereby obtaining alarm data with a consistent structure.

[0097] The alarm data is then processed for feature extraction: behavioral and asset features are extracted and constructed from fixed fields (such as converting IPv4 addresses to integers, mapping ports to service categories, and enumerating asset types). Text features (such as event names, payloads, threat types, and event descriptions) are extracted from the text content. Formatting and cleaning are performed when necessary to remove irrelevant tags and abnormal lengths.

[0098] Through this preprocessing and feature extraction process, alarm data from different devices and manufacturers are standardized into three comparable feature classes, providing consistent and reliable input for subsequent attention weight calculation, text semantic aggregation, and cross-alarm similarity determination.

[0099] Optionally, in the step of performing feature extraction processing based on alarm data to obtain behavioral features, asset features, and text features of alarm data, the alarm data can also be processed by performing structured feature extraction processing based on preset mapping rules to obtain initial asset features and initial behavioral features; initial text features can be extracted based on the text content in the alarm data; and formatting processing can be performed based on the initial asset features, initial behavioral features, and initial text features to obtain behavioral features, asset features, and text features.

[0100] In this embodiment of the invention, alarm data can be extracted in a structured manner according to preset mapping rules, and the field names and values ​​of different vendors can be identified and unified. "src-ip / SourceIP" and other such fields can be mapped to attack IPs, and "dst-ip / TargetIP" and other such fields can be mapped to target IPs. At the same time, port, time, number of times, duration, asset ID, public / internal network address, asset type, operating system, etc. can be extracted to form initial behavioral features and initial asset features.

[0101] Subsequently, initial text features are extracted from the text content, including event name, payload, threat type, event description, impact and handling recommendations.

[0102] Based on this, the above-mentioned "initial asset characteristics, initial behavioral characteristics, and initial text characteristics" are formatted: the structured side is handed over to a pre-trained language model that has been fine-tuned by historical experts to uniformly encode and standardize the units (such as IPv4 numericalization and supplementing public / internal network markings, enumerating ports by service category, mapping asset type and operating system to discrete encoding, and unifying time to the same time zone and format).

[0103] The text is first cleaned (log prefixes and escape sequences are removed, payload comments are removed, and long texts are truncated to retain core segments), and then handed over to a pre-trained language model that has been fine-tuned based on historical samples for element-level semantic encoding, outputting stable text features.

[0104] More specifically, for text features, the information modules (such as event name, threat type, payload, event description, etc.) are first combined, and the query alarms to be compared and the candidate alarms are represented as information module sets A and B, respectively. Each m represents a specific information module (i.e., a text element in the text feature), such as the event name.

[0105]

[0106] The elements from these two sets are then fed into a domain-tuned pre-trained model (preferably using the BERT model or its lightweight variant), where each information module is encoded pairwise, and a semantic vector (i.e., text features) is output. :

[0107]

[0108] in, This indicates the i-th information module in the query alarm. With the j-th information module in the candidate alarm The jointly generated semantic vector (i.e., text features) is used to measure the semantic relationship between the two. [CLS]: This is the BERT model's classification token, located at the beginning of the input sequence, used to aggregate the semantic information of the entire sequence. The final [CLS] vector output by the model represents the comprehensive semantic features of the input segment. [SEP]: This is the separator token, used to distinguish different input segments. In this scenario, the first [SEP] distinguishes between the query module and the candidate module, and the second [SEP] marks the end of the input.

[0109] For structured features (such as initial behavioral features and initial asset features), they are transformed into computable structured vectors (i.e., behavioral features and asset features) through a pre-trained model:

[0110]

[0111] in Represents a specific feature vector. It is the number of structured features, for example This represents the attacking IP address.

[0112] Optionally, in the step of calculating the attention weight of each text element in the alarm similarity determination, the cosine similarity of each pair of text elements can also be calculated; based on the cosine similarity, max pooling is performed to obtain at least one optimal matching pair, which includes two text elements; all optimal matching pairs are input into a preset recurrent neural network model to obtain the hidden state of each text element; and the attention weight of each text element is calculated based on the hidden state.

[0113] In this embodiment of the invention, in order to identify the importance of different text elements in alarm similarity determination, the correlation between text elements can be measured by calculating semantic similarity.

[0114] Specifically, for the semantic vector between any two text elements Cosine similarity is used to calculate similarity, as shown in the following formula:

[0115]

[0116] in, This represents the similarity between the i-th query text element and the j-th candidate text element, with a value range of [-1, 1]. The higher the similarity, the stronger the correlation between the two in the semantic space.

[0117] Next, the optimal match is selected from multiple similarity results using a max-pooling operation, as shown in the following formula:

[0118]

[0119] in, represents the feature value that best matches the i-th text element, and N is the total number of candidate elements.

[0120] Then, all N optimal matching vectors are input into a recurrent neural network (RNN) model (e.g., a gated recurrent unit GRU) to capture sequence context dependencies, as shown in the following formula:

[0121]

[0122] in, This represents the sequence of hidden states output by the model, each... It contains contextual feature information of the corresponding text elements.

[0123] Finally, attention weights for each text element are calculated based on the hidden state to distinguish the contribution of different elements to the overall semantic aggregation, as shown in the following formula:

[0124]

[0125] in, This represents the attention weight of the i-th text element. This is a learnable context vector. The larger the weight value, the more significant the contribution of the text element to semantic judgment.

[0126] Through the above attention calculation process, it is possible to automatically focus on key text elements (such as "SQL injection" and "Payload"), thereby improving the accuracy and robustness of alarm similarity determination.

[0127] Optionally, in the step of aggregating all alarm data based on the fusion features of each alarm data to obtain the aggregation result, the similarity between the fusion features of any two alarm data can also be calculated; based on the similarity and a preset similarity threshold, it can be determined whether two alarm data are aggregable alarm data; among all alarm data, the alarm data determined to be aggregable are merged to obtain the aggregation result.

[0128] In this embodiment of the invention, in order to further improve the accuracy and reliability of alarm aggregation, a similarity score can be calculated based on the fusion features of each alarm data to determine whether different alarms belong to the same attack event.

[0129] Specifically, firstly, based on the attention weights after bias processing, the text feature semantic vector of query alert A is aggregated, as shown in the following formula:

[0130]

[0131] in, This represents the text semantic vector of query alert A. These are the attention weights after bias correction. This represents the corresponding hidden state vector. Through this weighted summation process, a global semantic representation that comprehensively considers the weights of different elements can be obtained.

[0132] Similarly, the text semantic vector of candidate alarm B can be obtained.

[0133] Subsequently, the text semantic vector and structured feature vectors (such as behavioral features and asset features) are fused to construct a comprehensive feature representation, as shown in the following formula:

[0134]

[0135] in, These represent the structured feature vectors of alarm A and alarm B, respectively, including information such as the attacking IP, target IP, and asset type. The fused feature vectors simultaneously reflect the semantic relevance and behavioral consistency of the alarms.

[0136] Finally, the similarity score between the two alarm fusion features is calculated as shown in the following formula:

[0137]

[0138] in, This represents the semantic similarity between alarm A and alarm B, and the cosine similarity measures how close they are in the high-dimensional semantic space.

[0139] Then set the threshold ,when: If so, it is judged as a similar alarm and aggregated.

[0140] Optionally, after the step of aggregating all alarm data based on the fusion characteristics of each alarm data to obtain the aggregation result, an evaluation result of the aggregation result can also be obtained; based on the evaluation result, the preset adjustment coefficient can be optimized.

[0141] In this embodiment of the invention, after the aggregation of all alarm data is completed and the aggregation result is output, the quality of the aggregation result can be evaluated, and the weight adjustment coefficient of the core text elements can be optimized accordingly.

[0142] The evaluation results can come from two sources: one is the labeling of the correctness of the aggregation by manual judgment / expert review, forming feedback of "correct aggregation / incorrect merging / missed merging"; the other is to statistically analyze the historical aggregation results by time window to obtain indicators such as incorrect merging rate, missed merging rate, accuracy rate or F1 score.

[0143] Using the evaluation results as feedback signals, bounded updates are performed on the weight adjustment coefficients for core text elements: when the false merging rate is too high, the adjustment coefficients of relevant elements are reduced or the similarity threshold is appropriately increased; when the false merging rate is too high, the adjustment coefficients of core elements more relevant to the scenario (such as event name, payload, threat type) are appropriately increased; to avoid parameter oscillations, the update magnitude is controlled by the learning rate and upper and lower bounds are set. If necessary, the adjustment coefficients are maintained separately according to alarm type or asset type to make the optimization scenario-adaptive.

[0144] For example, within a certain time window, the aggregation of "SQL injection" scenarios showed an increase in missed merges. Expert review showed that this was mainly due to insufficient text similarity caused by low weight of Payload elements. Accordingly, the adjustment coefficient corresponding to Payload was increased by a small step while keeping it below the preset upper limit. In subsequent windows, the new parameters will be used for the calculation of attention weights and aggregation judgment, thereby gradually reducing the missed merge rate of this scenario and steadily improving the overall aggregation accuracy.

[0145] Optionally, in the step of optimizing the preset adjustment coefficient based on the evaluation results, the preset adjustment coefficient can be increased when the evaluation result is a missed merge, and decreased when the evaluation result is an incorrect merge.

[0146] In this embodiment of the invention, the above evaluation result can be represented by R:

[0147] like This indicates a missed merge; in this case, the relevance weighting coefficient of the core module is increased. ,in For learning rate, is the gradient of the weights.

[0148] like This indicates an error merging process, in which case the relevance weighting coefficient of the core module is reduced. .

[0149] like This indicates a successful merger.

[0150] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0151] In one embodiment, an alarm aggregation device is provided, which corresponds one-to-one with the alarm aggregation methods described in the above embodiments. For example... Figure 2As shown, the alarm aggregation device includes a first acquisition module 201, a first calculation module 202, a first adjustment module 203, a first aggregation module 204, a first fusion module 205, and a second aggregation module 206. Detailed descriptions of each functional module are as follows:

[0152] The first acquisition module 201 is used to acquire multiple alarm data, the alarm data corresponding to behavioral features, asset features and text features;

[0153] The first calculation module 202 is used to calculate the attention weight of each text element in the text features in the alarm similarity determination;

[0154] The first adjustment module 203 is used to divide the core text elements and non-core text elements among the various text elements, and adjust the attention weight of the core text elements according to the preset adjustment coefficient to obtain the adjusted attention weight.

[0155] The first aggregation module 204 is used to aggregate the text elements of the alarm data based on the adjusted attention weights and the attention weights of the non-core text elements to obtain the text semantic vector of the alarm data.

[0156] The first fusion module 205 is used to perform fusion processing based on the text semantic vector, the behavioral features and the asset features to obtain the fusion features of the alarm data;

[0157] The second aggregation module 206 is used to aggregate all the alarm data based on the fusion characteristics of each alarm data to obtain an aggregation result.

[0158] Optionally, the device further includes:

[0159] The second acquisition module is used to acquire multiple alarm messages, and the alarm messages correspond to a message format;

[0160] The first determining module is used to determine the parsing rules for each alarm message based on the information format of each alarm message;

[0161] The first parsing module is used to parse the corresponding alarm information based on the parsing rules to obtain initial alarm data;

[0162] The first mapping module is used to perform field mapping processing on the initial alarm data based on a preset mapping table to obtain the alarm data;

[0163] The first extraction module is used to perform feature extraction processing based on the alarm data to obtain the behavioral features, asset features and text features of the alarm data.

[0164] Optionally, the first extraction module is further configured to:

[0165] Based on preset mapping rules, the alarm data is subjected to structured feature extraction processing to obtain initial asset features and initial behavior features.

[0166] Based on the text content in the alarm data, extract initial text features;

[0167] The initial asset features, initial behavioral features, and initial text features are formatted to obtain the behavioral features, asset features, and text features.

[0168] Optionally, the first computing module 202 is further configured to:

[0169] Calculate the cosine similarity between every two of the text elements;

[0170] Max pooling is performed based on the cosine similarity to obtain at least one optimal matching pair, wherein the optimal matching pair includes two of the text elements.

[0171] Input all the optimal matching pairs into a preset recurrent neural network model to obtain the hidden state of each text element;

[0172] The attention weight of each text element is calculated based on the hidden state.

[0173] Optionally, the first aggregation module 204 is further configured to:

[0174] Calculate the similarity between the fused features of any two of the alarm data;

[0175] Based on the similarity and the preset similarity threshold, it is determined whether the two alarm data are aggregable alarm data;

[0176] Among all the alarm data, the alarm data that is determined to be aggregable is merged to obtain the aggregation result.

[0177] Optionally, the device further includes:

[0178] The third acquisition module is used to acquire the evaluation results of the aggregation results;

[0179] The first optimization module is used to optimize the preset adjustment coefficient based on the evaluation results.

[0180] Optionally, the first optimization module is further configured to:

[0181] When the evaluation result indicates missed merging, the preset adjustment coefficient is increased;

[0182] When the evaluation result indicates an incorrect merging, the preset adjustment coefficient is reduced.

[0183] Specific limitations regarding the alarm aggregation device can be found in the limitations of the alarm aggregation method described above, and will not be repeated here. Each module in the aforementioned alarm aggregation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0184] In one embodiment, a computer device is provided, which may be a terminal device, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a readable storage medium storing computer-readable instructions. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer-readable instructions implement an alarm aggregation method. The readable storage medium provided in this embodiment includes both non-volatile and volatile readable storage media.

[0185] In this application embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, it implements the steps of the alarm aggregation method described above.

[0186] In one embodiment of the application, a readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, they implement the steps of the alarm aggregation method described above.

[0187] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0188] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0189] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An alarm aggregation method, characterized in that, The method includes: Multiple alarm data points are acquired. These alarm data points correspond to behavioral characteristics, asset characteristics, and text characteristics. Behavioral characteristics describe the dynamic attributes of the attack behavior, including the attack source IP address, attack port, attack type, attack time, and attack frequency, reflecting the attacker's behavioral characteristics. Asset characteristics represent the static attributes of the attacked object, including the asset's public IP address, internal IP address, asset type, affiliated business system, and operating system version. Text characteristics include the event name, attack description, payload, threat type, impact, and handling suggestions. These are unstructured natural language descriptions used to reflect the semantic content of the alarm. Calculate the attention weight of each text element in the text features in the alarm similarity determination; Core text elements and non-core text elements are identified among the various text elements. The attention weight of the core text elements is then adjusted according to a preset adjustment coefficient to obtain the adjusted attention weight. The segmentation is completed through static configuration or maintained by category based on historical aggregation performance. Event name, payload, and threat type are marked as core set, while other text elements are non-core set by default. After the segmentation is completed, the attention weight of core text elements is amplified or reduced according to the preset adjustment coefficient to obtain the adjusted attention weight. Non-core text elements are not amplified and their initial attention weight remains unchanged. The adjustment process limits the maximum and minimum amplification amounts and performs a normalization after all element weights are corrected to keep the total weight stable, which facilitates subsequent weighted aggregation calculations. In the case of missing elements, only the actual core elements are adjusted, and the missing elements are not included in the calculation, thereby ensuring the executability and robustness of the weighting process. Based on the adjusted attention weights and the attention weights of the non-core text elements, the text elements of the alarm data are aggregated to obtain the text semantic vector of the alarm data. The alarm data is obtained by fusing the text semantic vector, the behavioral features, and the asset features. Based on the fusion characteristics of each alarm data, all the alarm data are aggregated to obtain an aggregation result; After aggregating all the alarm data based on the fusion features of each alarm data to obtain the aggregation result, the method further includes: The evaluation results of the aggregation results are obtained from two sources: one is the labeling of the correctness of the aggregation by manual judgment or expert review, forming feedback on correct aggregation, incorrect merging or missed merging; the other is to statistically analyze the historical aggregation results by time window to obtain the incorrect merging rate, missed merging rate, accuracy rate or F1 score. Based on the evaluation results, the preset adjustment coefficients are optimized. Using the evaluation results as feedback signals, bounded updates are performed on the weight adjustment coefficients for core text elements: when the false merging rate is too high, the adjustment coefficients of related elements are reduced or the similarity threshold is appropriately increased; when the missed merging rate is too high, the adjustment coefficients of core elements that are more relevant to the scene are appropriately increased; to avoid parameter oscillations, the update amplitude is controlled by the learning rate and upper and lower bounds are set, and the adjustment coefficients are maintained separately according to alarm type or asset type, so that the optimization has scene adaptability. The step of optimizing the preset adjustment coefficient based on the evaluation results includes: When the evaluation result indicates missed merging, the preset adjustment coefficient is increased; When the evaluation result indicates an incorrect merging, the preset adjustment coefficient is reduced; The evaluation result is represented by R: like This indicates a missed merge; in this case, the relevance weighting coefficient of the core module is increased. ,in For learning rate, The gradient of the weights; like This indicates an error merging process, in which case the relevance weighting coefficient of the core module is reduced. ; like This indicates a successful merger.

2. The alarm aggregation method as described in claim 1, characterized in that, Before acquiring multiple alarm data, the method further includes: Multiple alarm messages are acquired, and each alarm message has a corresponding message format; Based on the information format of each alarm message, determine the parsing rules for each alarm message; The alarm information is parsed based on the parsing rules to obtain the initial alarm data; The initial alarm data is processed by field mapping based on a preset mapping table to obtain the alarm data. Based on the alarm data, feature extraction processing is performed to obtain the behavioral features, asset features, and text features of the alarm data.

3. The alarm aggregation method as described in claim 2, characterized in that, The feature extraction process based on the alarm data yields behavioral features, asset features, and text features of the alarm data, including: Based on preset mapping rules, the alarm data is subjected to structured feature extraction processing to obtain initial asset features and initial behavior features. Based on the text content in the alarm data, extract initial text features; The initial asset features, initial behavioral features, and initial text features are formatted to obtain the behavioral features, asset features, and text features.

4. The alarm aggregation method as described in claim 1, characterized in that, The calculation of the attention weight of each text element in the text features in the alarm similarity determination includes: Calculate the cosine similarity between every two of the text elements; Max pooling is performed based on the cosine similarity to obtain at least one optimal matching pair, wherein the optimal matching pair includes two of the text elements. Input all the optimal matching pairs into a preset recurrent neural network model to obtain the hidden state of each text element; The attention weight of each text element is calculated based on the hidden state.

5. The alarm aggregation method as described in claim 1, characterized in that, The aggregation process, based on the fusion features of each alarm data point, is performed on all the alarm data to obtain an aggregation result, including: Calculate the similarity between the fused features of any two of the alarm data; Based on the similarity and the preset similarity threshold, it is determined whether the two alarm data are aggregable alarm data; Among all the alarm data, the alarm data that is determined to be aggregable is merged to obtain the aggregation result.

6. An alarm aggregation device, characterized in that, The device includes: The first acquisition module is used to acquire multiple alarm data, which correspond to behavioral features, asset features, and text features. Behavioral features are used to describe the dynamic attributes of attack behavior, including the attack source IP address, attack port, attack type, attack time, and attack frequency, reflecting the attacker's behavioral characteristics. Asset features are used to represent the static attributes of the attacked object, including the asset's public IP address, internal IP address, asset type, affiliated business system, and operating system version. Text features include event name, attack description, payload, threat type, impact, and handling suggestions, which are unstructured natural language descriptions used to reflect the semantic content of the alarm. The first calculation module is used to calculate the attention weight of each text element in the text features in the alarm similarity determination; The first adjustment module is used to distinguish core text elements from non-core text elements among various text elements, and adjust the attention weight of the core text elements according to a preset adjustment coefficient to obtain the adjusted attention weight. The segmentation is completed through static configuration or maintained by category based on historical aggregation performance. Event name, payload, and threat type are marked as core set, while other text elements are non-core set by default. After the segmentation is completed, the attention weight of core text elements is amplified or reduced according to the preset adjustment coefficient to obtain the adjusted attention weight. Non-core text elements are not amplified and their initial attention weight remains unchanged. The adjustment process limits the maximum and minimum amplification amounts and performs a normalization after all element weights are corrected to keep the total weight stable, which facilitates subsequent weighted aggregation calculations. In the case of missing elements, only the actual core elements are adjusted, and the missing elements are not included in the calculation, thereby ensuring the executability and robustness of the weighting process. The first aggregation module is used to aggregate the text elements of the alarm data based on the adjusted attention weights and the attention weights of the non-core text elements to obtain the text semantic vector of the alarm data. The first fusion module is used to perform fusion processing based on the text semantic vector, the behavioral features and the asset features to obtain the fusion features of the alarm data; The second aggregation module is used to aggregate all the alarm data based on the fusion characteristics of each alarm data to obtain an aggregation result; The device further includes: The third acquisition module is used to acquire the evaluation results of the aggregation results. The evaluation results come from two sources: one is the labeling of the correctness of the aggregation by manual judgment or expert review, forming feedback on correct aggregation, incorrect merging or missed merging; the other is to statistically analyze the historical aggregation effects according to time windows to obtain the incorrect merging rate, missed merging rate, accuracy rate or F1 score. The first optimization module is used to optimize the preset adjustment coefficients based on the evaluation results. Using the evaluation results as feedback signals, it performs bounded updates to the weight adjustment coefficients for core text elements: when the false merging rate is high, it reduces the adjustment coefficients of related elements or appropriately increases the similarity threshold; when the missed merging rate is high, it appropriately increases the adjustment coefficients of core elements more relevant to the scene. To avoid parameter oscillations, the update amplitude is controlled by the learning rate and has upper and lower bounds. The adjustment coefficients are maintained separately according to alarm type or asset type, making the optimization scene-adaptive. The first optimization module is further configured to: When the evaluation result indicates missed merging, the preset adjustment coefficient is increased; When the evaluation result indicates an incorrect merging, the preset adjustment coefficient is reduced; The evaluation result is represented by R: like This indicates a missed merge; in this case, the relevance weighting coefficient of the core module is increased. ,in For learning rate, The gradient of the weights; like This indicates an error merging process, in which case the relevance weighting coefficient of the core module is reduced. ; like This indicates a successful merger.

7. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and running on the processor, characterized in that, When the processor executes the computer-readable instructions, it implements the alarm aggregation method as described in any one of claims 1 to 5.

8. A readable storage medium having computer-readable instructions stored thereon, characterized in that, When the computer-readable instructions are executed by the processor, they implement the alarm aggregation method as described in any one of claims 1 to 5.

Images