Network security threat alarm analysis method

Abstract

The invention discloses a network security threat alarm analysis method, and relates to the technical field of network security, and the method comprises the steps: collecting historical threat alarm data, extracting key information, and constructing a time-event-equipment three-dimensional event chain; calculating the similarity of the three-dimensional event chain by adopting a Bhattacharyya distance and a hierarchical matching algorithm, and automatically identifying a high threat cluster in combination with density peak clustering; and constructing a high threat cluster feature template library, calculating the comprehensive matching degree of a real-time three-dimensional event chain and a target cluster by utilizing multi-dimensional matching, and judging whether to give an alarm or not by combining an intra-cluster similarity confidence interval. According to the method, the description accuracy of the threat propagation path and the high threat identification accuracy are improved, and the false alarm and missing alarm rate is reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method for analyzing network security threat alerts. Background Technology

[0002] With the intelligent development of the State Grid's critical information infrastructure, the cybersecurity threats it faces are becoming increasingly complex. Threats such as APT attacks, malicious code propagation, and data tampering exhibit multi-step and cross-device propagation characteristics, posing a serious risk to the stable operation of the power grid. Existing cybersecurity threat alert analysis methods have the following shortcomings: First, most methods only process alarm data for a single dimension (such as time or event type), without integrating time, event, and device three-dimensional information to build a complete event chain, and cannot accurately reflect the propagation path and timing logic of threats across devices; Secondly, the ability to identify high-threat clusters is insufficient, and it is impossible to accurately classify high-threat event clusters through reasonable distance calculation and density analysis, which can easily lead to missed detection of high-risk threats or misjudgment of low-risk events. Third, it does not build dynamic feature templates and similarity confidence intervals based on high-threat clusters, but only relies on a single threshold for judgment, resulting in a high false alarm rate and a high false negative rate, which makes it difficult to meet the power industry's requirements for alarm accuracy and timeliness. Therefore, there is an urgent need for a method for analyzing network security threat alerts. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a network security threat alert analysis method that solves the problems of insufficient event correlation, poor high threat identification, and poor alert determination in existing methods.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a network security threat alert analysis method, comprising: Step 1: Collect historical threat alarm data of State Grid's critical information infrastructure, extract the occurrence time, threat type, affected equipment ID, and alarm level of alarm events, and construct a three-dimensional event chain of time-event-equipment in chronological order; Step 2: Perform structured preprocessing on the 3D event chain. Calculate the time interval similarity and event type similarity between any two 3D event chains using Bach distance and hierarchical matching algorithms respectively. Combine the two and automatically identify high-threat event chain clusters through density peak clustering. Step 3: Construct a feature template library for high-threat clusters, filter out the corresponding target clusters based on the real-time 3D event chain, calculate the similarity between the real-time 3D event chain and the target cluster through multi-dimensional matching, and determine whether the real-time threat needs to be alerted based on the similarity.

[0005] As a further aspect of the present invention, for extracting the occurrence time of alarm events, a timestamp calibration algorithm is selected to improve the timestamp accuracy of alarm events from the second level to the millisecond level; for extracting the threat type, affected device ID, and alarm level of alarm events, a variant BERT model is selected and fine-tuned using a power alarm corpus; the timestamp calibration algorithm is based on GPS timing and device local clock calibration, and the variant BERT model includes the BERT-CRF model, the BERT-CRF-RE2 model, and the BW_BiLSTM_ATTN model.

[0006] As a further aspect of the present invention, the specific steps for constructing a three-dimensional event chain of time-event-device are as follows: Based on the State Grid equipment topology diagram, a device relationship diagram is constructed using Neo4j, and the data flow between devices is clarified; Arrange alarm events for the same device in ascending order based on the refined timestamps; The Dynamic Time Warping (DTW) algorithm is used to calculate the temporal similarity of alarm events from different devices, and cross-device events with a similarity ≥ 0.8 are associated to form a two-dimensional device-event chain. Based on the two-dimensional device-event chain, the timestamp of each event and the time interval between events are marked to ultimately form a three-dimensional event chain.

[0007] As a further aspect of the present invention, calculating the time interval similarity between any two three-dimensional event chains using Bach distance includes: The time interval sequences of the two three-dimensional event chains are considered to follow a Gaussian distribution, according to the formula... Calculate their Bach distance to obtain the time interval similarity. , where p(x) and q(x) are the probability density functions of the two sequences, respectively.

[0008] As a further aspect of the present invention, calculating the event type similarity between any two three-dimensional event chains using a hierarchical matching algorithm includes: A hierarchical tree of power threat event types is constructed, with the root node representing network threats, the first-level child nodes representing core threat categories, and the second-level child nodes representing specific types. The core threat categories include APT attacks, malicious code attacks, abnormal access attacks, vulnerability exploitation attacks, data leakage / tampering attacks, power-specific protocol attacks, equipment abnormal control attacks, and operation and maintenance violation events. For the type sequences of two three-dimensional event chains, calculate the type similarity position by position: If the second-level child nodes are of the same type, the matching degree is 1; if they belong to the same first-level child node, the matching degree is 0.6; if they belong to different first-level child nodes, the matching degree is 0.2. The event type similarity is obtained by taking the arithmetic mean of the similarities at all positions in the sequence.

[0009] As a further aspect of the present invention, the specific steps for automatically identifying high-threat event clusters through density peak clustering are as follows: For the time interval similarity S1 and the event type similarity S2, the inverse of the geometric mean is used to generate the clustering distance Dis, and the specific formula is as follows: Where Dis∈[0,1]; Calculate the Dis distances between all 3D event chains, count the frequency distribution of these Dis distances, calculate the distance between each 3D event chain and other 3D event chains, count the number of neighbors whose distance is less than or equal to Dis, and if the average number of neighbors of all 3D event chains is ∈ [5,10], then use this Dis distance as the cutoff distance dc. For each 3D event chain i, calculate the Dis of other 3D event chains relative to i, count the number of chains with Dis ≤ dc, and use this number as the local density of 3D event chain i. Where dc is the distance threshold; For each 3D event chain i, filter out all local densities. Given a 3D event chain, calculate the distances (Dis) between i and these 3D event chains, and take the minimum value as the distance between i. If i is the 3D event chain with the highest local density, then the maximum Dis among all 3D event chains is set to the value of i. ; Drawing with local density x-axis, y-axis, distance A decision graph with the vertical axis as the y-axis, and pre-defined... and The screening threshold is used to select three-dimensional event chains that simultaneously meet the threshold conditions and determine them as cluster centers for clustering. For a 3D event chain that is not a cluster center, calculate its Dis with all cluster centers, and find the nearest local density. If the cluster center is higher than the cluster center of the three-dimensional event chain, set the cluster label of the three-dimensional event chain to the cluster label of the cluster center. For each cluster, calculate the threat score = (average alarm level of the event chain within the cluster × w1) + (proportion of critical devices involved in the cluster × w2) + (average length of the event chain within the cluster × w3), and mark the clusters with a threat score > Grade as high threat clusters, where w1 + w2 + w3 = 1 and w1 > w2 > w3, and Grade is the threat score threshold.

[0010] As a further aspect of the present invention, the specific steps for constructing the cluster feature template library are as follows: For all three-dimensional event chains within the high-threat cluster, first extract the time interval sequence of each chain, and calculate the mean miu and standard deviation piu of all time interval sequences to form a time feature template; For all three-dimensional event chains within the high-threat cluster, the event types of each chain are sequentially combined into an event type sequence. The sequence is then split using a 3-gram model. The frequency of occurrence of all 3-gram sequences is counted, and the top three sequences with the highest frequency are taken as type feature templates. Based on the device association graph, for each 3D event chain within the cluster, the device types and associations involved are extracted. The Cypher path query statement of Neo4j is used to count the occurrence frequency of all device association paths, and the proportion of each path is calculated. Paths with a proportion of ≥50% are selected as association feature templates.

[0011] As a further aspect of the present invention, the step of selecting the corresponding target cluster is as follows: The event type sequence Re of the real-time 3D event chain is compared with the type feature template Te of each high-threat cluster according to the sequence position. The number of times Re and Te have completely identical event types at the same position is counted, C1. If the lengths of the two are different, only the overlapping positions of the two are judged. Remove the event types that have been matched one by one from Re and Te to obtain the real-time remaining event set Ree and the template remaining event set Tee respectively, and count the number of events with completely identical event types in Ree and Tee, C2; According to the formula Calculate the order fit coefficient Where M is the sequence length of Re and N is the sequence length of Te; According to the formula Calculate the event sequence matching degree Se, and select the high-threat cluster corresponding to the maximum Se value as the corresponding target cluster.

[0012] As a further aspect of the present invention, the specific steps for calculating the comprehensive matching degree are as follows: Calculate the time interval matching degree St: Call the time interval template of the target cluster; calculate the deviation rate between the real-time 3D event chain time interval and miu, specifically using the formula: Deviation rate R = |real-time interval - miu| / miu; If R ≤ (miu / piu), then the time interval matching degree St = 1; If R > (miu / piu), then according to the formula... Calculate the time interval matching degree St; Calculate the device association matching degree Sd: Extract all device types from the target cluster association feature template to form a template device set B={b1,b2,...,bn}; extract all device types from the real-time 3D event chain to form a real-time device set C={c1,c2,...,cm}; calculate the number of intersections K between the two to obtain the device type matching rate Rtype=K / num, where num is the number of elements in B; transform the target cluster association feature template into a device association sequence Bseq=[b1→b2,b2→b3,...,bn-1→bn]; transform the device associations of the real-time 3D event chain into a real-time association sequence Cseq=[c1→c2,c2→c3,...,cm-1→cm]; use the longest common subsequence (LCS) algorithm to find the length L of the completely consistent association segment in Bseq and Cseq, then the association matching degree Rrel=L / (n-1); calculate the device association matching degree Sd according to the formula Sd=Rtype×Rrel. The weights corresponding to the time interval matching degree St, the event sequence matching degree Se, and the device association matching degree Sd are calculated using the entropy weight method, and are wt, we, and wd, respectively. The comprehensive matching degree Sim between the real-time 3D event chain and the corresponding target cluster is calculated using the formula Sim=wt×St+we×Se+wd×Sd.

[0013] As a further aspect of the present invention, the determination of whether a real-time threat requires an alert is based on the comprehensive matching degree (Sim). The specific process is as follows: Find the target cluster corresponding to the real-time 3D event chain, calculate the intra-cluster comprehensive matching degree of all event chains in the target cluster, and take the 95% confidence interval [E,U] to represent the matching degree range of the real threat in the cluster, where E and U are the lower limit and upper limit of the confidence interval, respectively. If the Sim∈[E,U] of the real-time 3D event chain, and the real-time 3D event chain contains ≥2 events, it is determined to be a potential threat associated with the cluster, and an alarm needs to be triggered. If Sim∉[E,U], or the real-time 3D event chain contains only one event, it is determined to be an unrelated threat or a false alarm, and no alarm is triggered.

[0014] This invention provides a method for analyzing network security threat alerts, which has the following advantages compared with existing technologies: (1) This invention constructs a three-dimensional event chain of time-event-device by integrating the occurrence time, threat type, and affected device ID of alarm events, and associates cross-device events with the State Grid equipment topology map and dynamic time warping algorithm to avoid the break in propagation logic caused by single-dimensional processing; (2) This invention uses Bach distance to calculate time interval similarity and hierarchical matching algorithm to calculate event type similarity. It combines geometric mean reciprocal to generate cluster distance, divides event chain clusters by density peak clustering, and constructs a threat scoring mechanism based on alarm level, key equipment correlation, etc. to screen high threat clusters, adapt to the threat characteristics of the power industry, and ensure the accuracy of high threat event cluster identification. (3) This invention constructs a high-threat cluster feature template library, calculates the comprehensive matching degree between the real-time event chain and the target cluster through multi-dimensional matching, and determines the alarm by combining the 95% confidence interval of the matching degree within the cluster and the number of events, thereby avoiding the rigidity of single threshold judgment and realizing accurate identification of potential threats. Attached Figure Description

[0015] Figure 1 This is a flowchart of the steps of the present invention; Figure 2 A flowchart illustrating the steps involved in constructing the cluster feature template library for this invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1 like Figure 1 This invention provides a method for analyzing network security threat alerts, including: Step 1: Collect historical threat alarm data of State Grid's critical information infrastructure, extract the occurrence time, threat type, affected device ID, and alarm level of alarm events, and construct a three-dimensional event chain of time-event-device in chronological order to ensure that each event chain fully covers the threat propagation process of a single device or multiple devices. The State Grid's key information infrastructure includes substation SCADA systems, dispatch center EMS systems, and distribution terminal units (DTUs). The data interfaces of these infrastructures mostly support the OPC UA protocol, which has power industry-specific data encryption and real-time transmission capabilities, avoiding transmission delays and data leaks associated with general acquisition protocols. Meanwhile, ELK distributed log aggregation technology can be used to collect alarm logs (such as equipment anomaly logs and traffic alarm logs) scattered in substations in various provinces and cities into a cloud database, solving the "data silo" problem caused by traditional single-machine collection. To extract the occurrence time of alarm events, a timestamp calibration algorithm is used, such as GPS timing and device local clock calibration, to improve the timestamp accuracy of alarm events from the second level to the millisecond level, avoiding event sequence disorder caused by device clock deviation; To extract the threat type, affected device ID, and alarm level of alarm events, the basic BERT model is not accurate enough in recognizing power industry-specific terms (such as zero-sequence current anomaly and remote control channel interruption). Therefore, a variant BERT model is selected and fine-tuned through a power alarm corpus to improve the recognition accuracy of the above three elements to over 95%. The variant BERT models include the BERT-CRF model, the BERT-CRF-RE2 model, and the BW_BiLSTM_ATTN model; For example, inputting the unstructured alarm text "2024-10-01 10:00:02, a malicious process was detected on the #1 DTU terminal of the 500kV Dongzhou Substation, process ID: 01, alarm level: high risk", the following elements are extracted using a variant BERT model: alarm timestamp (2024-10-01 10:00:02.156), threat type (malicious process), affected device ID (DTU-500KV-DZ-01), and alarm level (high risk); The specific steps for constructing a 3D event chain of time-event-device in chronological order are as follows: Based on the State Grid equipment topology diagram, a device association diagram is constructed using Neo4j, and the data flow between devices is clarified, providing a physical basis for event association; Arrange alarm events for the same device in ascending order according to the refined timestamps. For example, the event sequence for DTU-500KV-DZ-01 is: 10:00:02.156 Malicious process → 10:05:10.234 Data upload anomaly. Power field equipment often suffers from problems such as local clock crystal oscillator deviation and lack of synchronization, resulting in alarm timestamps with deviations of seconds or even minutes. If sorted directly by local time, a time sequence disorder will occur, where "events that occurred after the same device are listed first". The Dynamic Time Warping (DTW) algorithm is used to calculate the temporal similarity of alarm events from different devices, and cross-device events with a similarity ≥ 0.8 are associated to form a two-dimensional device-event chain. Cross-device alarms exhibit time interval fluctuations and non-rigid timing: On the one hand, differences in network latency and processing speed between devices lead to "unfixed time intervals" for cross-device alarms triggered by the same threat; on the other hand, traditional time similarity algorithms are only applicable to time series with fixed intervals, and will misjudge sequences with fluctuating intervals as having low similarity; while the DTW algorithm can dynamically stretch or compress the time axis to align non-rigid time series and tolerate reasonable time interval fluctuations. Based on the device-event two-dimensional chain, the timestamp of each event and the time interval between events are marked to finally form a three-dimensional event chain, such as DTU malicious process (10:00:02) → database permission change (10:00:05, 3-second interval) → dispatch center traffic anomaly (10:00:10, 5-second interval). After obtaining the three-dimensional event chain, its integrity needs to be verified: Threat events in the power sector often follow a propagation path of "terminal intrusion → intermediate system penetration → core dispatch impact". If a node is missing from the propagation path of the event chain, it indicates a break in the process, and the integrity needs to be verified by a closed-loop detection algorithm (based on the power threat propagation model library).

[0018] Step 2: Perform structured preprocessing on the 3D event chain. Calculate the time interval similarity and event type similarity between any two 3D event chains using Bach distance and hierarchical matching algorithms respectively. Combine the two and automatically identify high-threat event chain clusters through density peak clustering. The 3D event chain is preprocessed in a structured manner to extract two core feature sequences, specifically including: Time interval sequence: Extracts the time difference between consecutive events in an event chain into a sequence, such as event chain A: [3000ms(10:00:00→10:00:03), 5000ms(10:00:03→10:00:08)]; For event chains of different lengths, zero-padding is used for alignment, with the padding value being 1.5 times the maximum time interval within the chain, and the time interval sequence is normalized to the [0,1] interval. Event type sequence: extracts the threat types in the event chain into a sequence according to the order of occurrence, such as event chain A: [T1,T2], event chain B: [T1,T3], where T1 = abnormal port access, T2 = permission change, T3 = malicious process; Calculating the time interval similarity between any two 3D event chains using Bhattacharyya distance includes: The time interval sequences of the two three-dimensional event chains are considered to follow a Gaussian distribution, according to the formula... Calculate their Bach distance, where p(x) and q(x) are the probability density functions of the two sequences, respectively; The smaller the distance value, the more similar the two time interval distributions are (higher similarity). The similarity after normalization is... ; The overall distribution characteristics of the Barthel distance time intervals, rather than point-by-point alignment, are more consistent with the characteristics of power threat events: "stable interval patterns but slight fluctuations in specific values." Calculating the event type similarity between any two three-dimensional event chains using a hierarchical matching algorithm includes: Construct a hierarchical tree of power threat event types. The root node is network threats, the first-level sub-nodes are core threat categories, including APT attacks, malicious code attacks, abnormal access attacks, vulnerability exploitation attacks, data leakage / tampering attacks, power-specific protocol attacks, equipment abnormal control attacks, and operation and maintenance violation events. The second-level sub-nodes are specific types, such as port scanning and vulnerability exploitation under APT attacks. For the type sequences of two three-dimensional event chains, calculate the type matching degree position by position: If the second-level child nodes are of the same type, the matching degree is 1; if they belong to the same first-level child node, the matching degree is 0.6; if they belong to different first-level child nodes, the matching degree is 0.2. The event type similarity is obtained by taking the arithmetic mean of the similarities at all positions in the sequence. For example, the type sequence of event chain A is [T1=port scanning (APT type), T2=vulnerability exploitation (APT type)], and the type sequence of event chain B is [T1=port scanning, T3=data theft (APT type)], with a positional matching degree of [1, 0.6], and an overall matching degree of (1+0.6) / 2=0.8; the type sequence of event chain C is [T4=ransomware (malicious code type), T5=file encryption (malicious code type)], and its matching degree with A is (0.2+0.2) / 2=0.2.

[0019] Step 3: Construct a feature template library for high-threat clusters, and filter out the corresponding target clusters based on the real-time 3D event chain. Calculate the comprehensive matching degree between the real-time 3D event chain and the target clusters through multi-dimensional matching. The steps to select the corresponding target cluster are as follows: The event type sequence Re of the real-time 3D event chain is compared with the type feature template Te of each high-threat cluster according to the sequence position. The number of times Re and Te have completely identical event types at the same position is counted, C1. If the lengths of the two are different, only the overlapping positions of the two are judged. Remove the event types that have been matched one by one from Re and Te to obtain the real-time remaining event set Ree and the template remaining event set Tee respectively, and count the number of events with completely identical event types in Ree and Tee, C2; According to the formula Calculate the order fit coefficient Where M is the sequence length of Re and N is the sequence length of Te; According to the formula Calculate the event sequence matching degree Se, where (C1+C2) represents the total type overlap between Re and Te; dividing by N (total template length) ensures that the baseline for type overlap is between [0,1]; multiplying by (Sequence Fit Coefficient) is used to penalize situations where the types overlap but the order is disordered, reflecting the importance of the order of events; Select the high-threat cluster corresponding to the maximum Se value as the corresponding target cluster; The specific steps for calculating the comprehensive matching degree between the real-time 3D event chain and the corresponding target cluster through multi-dimensional matching are as follows: The specific steps to calculate the time interval matching degree St are as follows: Call the time interval template of the target cluster; calculate the deviation rate between the real-time 3D event chain time interval and the miu, the specific formula is: deviation rate R = |real-time interval - miu| / miu; If R≤(miu / piu), then the time interval matching degree St=1; If R > (miu / piu), then according to the formula Calculate the excess value of R relative to (miu / piu), and calculate it according to the ratio of "for every 0.1 of excess value, St decreases by 0.2", and the minimum value of St is 0; The event sequence matching degree Se has already been obtained when selecting the corresponding target cluster as described above; The specific steps to calculate the device association matching degree Sd are as follows: Extract all device types from the target cluster associated feature template to form a template device set B={b1,b2,...,bn}; Extract all device types from the real-time 3D event chain to form a real-time device set C={c1,c2,...,cm}; Calculate the number of intersections K between the two to obtain the device type matching rate Rtype = K / num, where num is the number of elements in B; Transform the target cluster association feature template into a device association sequence Bseq=[b1→b2,b2→b3,...,bn-1→bn]; The device association of the real-time 3D event chain is transformed into a real-time association sequence Cseq=[c1→c2,c2→c3,...,cm-1→cm]; Using the Longest Common Subsequence (LCS) algorithm, the length L of the completely identical associated segments in Bseq and Cseq is found. Then, the association matching degree Rrel = L / (n-1). The device association matching degree Sd is calculated according to the formula Sd=Rtype×Rrel; Based on the three types of feature dispersion of the historical three-dimensional event chain of the target cluster, the weights corresponding to the time interval matching degree St, event sequence matching degree Se, and device association matching degree Sd are calculated by the entropy weight method, which are wt, we, and wd, respectively. The comprehensive matching degree Sim between the real-time 3D event chain and the corresponding target cluster is calculated according to the formula Sim=wt×St+we×Se+wd×Sd. Based on the comprehensive matching score, Sim determines whether a real-time threat requires an alert. The specific process is as follows: Find the target cluster corresponding to the real-time 3D event chain, calculate the intra-cluster comprehensive matching degree of all event chains in the target cluster (i.e., the matching degree of any two 3D event chains in the cluster, calculated in the same way as the above method for calculating the matching degree with the template), and take the 95% confidence interval [E,U] to represent the matching degree range of the real threat in the cluster, where E and U are the lower limit and upper limit of the confidence interval. If the Sim∈[E,U] of the real-time 3D event chain (falls into the confidence interval of the cluster), and the real-time 3D event chain contains ≥2 events (excluding false alarms of a single event), then it is determined to be a potential threat associated with the cluster and an alarm needs to be triggered. If Sim∉[E,U], or the real-time 3D event chain contains only one event, it is determined to be an unrelated threat or a false alarm, and no alarm is triggered.

[0020] Example 2 This embodiment, based on Embodiment 1, further discloses a method for automatically identifying high-threat event clusters through density peak clustering, specifically including: For the time interval similarity S1 and the event type similarity S2, the inverse of the geometric mean is used to generate the clustering distance Dis, and the specific formula is as follows: The smaller the value, the more similar the two three-dimensional event chains are, where Dis∈[0,1]; Calculate the Dis distances between all 3D event chains, count the frequency distribution of these Dis distances, calculate the distance between each 3D event chain and other 3D event chains, count the number of neighbors whose distance is less than or equal to Dis, and if the average number of neighbors of all 3D event chains is ∈ [5,10], then use this Dis distance as the cutoff distance dc. For each 3D event chain i, calculate the Dis of other 3D event chains relative to i, count the number of chains with Dis ≤ dc, and use this number as the local density of 3D event chain i. Where dc is the distance threshold; For each 3D event chain i, filter out all local densities. Given a 3D event chain, calculate the distances (Dis) between i and these 3D event chains, and take the minimum value as the distance between i. If i is the 3D event chain with the highest local density, then the maximum Dis among all 3D event chains is set to the value of i. ; Drawing with local density x-axis, y-axis, distance A decision graph with the vertical axis as the y-axis, and pre-defined... and The screening threshold is used to select three-dimensional event chains that simultaneously meet the threshold conditions and determine them as cluster centers for clustering. For a 3D event chain that is not a cluster center, calculate its Dis with all cluster centers, and find the nearest local density. If the cluster center is higher than the cluster center of the three-dimensional event chain, set the cluster label of the three-dimensional event chain to the cluster label of the cluster center. For each cluster, calculate the threat score = (average alarm level of the event chain within the cluster × w1) + (proportion of critical devices involved in the cluster × w2) + (average length of the event chain within the cluster × w3), and mark the clusters with threat scores > Grade as high threat clusters, where w1 + w2 + w3 = 1 and w1 > w2 > w3, and Grade is the threat score threshold. The alarm levels in the power industry are preset based on the degree of impact of threats on equipment operation and power supply. They are directly related to the immediate harm of the threats, and their weight is set to the highest in order to prioritize anchoring clusters with high harm levels. In the power industry, attacks on critical equipment can directly affect the stable operation of the power grid (e.g., a failure of the dispatch center server may lead to a network-wide dispatch interruption), while the impact of non-critical equipment (e.g., ordinary office terminals) is limited. Setting the weight of this indicator below the alarm level is to highlight whether the threat has touched the core assets of the power grid. The length of the event chain corresponds to the completeness of the attack steps: short chains are mostly single anomalies (such as false alarms, instantaneous attacks), while long chains are mostly organized, multi-step attacks (such as the "scanning → vulnerability exploitation → persistence → data theft" of APT attacks). The threats are more covert and destructive. The weight of this indicator is set to the minimum in order to supplement the judgment blind spots of the first two indicators.

[0021] Example 3 This embodiment, based on Embodiments 1 and 2, further discloses a method for constructing a cluster feature template library, such as... Figure 2 As shown, the specific process is as follows: For all three-dimensional event chains within the high-threat cluster, first extract the time interval sequence of each chain, and calculate the mean miu and standard deviation piu of all time interval sequences to form a time feature template; The mean reflects the typical pattern of event intervals within a cluster, while the standard deviation reflects the range of interval fluctuations. Combining the two can accurately characterize the temporal rhythm of threat propagation. For all three-dimensional event chains within the cluster, the event types of each chain are sequentially combined into an event type sequence, and the sequence is split using a 3-gram model to ensure that it matches the length of the typical attack steps of the three-dimensional event chain. The frequency of occurrence of all 3-gram sequences is counted, and the top 3 sequences with the highest frequency are taken as type feature templates. The N-gram model can accurately capture the sequential relationship of event types. For example, "vulnerability exploitation" must follow "port scanning" rather than be a random combination, which conforms to the step-by-step nature of the attack. Taking the top 3 high-frequency sequences can cover more than 80% of the typical attack paths within the cluster, which avoids feature redundancy and improves the accuracy of subsequent real-time matching. Based on the device association graph, for each 3D event chain within the cluster, the device types and associations involved are extracted. The Cypher path query statement of Neo4j is used to count the occurrence of all device association paths, and the proportion of each path (path occurrence count / total number of 3D event chains within the cluster) is calculated. Paths with a proportion ≥ 50% are selected as association feature templates. Graph path analysis can intuitively present the physical relationships and data flow between devices, ensuring that the extracted relationships conform to the topological logic of power equipment, while the percentage statistics can filter out the mainstream propagation paths within the cluster, avoiding accidental device relationships from interfering with the accuracy of the template.

[0022] Some of the data in the above formulas are numerical calculations with dimensions removed, and the contents not described in detail in this specification are all prior art known to those skilled in the art.

[0023] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A network security threat alert analysis method, characterized by, The application relates to a high-threat event chain cluster automatic identification method based on a three-dimensional event chain, and belongs to the field of power grid security. The application comprises the following steps: Step 1, collecting historical threat alarm data of a key information infrastructure of State Grid, extracting the occurrence time, threat type, affected device ID and alarm level of an alarm event, and constructing a time-event-device three-dimensional event chain in chronological order; Step 2, structurally preprocessing the three-dimensional event chain, calculating the time interval similarity and event type similarity of any two three-dimensional event chains by using the Bhattacharyya distance and hierarchical matching algorithm respectively, combining the two to automatically identify a high-threat event chain cluster by density peak clustering; 2. The network security threat alert analysis method of claim 1, wherein, Step 3, constructing a feature template library of the high-threat cluster, screening out a corresponding target cluster according to a real-time three-dimensional event chain, calculating the similarity of the real-time three-dimensional event chain and the target cluster through multidimensional matching, and judging whether real-time threat needs to be alarmed based on the similarity.

3. The network security threat alert analysis method of claim 1, wherein, For extracting the occurrence time of the alarm event, a timestamp fine calibration algorithm is selected to improve the alarm event timestamp accuracy from the second level to the millisecond level; for extracting the threat type, affected device ID and alarm level of the alarm event, a variant BERT model is selected to fine tune through a power alarm corpus; the timestamp fine calibration algorithm is based on GPS time service and device local clock calibration, and the variant BERT model comprises a BERT-CRF model, a BERT-CRF-RE2 model and a BW_BiLSTM_ATTN model. The specific operation steps for constructing the time-event-device three-dimensional event chain are as follows: Based on a State Grid device topology graph, a device correlation graph is constructed through Neo4j, and the data flow direction between devices is determined; Alarm events of the same device are arranged in ascending order according to the fine-calibrated timestamp; The time similarity of different device alarm events is calculated by using a dynamic time warping (DTW) algorithm, cross-device events with a similarity greater than or equal to 0.8 are associated, and a device-event two-dimensional chain is formed; 4. The network security threat alert analysis method of claim 1, wherein, On the basis of the device-event two-dimensional chain, the timestamp of each event and the time interval between events are labeled, and finally a three-dimensional event chain is formed. The time interval sequences of the two three-dimensional event chains are regarded as Gaussian distribution, and the Bhattacharyya distance is calculated according to the formula The time interval similarity is where p(x) and q(x) are the probability density functions of the two sequences respectively.

5. The method of claim 1, wherein, The time interval similarity of any two three-dimensional event chains is calculated by using the Bhattacharyya distance, which comprises the following steps: The event type similarity of any two three-dimensional event chains is calculated by using a hierarchical matching algorithm, which comprises the following steps: A power threat event type hierarchical tree is constructed, the root node is a network threat, the first-level child nodes are core threat categories, the second-level child nodes are specific types, the core threat categories comprise APT attacks, malicious code attacks, abnormal access attacks, vulnerability exploitation attacks, data leakage / corruption attacks, power special protocol attacks, device abnormal control attacks and operation and maintenance violation operation events; The type similarity of the two three-dimensional event chains is calculated position by position, which comprises the following steps: If the types of the second-level child nodes are completely the same, the matching degree is 1; if the types belong to the same first-level child node, the matching degree is 0.6; if the types belong to different first-level child nodes, the matching degree is 0.2; 6. The method of claim 1, wherein, The arithmetic mean value of all position similarities in the sequence is calculated to obtain the event type similarity. The specific steps for automatically identifying a high-threat event chain cluster by density peak clustering are as follows: The geometric mean reciprocal is used for the time interval similarity S1 and the event type similarity S2 to generate the clustering distance Dis, and the specific formula is wherein Dis∈[0,1]. Calculate Dis between all three-dimensional event chains, count the frequency distribution of these Dis, calculate the distance of each three-dimensional event chain from other three-dimensional event chains, count the number of neighbors with distance ≤ Dis, if the average number of neighbors of all three-dimensional event chains ∈ [5, 10], then the Dis is taken as the cut-off distance dc; For each three-dimensional event chain i, calculate Dis of other three-dimensional event chains and i, count the number of Dis≤dc, and take the number as the local density of the three-dimensional event chain i wherein dc is a distance threshold value; For each three-dimensional event chain i, all local density three-dimensional event chains are filtered out, Dis of i and these three-dimensional event chains are calculated, and the minimum value is taken as the distance of i ; if i is the three-dimensional event chain with the maximum local density, the maximum Dis between all three-dimensional event chains is taken as the distance of i ; Draw a decision graph with local density as the horizontal axis and distance as the vertical axis, and preset the screening threshold of and Draw a decision graph with local density as the horizontal axis and distance as the vertical axis, and preset the screening threshold of and Draw a decision graph with local density as the horizontal axis and distance as the vertical axis, and preset the screening threshold of and Draw a decision graph with local density as the horizontal axis and distance as the vertical axis, and preset the screening threshold of and Draw a decision graph with local density as the horizontal axis and distance as the vertical axis, and preset the screening threshold of and For non-cluster center three-dimensional event chain, calculate its Dis with all cluster centers, find the nearest and local density higher than the cluster center of the three-dimensional event chain, set the cluster label of the three-dimensional event chain to the cluster label to which the cluster center belongs; Calculate the threat score of each cluster = (average alarm level of event chains in the cluster × w1) + (proportion of key equipment involved in the cluster × w2) + (average length of event chains in the cluster × w3), and mark the cluster with threat score > Grade as a high-threat cluster, wherein w1+w2+w3=1 and w1>w2>w3, and Grade is the threat score threshold.

7. The network security threat alert analysis method of claim 1, wherein, The specific operation steps of constructing the cluster feature template library are: For all three-dimensional event chains in the high-threat cluster, first extract the time interval sequence of each chain, and calculate the mean miu and standard deviation piu of all time interval sequences to form a time feature template; For all three-dimensional event chains in the high-threat cluster, combine the event types of each chain in order to form an event type sequence, and use a 3-gram model to split the sequence, count the occurrence frequency of all 3-gram sequences, and take the top 3 sequences with the highest frequency as the type feature template; Based on the device association graph, for each three-dimensional event chain in the cluster, extract the device types and associations involved, use the Cypher path query statement of Neo4j to count the number of occurrences of all device association paths, and calculate the proportion of each path, select the path with a proportion ≥ 50% as the association feature template.

8. The network security threat alert analysis method of claim 1, wherein, The steps of screening the corresponding target cluster are: Compare the event type sequence Re of the real-time three-dimensional event chain with the type feature template Te of each high-threat cluster one by one according to the sequence position, count the number C1 of event types that are completely consistent at the same position, and if the lengths of the two are not consistent, only the overlapping positions are determined; Eliminate the event types that have been matched bit by bit from Re and Te, respectively, to obtain the real-time remaining event set Ree and the template remaining event set Tee, and count the number C2 of event types that are completely consistent in Ree and Tee; According to the formula The sequential fitting coefficient is calculated Wherein, M is the sequence length of Re, and N is the sequence length of Te. According to the formula The event sequence matching degree Se is calculated, and a high threat cluster corresponding to the maximum Se value is selected as the corresponding target cluster.

9. The method of claim 8, wherein, The specific steps of calculating the comprehensive matching degree are: Computing time interval matching degree St: calling time interval template of target cluster; computing deviation rate of real-time three-dimensional event chain time interval and miu, specific formula is: deviation rate R = |real-time time interval-miu| / miu; if R≤(miu / piu), then time interval matching degree St=1; if R>(miu / piu), then according to formula Computing time interval matching degree St; The device association matching degree Sd: extract all device types in the target cluster association feature template to form a template device set B={b1, b2,..., bn}; extract all device types in the real-time three-dimensional event chain to form a real-time device set C={c1, c2,..., cm}; calculate the intersection number K, and obtain the device type matching rate Rtype=K / num, wherein num is the number of elements in B; convert the target cluster association feature template into a device association sequence Bseq=[b1→b2, b2→b3,..., bn-1→bn]; convert the device association of the real-time three-dimensional event chain into a real-time association sequence Cseq=[c1→c2, c2→c3,..., cm-1→cm]; use the longest common subsequence LCS algorithm to find the length L of the completely consistent association fragment in Bseq and Cseq, and then the association matching degree Rrel=L / (n-1); and calculate the device association matching degree Sd according to the formula Sd=Rtype×Rrel. The weights of the time interval matching degree St, the event order matching degree Se, and the device association matching degree Sd are calculated by using the entropy weight method, and are wt, we, and wd, respectively. The comprehensive matching degree Sim of the real-time three-dimensional event chain and the corresponding target cluster is calculated according to the formula Sim=wt×St+we×Se+wd×Sd.

10. The method of claim 9, wherein, The real-time threat is determined whether to alarm according to the comprehensive matching degree Sim, and the specific process is as follows: Find the target cluster corresponding to the real-time three-dimensional event chain, calculate the intra-cluster comprehensive matching degree of all event chains in the target cluster, and take the 95% confidence interval [E, U], which represents the matching degree range of the real threat in the cluster, wherein E and U are the lower limit and the upper limit of the confidence interval, respectively. If Sim of the real-time three-dimensional event chain is in [E, U], and the real-time three-dimensional event chain contains ≥2 events, it is determined as a potential threat associated with the cluster, and an alarm is triggered. If Sim is not in [E, U], or the real-time three-dimensional event chain contains only 1 event, it is determined as a non-associated threat or a false alarm, and no alarm is triggered.

Images