Security alarm processing method, device, equipment and storage medium

Abstract

This application discloses a security alarm processing method, apparatus, device, and storage medium, relating to the field of network security technology. The method includes: preprocessing multi-source heterogeneous data to obtain security alarm data; identifying the security alarm data using an alarm identification model to determine the alarm type and threat level; constructing a security knowledge graph from the security alarm data using a graph database; performing correlation analysis on the security knowledge graph to obtain attack chain information; and assessing the risk of the attack chain information based on the alarm type and threat level to obtain a comprehensive risk level. Because this application identifies security alarm data using an alarm identification model, it can improve the detection capability of new attacks; simultaneously, by combining the constructed security knowledge graph with alarm correlation analysis, it effectively identifies potential attack chains and complex attack behaviors, thereby enabling in-depth analysis of alarms and accurate judgment of their severity.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a security alarm processing method, apparatus, device and storage medium. Background Technology

[0002] With the rapid development of information technology, data security has become increasingly important in various fields, especially in the field of cybersecurity, where the detection and analysis of security alerts are of paramount importance.

[0003] Current network security alert analysis typically employs methods such as rule-based Security Information and Event Management (SIEM) systems and machine learning-based anomaly detection. Rule-based SIEM systems primarily analyze logs and alerts from various security devices (such as firewalls and intrusion detection systems) using predefined rules to identify security threats. Machine learning-based anomaly detection utilizes machine learning algorithms to learn normal network behavior patterns and detect deviations from these patterns, thereby identifying anomalous behavior.

[0004] However, some cyberattacks are covert and complex, often involving phased, gradual penetration that is difficult to detect in the initial stages. The aforementioned alert analysis methods generally focus only on the alert itself, failing to uncover complex attacks spanning multiple security devices and lacking in-depth analysis, making it difficult to accurately assess the severity of the alerts. Summary of the Invention

[0005] The main purpose of this application is to provide a security alarm processing method, apparatus, device and storage medium, which aims to solve the technical problem that traditional alarm analysis methods generally only focus on the alarm itself, making it difficult to detect complex attack behaviors across multiple security devices, thus making it difficult to accurately determine the severity of the alarm.

[0006] To achieve the above objectives, this application proposes a security alarm processing method, the method comprising:

[0007] Security alarm data is obtained by preprocessing multi-source heterogeneous data, which is collected from the network side and terminal side of the current network system.

[0008] The security alarm data is identified by a preset alarm identification model to determine the alarm type and threat level. The alarm identification model is built based on the Transformer architecture.

[0009] A security knowledge graph is generated by constructing a graph from the security alarm data using a graph database.

[0010] The attack chain information is obtained by performing correlation analysis on the security knowledge graph.

[0011] Based on the alarm type and the threat level, the attack chain information is assessed for risk, and a comprehensive risk level is obtained.

[0012] In one embodiment, the step of identifying the security alarm data using a preset alarm identification model to determine the alarm type and threat level includes:

[0013] The security alarm data is segmented using a preset word segmenter to obtain multiple sub-words;

[0014] A unique identifier and attention mask are assigned to the multiple sub-words to obtain the alarm coded text;

[0015] The alarm coded text is encoded using a preset word embedding model to obtain corresponding low-dimensional vector data;

[0016] The low-dimensional vector data is input into a preset alarm identification model to obtain the alarm type and threat level corresponding to the security alarm data.

[0017] In one embodiment, before the step of segmenting the security alarm data using a preset word segmenter to obtain multiple sub-words, the method further includes:

[0018] The alarm types and threat levels of historical security alarm data are labeled to obtain labeled alarm data, which is obtained from the current network system;

[0019] Build the initial model using the Transformer architecture;

[0020] The labeled alarm data is input into the initial model for model training to obtain the model output results;

[0021] Determine whether the accuracy of the model output reaches a first preset threshold;

[0022] If the first preset threshold is not reached, the model parameters are adjusted, and the process returns to the step of inputting the labeled alarm data into the initial model for model training, until the accuracy reaches the first preset threshold, thus obtaining the alarm recognition model.

[0023] In one embodiment, the step of constructing a security knowledge graph from the security alarm data using a graph database includes:

[0024] Based on the security alarm data, information identification is performed to determine the entity types and external threat information contained in the security alarm data;

[0025] Relationship extraction is performed on the security alarm data to determine the mapping relationship between the entity types;

[0026] An initial knowledge graph is obtained by constructing a graph graph of the entity types and the mapping relationships using a graph database.

[0027] The external threat information is imported into the initial knowledge graph to obtain a security knowledge graph.

[0028] In one embodiment, the step of performing correlation analysis on the security knowledge graph to obtain attack chain information includes:

[0029] Potential attack chains are identified by performing a graph search in the security knowledge graph using a depth-first search algorithm.

[0030] The attack chain score of the potential attack chain is determined based on the paths between entity nodes in the security knowledge graph.

[0031] Determine whether the attack chain score reaches a second preset threshold;

[0032] The entity nodes that reach the second preset threshold are identified as attack chain information.

[0033] In one embodiment, the step of performing risk assessment on the attack chain information based on the alarm type and the threat level to obtain a comprehensive risk level includes:

[0034] Identify the device assets involved in the alarm type within the current network system;

[0035] Quantify the importance level of the aforementioned equipment assets;

[0036] The attack chain information is assessed for risk based on the importance level and the threat level to obtain a comprehensive risk level.

[0037] In one embodiment, the step of preprocessing multi-source heterogeneous data to obtain security alarm data includes:

[0038] Data is collected from the network side and terminal side of the current network system through preset components to obtain multi-source heterogeneous data;

[0039] The missing values ​​of the multi-source heterogeneous data are filled to obtain the target multi-source data;

[0040] The target multi-source data is deduplicated using a hash algorithm to obtain the deduplicated data.

[0041] The deduplicated data is normalized to obtain the security alarm data corresponding to the current network system.

[0042] Furthermore, to achieve the above objectives, this application also proposes a security alarm processing device, the device comprising:

[0043] The preprocessing module is used to preprocess multi-source heterogeneous data to obtain security alarm data. The multi-source heterogeneous data is collected from the network side and terminal side of the current network system.

[0044] The alarm identification module is used to identify the security alarm data through a preset alarm identification model, and determine the alarm type and threat level. The alarm identification model is built based on the Transformer architecture.

[0045] The knowledge graph module is used to construct a graph from the security alarm data using a graph database, thereby generating a security knowledge graph.

[0046] The attack chain module is used to perform correlation analysis on the security knowledge graph to obtain attack chain information.

[0047] The risk assessment module is used to assess the risk of the attack chain information based on the alarm type and the threat level, and obtain a comprehensive risk level.

[0048] In addition, to achieve the above objectives, this application also proposes a security alarm processing device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the security alarm processing method described above.

[0049] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the security alarm processing method described above.

[0050] One or more technical solutions proposed in this application have at least the following technical effects: The security alarm processing method of this application includes: preprocessing multi-source heterogeneous data to obtain security alarm data, wherein the multi-source heterogeneous data is collected from the network side and terminal side of the current network system; identifying the security alarm data through a preset alarm identification model to determine the alarm type and threat level, wherein the alarm identification model is built based on the Transformer architecture; constructing a graph of the security alarm data through a graph database to generate a security knowledge graph; performing correlation analysis on the security knowledge graph to obtain attack chain information; and performing risk assessment on the attack chain information based on the alarm type and the threat level to obtain a comprehensive risk level.

[0051] Because this application identifies security alarm data through an alarm recognition model, it can improve the detection capability of new types of attacks; at the same time, by combining the constructed security knowledge graph with alarm correlation analysis, it can effectively identify potential attack chains and complex attack behaviors, thereby enabling in-depth analysis of alarms and accurate judgment of the severity of alarms. Attached Figure Description

[0052] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a flowchart illustrating an embodiment of the security alarm handling method of this application.

[0055] Figure 2 This is a flowchart illustrating Embodiment 2 of the security alarm handling method of this application.

[0056] Figure 3 This is a flowchart illustrating Embodiment 3 of the security alarm handling method of this application;

[0057] Figure 4 This is a schematic diagram of the module structure of the security alarm processing device according to an embodiment of this application;

[0058] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the security alarm processing method in this application embodiment.

[0059] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0060] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0061] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0062] It should be noted that the executing entity in this embodiment can be a computing service device with alarm identification, map construction, and risk assessment functions, such as a personal computer or a network server, or an electronic device capable of performing the above functions, or a security alarm processing device (hereinafter referred to as the processing device) that executes the security alarm processing method of this application. This embodiment does not limit this. The following uses the processing device as an example to describe this embodiment and the following embodiments.

[0063] This application presents Embodiment 1. Embodiment 1 of this application provides a security alarm processing method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the security alarm handling method of this application.

[0064] In this embodiment, the security alarm processing method includes steps S10 to S50:

[0065] Step S10: Perform data preprocessing on the multi-source heterogeneous data to obtain security alarm data. The multi-source heterogeneous data is collected from the network side and terminal side of the current network system.

[0066] It should be noted that multi-source heterogeneous data refers to data sources collected from the network side (such as network traffic data and network logs generated by network devices) and the terminal side (such as system logs and runtime data generated by applications on terminal devices) in the current network system.

[0067] Network-side data may have a network protocol-related structure; for example, network traffic data exists in the form of data packets, containing information such as source IP, destination IP, and port number. Terminal-side data, on the other hand, may be related to the terminal's operating system and application type, and may be in data formats such as text logs. These data, with their different sources, structures, and semantics, collectively constitute multi-source heterogeneous data.

[0068] Understandably, security alert data is network security-related data extracted from multi-source heterogeneous data. This data can indicate potential security threats or abnormal behavior in the network system.

[0069] For example, a large amount of abnormal port scanning behavior is detected in network traffic; or a malicious program is detected on the terminal device attempting to modify critical system files.

[0070] In practice, the processing device first collects data from the network side and the terminal side, and performs preliminary cleaning, deduplication, and normalization on the collected raw data to obtain security alarm data related to network security.

[0071] In one feasible implementation, step S10 of this embodiment may include the following steps: collecting data from the network side and terminal side of the current network system through a preset component to obtain multi-source heterogeneous data; filling in missing values ​​in the multi-source heterogeneous data to obtain target multi-source data; performing deduplication processing on the target multi-source data using a hash algorithm to obtain deduplicated data; and performing normalization processing on the deduplicated data to obtain security alarm data corresponding to the current network system.

[0072] It should be noted that the preset components are hardware units pre-configured in the processing device for collecting data from the network side and terminal side of the network system. Examples include traffic collection components, terminal collection components, proprietary security components, and third-party security components, etc., and this embodiment does not limit them.

[0073] For example, network-side traffic acquisition components can obtain traffic-related alarm data through network monitoring protocols, while terminal acquisition components can obtain alarm information on the terminal through APIs of the terminal device's operating system.

[0074] Understandably, a hash algorithm is an algorithm that can map data of arbitrary length to a hash value of fixed length. By calculating the hash value of each data element in the target multi-source data, it is possible to quickly determine whether the data is duplicated.

[0075] Specifically, the processing of the aforementioned multi-source heterogeneous data may include: First, raw multi-source heterogeneous data can be collected from the network side and the terminal side using traffic acquisition components, terminal acquisition components, proprietary security components, and third-party security components. Then, the multi-source heterogeneous data is inspected. For missing data values, they can be filled in or directly deleted according to the logical relationship of the data. For erroneous data, value range verification can be performed, such as whether the IP address conforms to the format specification; those that do not conform are considered erroneous data and deleted.

[0076] Next, data imputation is performed on the above data. For example, for numerical data, if the data follows a normal or approximately normal distribution, the mean of the variable can be calculated and used to fill in missing values. If the proportion of missing values ​​in the entire multi-source heterogeneous data is very small (e.g., less than 5%), and the data volume is large enough, rows or columns containing missing values ​​can be directly deleted. After the above data imputation, the target multi-source data can be obtained.

[0077] Next, the target multi-source data is deduplicated. A hash algorithm can be used to process the target multi-source data, calculating a hash value for each data point (containing key information such as alarm type, timestamp, source IP address, and destination IP address). Identical target multi-source data will yield the same hash value. By comparing the hash values, duplicate alarm data can be quickly identified and removed, resulting in deduplicated data.

[0078] Finally, the deduplicated data is normalized. For alarm data with different value ranges, such as some alarm data values ​​being between 0 and 100 while others are between 0 and 1, they can be converted into a uniform numerical range through linear transformation or normalization algorithms (such as Min-Max normalization) to obtain the security alarm data corresponding to the current network system, which will facilitate subsequent analysis and processing.

[0079] In this embodiment, the processing device starts by collecting and processing multi-source heterogeneous data step by step, which can integrate information from all aspects of the network system and adapt to the processing needs of data from different sources and types in complex network environments, thereby more effectively discovering security problems in the network system.

[0080] Step S20: Identify the security alarm data using a preset alarm identification model to determine the alarm type and threat level. The alarm identification model is built based on the Transformer architecture.

[0081] It should be noted that the alarm identification model is a model built on the Transformer architecture for identifying security alarm data. By learning from a large number of known security alarm data samples, the model establishes a mapping relationship between data features and alarm types and threat levels, enabling it to accurately identify new security alarm data and determine its alarm type and threat level.

[0082] The Transformer architecture is a deep learning architecture consisting of an encoder and a decoder, which can more effectively learn complex patterns in security alarm data and improve the accuracy of alarm identification.

[0083] Understandably, alert types are categories used to identify the specific security events represented by network security alerts. For example, one alert type might be an "intrusion detection alert," indicating that the network security system has detected an external entity attempting to illegally intrude into the network. Another alert type might be a "malware alert," indicating that suspected malware activity, such as viruses or Trojans, has been detected on the network.

[0084] It should be understood that threat level is an indicator used to measure the severity of the security threat represented by a cybersecurity alert.

[0085] In the specific implementation, the processing device pre-builds an alarm recognition model using the Transformer architecture, which is used as a classifier to identify security alarm data, thereby determining the alarm type and threat level of the security alarm data.

[0086] In one feasible implementation, step S20 of this embodiment may include the following steps: performing word segmentation on the security alarm data using a preset word segmenter to obtain multiple sub-words; assigning unique identifiers and attention masks to the multiple sub-words to obtain alarm encoded text; performing data encoding on the alarm encoded text using a preset word embedding model to obtain corresponding low-dimensional vector data; and inputting the low-dimensional vector data into a preset alarm recognition model to obtain the alarm type and threat level corresponding to the security alarm data.

[0087] Specifically, if the security alarm data contains text information, the text needs to be converted into a format suitable for the alarm recognition model. At this point, a pre-defined tokenizer is loaded. This tokenizer splits the security alarm data text into individual words or sub-tokens. The tokenizer processes the text according to a set maximum length. If the text length is less than the maximum length, it is padded to ensure all inputs have the same length; if the text length exceeds the maximum length, it is truncated. During this process, the tokenizer assigns a unique identifier to each token and generates an attention mask. This mask tells the alarm recognition model which tokens are valid parts of the original text and which are padding parts. After processing by the tokenizer, the alarm coded text is obtained.

[0088] Next, the alarm coded text is input into the word embedding model. The word embedding model calculates the vector representation (i.e., low-dimensional vector data) of each token based on the input identifier and attention mask, and mines the semantic relationships between sub-words.

[0089] The low-dimensional vector data is then arranged and combined according to the word order in the text to form a vector sequence that can represent the semantic information of the entire security alarm data.

[0090] Finally, the trained alarm recognition model is used as a classifier. The vector sequence of low-dimensional vector data is input into the classifier, and the classification result of the security alarm data (i.e., alarm type and threat level) is output.

[0091] In this implementation, by constructing an adaptive alarm recognition model, new attack patterns can be continuously learned, improving the detection capability for novel attacks. This enables accurate classification of security alarms, significantly reducing false alarm rates and the risk of missed alarms.

[0092] Step S30: Construct a security knowledge graph from the security alarm data using a graph database.

[0093] It's important to note that a graph database is a database used to store and manage graph-structured data. Graph data consists of nodes and edges; nodes represent entities, and edges represent relationships between entities. In the field of network security, graph databases can be used to store various entities (such as IP addresses, users, and devices) and their relationships (such as network connectivity, user and device access relationships, which department an asset belongs to, and which websites a user visited). Graph databases enable efficient querying and analysis of such complex relationship networks, thus providing an effective data storage and query foundation for building security knowledge graphs.

[0094] Understandably, a security knowledge graph is a structure that represents cybersecurity knowledge in the form of a graph. It can be constructed by using various entities (such as IP addresses, security events, vulnerabilities, etc.) in security alert data as nodes and the relationships between entities (such as network connection relationships between IP addresses, and association relationships between security events and vulnerabilities) as edges.

[0095] In practice, the processing device extracts entities and relationships from security alarm data and stores them in a graph database, which is then used to construct a security knowledge graph containing various security elements.

[0096] In one feasible implementation, step S30 of this embodiment may include the following steps: performing information identification based on the security alarm data to determine the entity types and external threat information contained in the security alarm data; performing relationship extraction on the security alarm data to determine the mapping relationship between the entity types; constructing a graph of the entity types and the mapping relationship through a graph database to obtain an initial knowledge graph; and importing the external threat information into the initial knowledge graph to obtain a security knowledge graph.

[0097] Specifically, to build a knowledge graph, the first step is to determine the types of entities to be identified from security alert data, such as assets (servers, network devices, etc.), users, IP addresses, domain names, vulnerabilities, etc.; and to determine the external threat information to be identified, such as malicious IP addresses. For example, for identifying IP address entities, regular expressions can be used to match strings that conform to the IP address format. For identifying asset types, matching can be done based on keywords in the device name or description.

[0098] Next, the mapping relationships between entity types need to be determined. For example, to extract the relationship "which department the asset belongs to", records containing both the asset name and department name can be found in the security alarm data, and the relationship can be determined based on specific keywords. To extract the relationship "which website the user visited", records containing both the user account and domain name can be found.

[0099] Next, the graph database is activated, and the identified entity types and mapping relationships are imported into the knowledge graph to obtain an initial knowledge graph. Finally, the association between the information in the external threat intelligence and the existing entities and relationships in the initial knowledge graph is analyzed, and the external threat intelligence is imported into the initial knowledge graph to generate a security knowledge graph.

[0100] In this embodiment, by constructing a security knowledge graph containing security alarm data, alarm correlation analysis across devices and platforms can be achieved, effectively identifying potential attack chains and complex attack behaviors.

[0101] Step S40: Perform correlation analysis on the security knowledge graph to obtain attack chain information.

[0102] It should be noted that attack chain information describes the complete process by which an attacker carries out an attack on a network system, including each stage of the attack and the entities and operations involved in each stage. Attack chain information details the attack path and the elements involved, providing clear information about the attack process for network security defense and helping to develop targeted defense strategies.

[0103] In practical implementation, the processing device can perform correlation analysis on alarms based on the security knowledge graph, query relevant entities and relationships in the security knowledge graph, discover potential attack chains and complex attack behaviors, and identify attack chain information.

[0104] Step S50: Based on the alarm type and the threat level, perform risk assessment on the attack chain information to obtain a comprehensive risk level.

[0105] It should be noted that the comprehensive risk level is obtained by comprehensively assessing the attack chain information based on alarm type and threat level. Alarm type reflects the nature of the security incident, such as whether it's an intrusion detection alarm or a malware alarm; threat level indicates the degree of harm the security incident poses to the network system, such as low, medium, or high. Therefore, in the risk assessment process, the alarm type and threat level of each link in the attack chain can be comprehensively considered to obtain an overall assessment that accurately reflects the level of security risk faced by the network system.

[0106] In practice, the processing equipment can comprehensively assess alarms based on alarm type and threat level, combined with contextual information such as asset importance and business impact, and output a comprehensive risk level to improve the accuracy of the assessment.

[0107] In another feasible implementation, step S50 of this embodiment may include the steps of: determining the device assets involved in the alarm type in the current network system; quantifying the importance level of the device assets; and performing risk assessment on the attack chain information based on the importance level and the threat level to obtain a comprehensive risk level.

[0108] Specifically, the first step is to identify the device assets involved in the alarm in the current network system. This can be done by extracting asset-related identifiers from the security alarm data, such as IP addresses or specific asset name keywords.

[0109] Then, the importance level of the equipment assets is quantified. For example, the level is defined based on the impact of the equipment assets on the business, such as an asset importance level of 3, which indicates moderate importance, and an asset importance level of 8, which indicates extreme importance.

[0110] Finally, the attack chain information is assessed for risk based on its importance and threat levels, resulting in a comprehensive risk level. For example, if the asset importance level is 3 and the threat level is greater than or equal to 8, the comprehensive risk level is high. If the asset importance level is 2 and the threat level is between 4 and 7, the comprehensive risk level is medium. If the asset importance level is 1 and the threat level is less than or equal to 3, the comprehensive risk level is low. The boundary values ​​of these rules can be adjusted according to actual circumstances; this embodiment does not impose any restrictions on this.

[0111] In this implementation, by introducing a context-aware mechanism, alarms are correlated with factors such as asset importance and the threat level of business impact, which can improve the accuracy of the assessment.

[0112] Furthermore, interpretable artificial intelligence technology can be utilized to interpret the alarm analysis results using the SHAP (SHapley Additive Explanations) algorithm (used to interpret the prediction results of the above model) and the LIME (Local Interpretable Model-agnostic Explanations) algorithm (used to interpret the prediction results of individual alarms). The interpretation results are visualized to facilitate understanding and response by security personnel. Simultaneously, the alarm type, threat level, and contextual information are transmitted to the human-computer interaction module, allowing security personnel to query, analyze, and assess alarms through the user interface and take effective countermeasures.

[0113] In the technical solution provided in this embodiment, the processing device first collects data from the network side and the terminal side. The collected raw data undergoes preliminary cleaning, deduplication, and normalization operations to obtain security alarm data related to network security. Then, an alarm recognition model built using the Transformer architecture is used as a classifier to identify the security alarm data, thereby determining the alarm type and threat level. Next, entities and relationships are extracted from the security alarm data and stored in a graph database. A security knowledge graph containing various security elements is constructed using this graph database. Subsequently, based on the security knowledge graph, correlation analysis can be performed on the alarms. Relevant entities and relationships can be queried within the security knowledge graph to discover potential attack chains and complex attack behaviors, and to identify attack chain information. Finally, based on the alarm type and threat level, and combined with contextual information such as asset importance and business impact, a comprehensive assessment of the alarms is conducted to output a comprehensive risk level, thereby improving the accuracy of the assessment. Because this embodiment identifies security alarm data through an alarm recognition model, it can improve the detection capability of new attacks; at the same time, by combining the constructed security knowledge graph with alarm correlation analysis, it can effectively identify potential attack chains and complex attack behaviors, thereby enabling in-depth analysis of alarms and accurate judgment of the severity of alarms.

[0114] Based on the first embodiment of this application described above, a second embodiment of this application is proposed. In this second embodiment, content that is the same as or similar to that in the first embodiment can be referred to the above description and will not be repeated hereafter. Based on this, please refer to... Figure 2 , Figure 2 This is a flowchart illustrating Embodiment 2 of the security alarm handling method of this application.

[0115] The alarm recognition model described above still needs to be trained. Before the step of segmenting the security alarm data using a preset word segmenter to obtain multiple sub-words, this example also includes steps S01 to S05:

[0116] Step S01: Label the alarm types and threat levels of historical security alarm data to obtain labeled alarm data. The historical security alarm data is obtained from the current network system.

[0117] It should be noted that historical security alert data is a collection of security-related alerts from the current network system over a period of time. It includes records of various events that may pose security threats detected during the operation of the network system, such as network intrusion attempts, malware activities, and abnormal user access behavior.

[0118] Annotated alarm data refers to historical security alarm data that has undergone data annotation to clarify the alarm type and threat level. This data includes both the original security alarm information and the type and level information added by manual annotations, and is important input data for building and training alarm recognition models.

[0119] Specifically, after obtaining historical security alert data, accurate labeling of this data is necessary to train the model. Labeling can include alert type (e.g., network intrusion, device failure, service anomaly) and threat level (high, medium, low). This may require manual labeling or automatic labeling based on known rules and standards, and the accuracy and consistency of the labeling must be ensured.

[0120] Step S02: Build the initial model using the Transformer architecture.

[0121] Step S03: Input the labeled alarm data into the initial model for model training to obtain the model output results.

[0122] Understandably, the model output is the result obtained after the labeled alarm data is input into the initial model or the trained model, and the model performs a series of calculations and processing. This output will be compared with the actual labeled results in the labeled alarm data to evaluate the model's accuracy.

[0123] Step S04: Determine whether the accuracy of the model output reaches the first preset threshold.

[0124] Understandably, accuracy is an important metric for measuring model performance; it refers to the proportion of model outputs that match the actual labeled results in the labeled alert data. The first preset threshold is a pre-set target value for accuracy.

[0125] For example, if the model predicts 100 labeled alarm data points, and 80 of the predicted results are completely consistent with the actual labeled results, then the model's accuracy is 80%. If the first preset threshold is 80%, then the model is considered to have passed training and can be used as an alarm recognition model.

[0126] Step S05: If the first preset threshold is not reached, adjust the model parameters and return to the step of inputting the labeled alarm data into the initial model for model training until the accuracy reaches the first preset threshold to obtain the alarm recognition model.

[0127] It's important to note that model parameters refer to variables within the constructed model, such as the learning rate, connection weights between neurons, and biases. During model training, adjusting the values ​​of these parameters allows the model's output to approximate the actual labeled results as closely as possible, thereby improving the model's accuracy.

[0128] Specifically, the labeled alert data can be divided into a training set and a validation set (e.g., in an 8:2 ratio). The initial model is trained using the training set. After each training cycle, the model's performance is evaluated using the validation set, such as by calculating metrics like accuracy, recall, and F1-score. Based on the validation set evaluation results, the model's parameters, such as the learning rate and network architecture, are adjusted until the model achieves good performance on the validation set.

[0129] In the technical solution provided in this embodiment, by annotating historical security alarm data, building a model using the Transformer architecture and training it, and continuously adjusting the model parameters until the accuracy reaches a preset threshold, the obtained alarm identification model can accurately identify the alarm type and threat level of new alarm data, thereby improving the overall security of the network system.

[0130] Based on the above embodiments of this application, a third embodiment of this application is proposed. In this third embodiment, content that is the same as or similar to the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 , Figure 3 This is a flowchart illustrating Embodiment 3 of the security alarm handling method of this application.

[0131] Considering the implementation process of attack chain information, step S40 in this example includes steps S41 to S44:

[0132] Step S41: Perform graph search in the security knowledge graph using a depth-first search algorithm to identify potential attack chains.

[0133] It should be noted that Depth-First Search (DFS) is an algorithm used for searching graph data structures (such as security knowledge graphs). In a security knowledge graph, one can start with a security-related entity (such as a network service or user account) and explore other related entities (such as potential vulnerabilities, permission relationships, etc.) in depth, continuously digging deeper to find information related to potential attack chains (i.e., potential attack chains).

[0134] Specifically, graph algorithms, such as depth-first search or breadth-first search, can be used. Starting with an initial alert (such as an alert discovering a malicious IP), the security knowledge graph searches for possible subsequent alerts to build a complete attack chain. For example, if the initial alert discovers a malicious IP accessing the internal network, by searching for subsequent alerts, such as the IP's vulnerability detection on a specific server or exploitation of vulnerabilities for privilege escalation, a potential attack chain can be gradually constructed.

[0135] Step S42: Determine the attack chain score of the potential attack chain based on the paths between entity nodes in the security knowledge graph.

[0136] It's important to note that in a security knowledge graph, paths between entity nodes are links connecting them. These paths consist of edges in the graph, each representing a specific relationship between entities. For example, if there's a network service entity node and a vulnerability entity node, and an edge between them represents a "vulnerability exists" relationship, then this constitutes a path between these two entity nodes. Paths reflect the way different entities are associated in the security knowledge graph and are crucial for identifying potential attack chains and calculating attack chain scores.

[0137] Understandably, the attack chain score is a quantitative value determined based on the paths between entity nodes in a security knowledge graph, used to measure the likelihood or danger of a potential attack chain.

[0138] Specifically, in calculating the attack chain score, the weights of different relationships between entity nodes can be determined first. For example, in an attack chain, the relationship from "reconnaissance" to "weaponization" may have a higher weight than the relationship from "reconnaissance" to "initial access" because it is closer to the actual attack execution stage.

[0139] Then, for the entity nodes related to the alarm category found in the query, path analysis and score calculation can be performed using the aforementioned potential attack chain. When calculating the attack chain score, the relation weights on the path are accumulated. For example, if there is a path from entity node A (relevant entity in the reconnaissance phase) through relation R1 (weight 0.3) to entity node B (relevant entity in the weaponization phase), and then through relation R2 (weight 0.5) to entity node C (relevant entity in the execution phase), then the attack chain score for this path is 0.3 + 0.5 = 0.8.

[0140] Step S43: Determine whether the attack chain score reaches the second preset threshold.

[0141] It should be noted that the second preset threshold is a pre-defined critical value for the attack chain score. Only potential attack chains whose attack chain scores reach the second preset threshold are considered to be sufficiently dangerous or likely to be attacked.

[0142] For example, if an enterprise has very high security requirements, it may set the threshold to 0.7, meaning that only the sequence of entity nodes with a high score that is more likely to be a complete attack chain is considered as attack chain information; while for some relatively lenient security environments, the threshold may be set to 0.5.

[0143] Step S44: The entity node corresponding to the second preset threshold is determined as attack chain information.

[0144] Specifically, it can iterate through all entity node sequences that have calculated attack chain scores, and identify sequences with scores higher than a preset threshold as attack chain information for security analysis, risk assessment, and the development of response strategies.

[0145] In the technical solution provided in this embodiment, a depth-first search algorithm is used to search the security knowledge graph, which can effectively uncover potential attack chains. By calculating the attack chain score and comparing it with a second preset threshold, attack chain information with higher risk or probability can be filtered out. This helps cybersecurity personnel focus on attack paths that are truly likely to threaten the network system, take timely preventative measures, thereby improving the security and defense capabilities of the network system and reducing the risk of being attacked.

[0146] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the security alarm processing method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0147] This application also provides a security alarm processing device, please refer to... Figure 4 , Figure 4This is a schematic diagram of the module structure of the security alarm processing device according to an embodiment of this application; the security alarm processing device includes:

[0148] Preprocessing module 401 is used to preprocess multi-source heterogeneous data to obtain security alarm data. The multi-source heterogeneous data is collected from the network side and terminal side of the current network system.

[0149] The alarm identification module 402 is used to identify the security alarm data through a preset alarm identification model, and determine the alarm type and threat level. The alarm identification model is built based on the Transformer architecture.

[0150] Knowledge graph module 403 is used to construct a graph from the security alarm data using a graph database to generate a security knowledge graph;

[0151] Attack chain module 404 is used to perform correlation analysis on the security knowledge graph to obtain attack chain information;

[0152] The risk assessment module 405 is used to assess the risk of the attack chain information based on the alarm type and the threat level to obtain a comprehensive risk level.

[0153] In one implementation, the alarm recognition module 402 is further configured to perform word segmentation on the security alarm data using a preset word segmenter to obtain multiple sub-words; assign unique identifiers and attention masks to the multiple sub-words to obtain alarm encoded text; encode the alarm encoded text using a preset word embedding model to obtain corresponding low-dimensional vector data; and input the low-dimensional vector data into a preset alarm recognition model to obtain the alarm type and threat level corresponding to the security alarm data.

[0154] In one implementation, the alarm identification module 402 is further configured to annotate the alarm types and threat levels of historical security alarm data to obtain annotated alarm data, wherein the historical security alarm data is obtained from the current network system; construct an initial model using a Transformer architecture; input the annotated alarm data into the initial model for model training to obtain model output results; determine whether the accuracy of the model output results reaches a first preset threshold; if it does not reach the first preset threshold, adjust the model parameters and return to the operation of inputting the annotated alarm data into the initial model for model training until the accuracy reaches the first preset threshold, thereby obtaining an alarm identification model.

[0155] In one implementation, the knowledge graph module 403 is further configured to: identify information based on the security alarm data; determine the entity types and external threat information contained in the security alarm data; extract relationships from the security alarm data to determine the mapping relationships between the entity types; construct a graph of the entity types and the mapping relationships using a graph database to obtain an initial knowledge graph; and import the external threat information into the initial knowledge graph to obtain a security knowledge graph.

[0156] In one implementation, the attack chain module 404 is further configured to perform graph search in the security knowledge graph using a depth-first search algorithm to determine potential attack chains; determine the attack chain score of the potential attack chain based on the path between entity nodes in the security knowledge graph; determine whether the attack chain score reaches a second preset threshold; and determine the entity node corresponding to the second preset threshold as attack chain information.

[0157] As one implementation, the risk assessment module 405 is further configured to determine the device assets involved in the alarm type in the current network system; quantify the importance level of the device assets; and perform risk assessment on the attack chain information based on the importance level and the threat level to obtain a comprehensive risk level.

[0158] In one implementation, the preprocessing module 401 is further configured to collect data from the network side and terminal side of the current network system through preset components to obtain multi-source heterogeneous data; fill in missing values ​​in the multi-source heterogeneous data to obtain target multi-source data; perform deduplication processing on the target multi-source data using a hash algorithm to obtain deduplicated data; and perform normalization processing on the deduplicated data to obtain security alarm data corresponding to the current network system.

[0159] Other embodiments or specific implementations of the security alarm processing device of this application can be found in the above-described method embodiments, and will not be repeated here.

[0160] The security alarm processing device provided in this application, employing the security alarm processing method described in the above embodiments, can solve the technical problem that traditional alarm analysis methods generally only focus on the alarm itself, making it difficult to detect complex attacks spanning multiple security devices, thus hindering the accurate assessment of the alarm's severity. Compared with the prior art, the beneficial effects of the security alarm processing device provided in this application are the same as those of the security alarm processing method provided in the above embodiments, and other technical features in the security alarm processing device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0161] This application provides a security alarm processing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the security alarm processing method in the first embodiment described above.

[0162] The following is for reference. Figure 5 , Figure 5 This is a schematic diagram of the hardware operating environment involved in the security alarm processing method in the embodiments of this application, showing a structural diagram of a security alarm processing device suitable for implementing the embodiments of this application. The security alarm processing device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The security alarm processing device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0163] like Figure 5As shown, the security alarm processing device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in the read-only memory 1002 or a program loaded from the storage device 1003 into the random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the security alarm processing device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the security alarm processing device to communicate wirelessly or wiredly with other devices to exchange data. Although the figures show security alarm processing devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0164] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0165] The security alarm processing device provided in this application, employing the security alarm processing method described in the above embodiments, can solve the technical problem that traditional alarm analysis methods generally only focus on the alarm itself, making it difficult to detect complex attacks spanning multiple security devices, thus hindering the accurate assessment of the alarm's severity. Compared with the prior art, the beneficial effects of the security alarm processing device provided in this application are the same as those of the security alarm processing method provided in the above embodiments, and other technical features of this security alarm processing device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0166] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0167] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0168] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the security alarm processing method described in the above embodiments.

[0169] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0170] The aforementioned computer-readable storage medium may be included in the security alarm processing device; or it may exist independently and not assembled into the security alarm processing device.

[0171] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a security alarm processing device, the security alarm processing device performs the following actions: preprocesses multi-source heterogeneous data to obtain security alarm data, wherein the multi-source heterogeneous data is collected from the network side and terminal side of the current network system; identifies the security alarm data using a preset alarm identification model to determine the alarm type and threat level, wherein the alarm identification model is built based on the Transformer architecture; constructs a graph of the security alarm data using a graph database to generate a security knowledge graph; performs correlation analysis on the security knowledge graph to obtain attack chain information; and performs risk assessment on the attack chain information based on the alarm type and the threat level to obtain a comprehensive risk level.

[0172] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0173] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0174] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0175] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described security alarm processing method. This solves the technical problem that traditional alarm analysis methods generally only focus on the alarm itself, making it difficult to detect complex attacks spanning multiple security devices, thus hindering accurate assessment of the alarm's severity. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the security alarm processing method provided in the above embodiments, and will not be repeated here.

[0176] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A method for handling security alarms, characterized in that, The method comprises: data preprocessing is performed on multi-source heterogeneous data to obtain security alarm data, the multi-source heterogeneous data being collected from a network side and a terminal side of a current network system; an alarm recognition model is used to recognize the security alarm data to determine an alarm type and a threat level, the alarm recognition model being constructed based on a Transformer architecture; a graph database is used to construct a graph of the security alarm data to generate a security knowledge graph; correlation analysis is performed on the security knowledge graph to obtain attack chain information; risk research and judgment is performed on the attack chain information according to the alarm type and the threat level to obtain a comprehensive risk level; wherein the step of constructing the graph of the security alarm data by using the graph database to generate the security knowledge graph comprises: identifying information according to the security alarm data to determine entity types and external threat information contained in the security alarm data; extracting relationships of the security alarm data to determine mapping relationships between the entity types; starting the graph database, importing the identified entity types and mapping relationships into the knowledge graph, and constructing an initial knowledge graph by taking various entities as nodes and taking mapping relationships between the entities as edges; and importing the external threat information into the initial knowledge graph to obtain the security knowledge graph; wherein the step of performing correlation analysis on the security knowledge graph to obtain attack chain information comprises: starting a depth-first search algorithm in the security knowledge graph, starting from a security entity, exploring other entities related to the security entity in depth to determine a potential attack chain; determining relationship weights of different relationships between entity nodes and paths between entity nodes in the security knowledge graph; accumulating the relationship weights on the paths to obtain an attack chain score of the potential attack chain, wherein in the attack chain, a relationship of weaponization is detected with a higher weight than a relationship of initial access because it is closer to an actual attack execution stage; and traversing all entity node sequences with calculated attack chain scores to determine entity nodes with scores higher than a second preset threshold as attack chain information.

2. The method of claim 1, wherein, The step of recognizing the security alarm data by using the preset alarm recognition model to determine the alarm type and the threat level comprises: performing word segmentation on the security alarm data by using a preset word segmenter to obtain a plurality of subwords; allocating unique identifiers and attention masks to the plurality of subwords to obtain alarm coded text; performing data coding on the alarm coded text by using a preset word embedding model to obtain corresponding low-dimensional vector data; inputting the low-dimensional vector data into the preset alarm recognition model to obtain the alarm type and the threat level corresponding to the security alarm data.

3. The method of claim 2, wherein, Before the step of performing word segmentation on the security alarm data by using the preset word segmenter to obtain a plurality of subwords, the method further comprises: performing data labeling on alarm types and threat levels of historical security alarm data to obtain labeled alarm data, the historical security alarm data being obtained from a current network system; constructing an initial model by using a Transformer architecture; Input the labeled alarm data into the initial model for model training to obtain a model output result; Determine whether the accuracy of the model output result reaches a first preset threshold; If the first preset threshold is not reached, adjust the model parameters and return to execute the step of inputting the labeled alarm data into the initial model for model training until the accuracy reaches the first preset threshold to obtain an alarm recognition model.

4. The method of any one of claims 1 to 3, wherein, The step of determining the comprehensive risk level according to the alarm type and the threat level based on the attack chain information includes: Determine the device assets involved by the alarm type in the current network system; Quantify the importance level of the device assets; According to the importance level and the threat level, the attack chain information is risk judged to obtain a comprehensive risk level.

5. The method of any one of claims 1 to 3, wherein, The step of pre-processing the multi-source heterogeneous data to obtain security alarm data includes: Collecting data from the network side and the terminal side of the current network system through a preset component to obtain multi-source heterogeneous data; Filling in the missing values of the multi-source heterogeneous data to obtain target multi-source data; Using a hash algorithm to remove duplicate data from the target multi-source data to obtain de-duplicated data; Normalizing the de-duplicated data to obtain security alarm data corresponding to the current network system.

6. A safety alert processing apparatus characterized by comprising: The device includes: A preprocessing module for pre-processing multi-source heterogeneous data to obtain security alarm data, the multi-source heterogeneous data being collected from the network side and the terminal side of the current network system; An alarm recognition module for identifying the security alarm data through a preset alarm recognition model to determine the alarm type and the threat level, the alarm recognition model being constructed based on a Transformer architecture; A knowledge graph module for constructing a security knowledge graph through a graph database based on the security alarm data; An attack chain module for performing correlation analysis on the security knowledge graph to obtain attack chain information; A risk judgment module for determining a comprehensive risk level according to the alarm type and the threat level based on the attack chain information; The knowledge graph module is also used to identify information according to the security alarm data, determine the entity type and external threat information contained in the security alarm data, extract the relationship of the security alarm data to determine the mapping relationship between the entity types, start a graph database, import the identified entity types and mapping relationships into a knowledge graph, and construct an initial knowledge graph by taking various entities as nodes and the mapping relationships between the entities as edges. The attack chain module is further configured to: determine a potential attack chain by starting from a security entity and exploring other entities related to the security entity in the security knowledge graph through a depth-first search algorithm; determine relationship weights of different relationships between entity nodes and paths between the entity nodes in the security knowledge graph; accumulate the relationship weights on the paths to obtain an attack chain score of the potential attack chain, wherein the relationship weight of weaponized reconnaissance is higher than that of initial access in the attack chain because it is closer to an actual attack execution stage; and traverse all entity node sequences with calculated attack chain scores, and determine an entity node with a score higher than a second preset threshold as attack chain information.

7. A safety alert processing device, characterized by The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the security alarm processing method according to any one of claims 1 to 5.

8. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the security alarm processing method according to any one of claims 1 to 5.

Images