Warning log marking method and device, program product and electronic equipment

Abstract

The invention discloses an alarm log marking method and device, a program product and electronic equipment, and relates to the technical field of network security, and the method comprises the steps: determining a first label of a target log based on M log fields obtained through the hierarchical analysis of the target log, the first label represents an attack strategy / attack technology for performing security attacks on each network security device; based on the target log and the first tag, determining a second tag of the target log, the second tag representing an association relationship between entities in the target log; based on the target log, the first tag and the second tag, determining a third tag of the target log, the third tag representing attack information of security attacks on each network security device; and based on the first label, the second label and the third label of the target log, a marking result of the target log is determined. The technical problem of low accuracy of marking the alarm log based on the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a method and device for marking alarm logs, a program product and an electronic device. BACKGROUND

[0002] In the process of network security operation, it is necessary to analyze the massive alarm logs generated by security devices and information systems to obtain labels representing the attack nature / technology / intention of the alarm events corresponding to the alarm logs. At present, the mainstream automated marking method mainly relies on a method based on traditional machine learning. The effect of this method is limited by the quality of manual feature engineering, and deep domain knowledge is needed to design and select features. The model has insufficient generalization ability. In addition, the output of the model is usually a simple classification conclusion (such as "malicious" or "benign"), which lacks explanation of the basis for the determination and has insufficient interpretability, which is not conducive to the decision-making of security analysts. In addition, for unstructured text data (such as operation instructions and domain names) in the logs, traditional models are difficult to deeply understand the semantic information.

[0003] In view of the low accuracy of marking alarm logs based on the prior art, no effective solution has been proposed. SUMMARY

[0004] The present application provides a method and device for marking alarm logs, a program product and an electronic device to at least solve the technical problem of low accuracy of marking alarm logs based on the prior art.

[0005] According to one aspect of the present application, a method for marking alarm logs is provided, comprising: performing hierarchical analysis on a target log to obtain M log fields, wherein the target log is used to record alarm events corresponding to L network security devices, L and M are both positive integers, and the M log fields are used to represent event information of the alarm events; determining a first label of the target log based on the M log fields, wherein the first label is used to represent an attack strategy / attack technology for performing a security attack on each network security device; determining a second label of the target log based on the target log and the first label, wherein the second label is used to represent an association relationship between entities in the target log; determining a third label of the target log based on the target log, the first label and the second label, wherein the third label is used to at least represent an attack score, an attack type, a vulnerability type, an attack device identifier and a defense measure for performing a security attack on each network security device; and determining a marking result of the target log based on the first label, the second label and the third label of the target log.

[0006] Optionally, before the target log is hierarchically parsed to obtain M log fields, the marking method of the alarm log further includes: collecting original alarm logs corresponding to L network security devices, wherein the original alarm logs include event data corresponding to structured alarm events and unstructured payload data; performing data cleaning on the original alarm logs to obtain first alarm logs, wherein the data cleaning is at least used to remove duplicate data and blank data in the original alarm logs; performing standardization processing on the first alarm logs to obtain the target log, wherein the standardization processing is at least used to unify the data format and the timestamp format of the first alarm logs.

[0007] Optionally, the hierarchical parsing of the target log to obtain M log fields includes: performing a first parsing operation on the target log to obtain a general field, wherein the general field is at least used to represent the occurrence time of an alarm event, a processing result, and a network address, a port number, and a protocol type of a network security device; performing a second parsing operation on the target log based on a log type to obtain a special field, wherein the special field is one of the following: a first special field, at least used to represent a session duration, a data transmission amount, and a TCP flag bit of a network flow log; a second special field, at least used to represent a username, an authentication method, and a login result of an identity authentication log; a third special field, at least used to represent a process identifier, a command line parameter, and a file path of a system operation log; and the general field and the special field of the target log are taken as the M log fields.

[0008] Optionally, based on the M log fields, the first label of the target log is determined by: based on the M log fields, performing rule matching in a preset rule library to obtain a preset rule matched by the target log; detecting a similarity between each log field in the M log fields and each preset label corresponding to the matched preset rule; and in a case where the similarity is greater than or equal to a preset similarity threshold, taking the preset label corresponding to the similarity as the first label of the target log.

[0009] Optionally, the second label of the target log is determined based on the target log and the first label, including: determining P entities based on the target log, wherein an entity type of each entity is one of the following: host asset, network device, user account, and alarm event; determining all association relationships between the P entities based on the target log and the first label, wherein a relationship type of each association relationship is one of the following: network connection, permission granting, data access, and event triggering; creating a target knowledge graph based on the P entities and all association relationships between the P entities, performing entity analysis on the target knowledge graph to obtain an entity feature of each entity, wherein the target knowledge graph is stored in a time sequence graph database; performing multi-hop query on the target knowledge graph based on the entity feature of each entity to obtain Q attack paths, wherein Q is a positive integer, and an attack type of each attack path is one of the following: horizontal movement path and data leakage channel; performing community discovery operation on a subgraph to which each attack path in the target knowledge graph belongs to obtain the second label of the target log, wherein the community discovery operation is used to detect the attack type of each attack path.

[0010] Optionally, the third label of the target log is determined based on the target log, the first label, and the second label, including: performing feature extraction on payload data in the target log to obtain a data feature, and determining a data label corresponding to the payload data based on the data feature, wherein the data feature is used to represent at least an entropy value of the payload data; in a case where the data label is a preset label, performing replay attack test on the payload data based on a preset sandbox environment to obtain a test label, wherein the preset label is used to represent that there is security attack information in the payload data, and the test label is used to represent actual behavior information of the payload data; and in a case where the test label is consistent with the data label, determining the third label of the target log based on the data label, the first label, and the second label.

[0011] Optionally, the labeling result of the target log is determined based on the first label, the second label, and the third label of the target log, including: obtaining label weights corresponding to the first label, the second label, and the third label, wherein the label weights are used to represent confidence degrees of each of the three labels; and performing weighted fusion on the first label, the second label, and the third label based on the confidence degrees of each of the three labels to obtain the labeling result of the target log.

[0012] According to another aspect of this application, a tagging device for alarm logs is also provided, comprising: a hierarchical parsing unit, used to perform hierarchical parsing on a target log to obtain M log fields, wherein the target log is used to record alarm events corresponding to L network security devices, where L and M are both positive integers, and the M log fields are used to characterize the event information of the alarm events; a first label determination unit, used to determine a first label of the target log based on the M log fields, wherein the first label is used to characterize the attack strategy / attack technique for security attacks on each network security device; a second label determination unit, used to determine a second label of the target log based on the target log and the first label, wherein the second label is used to characterize the association relationship between entities in the target log; a third label determination unit, used to determine a third label of the target log based on the target log, the first label, and the second label, wherein the third label is used to characterize at least the attack score, attack type, vulnerability type, attack device identifier, and defense measures for security attacks on each network security device; and a tagging result determination unit, used to determine the tagging result of the target log based on the first label, the second label, and the third label of the target log.

[0013] According to another aspect of this application, a computer program product is also provided, which stores a computer program, wherein the method for tagging alarm logs that controls the computer program product to execute any of the above-mentioned methods when the computer program is running is provided.

[0014] According to another aspect of this application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the alarm log tagging method of any of the above.

[0015] In this application, the target log is first parsed hierarchically to obtain M log fields. The target log records alarm events corresponding to L network security devices, where L and M are both positive integers. The M log fields represent the event information of the alarm events. Then, based on the M log fields, this application determines the first label of the target log, which represents the attack strategy / attack technique for each network security device. Next, based on the target log and the first label, this application determines the second label of the target log, which represents the relationship between entities in the target log. Subsequently, based on the target log, the first label, and the second label, this application determines the third label of the target log, which represents at least the attack score, attack type, vulnerability type, attack device identifier, and defense measures for each network security device. Finally, based on the first, second, and third labels of the target log, this application determines the labeling result of the target log.

[0016] As described above, this application employs a layered parsing approach. By extracting and analyzing multiple fields of the target log, it identifies a first label describing the attack strategy and techniques, achieving preliminary identification of complex attack methods. Next, through in-depth analysis of the target log and the first label, it identifies a second label reflecting the relationships between entities, thus enabling cross-login attack chain correlation analysis and identification of context-dependent threats. Finally, by combining the target log, the first label, and the second label, this application generates a third label containing attack scores, types, vulnerability information, and defense recommendations. This enriches the labeling results and enhances decision support capabilities, achieving in-depth and multi-dimensional evaluation of alarm events. It addresses the technical shortcomings of existing technologies, such as low coverage of labeling results due to labeling based solely on preset rules in the rule base, and poor interpretability of labeling results due to labeling based on traditional machine learning models. This, in turn, solves the technical problem of low accuracy in labeling alarm logs using existing technologies. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a flowchart of an optional alarm log tagging method according to an embodiment of this application;

[0019] Figure 2 This is a flowchart of an optional automated tagging method for alarm events and logs according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of an optional alarm log marking device according to an embodiment of this application;

[0021] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] It should also be noted that all information and data (including but not limited to information used for display and analysis) involved in this application are authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and the relevant user or organization, before obtaining the relevant information, it is necessary to send a request to the aforementioned user or organization through the interface, and obtain the relevant information only after receiving consent from the aforementioned user or organization.

[0025] Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of relevant information and data involved in this application all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary confidentiality measures have been taken. This application does not violate public order and good morals. In addition, this application provides a corresponding operation entry point for users to choose to agree to or refuse authorization. If the user chooses to refuse authorization, the corresponding expert decision-making process will be initiated.

[0026] The present invention will now be described in detail with reference to various embodiments.

[0027] Example 1

[0028] According to an embodiment of this application, an embodiment of a method for tagging alarm logs is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] This application provides an alarm log tagging system (hereinafter referred to as the tagging system) for executing the alarm log tagging method in this application. Figure 1 This is a flowchart of an optional alarm log tagging method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Perform layered parsing on the target log to obtain M log fields. The target log is used to record alarm events corresponding to L network security devices, where L and M are both positive integers. The M log fields are used to represent the event information of the alarm events.

[0031] Optionally, target logs refer to heterogeneous logs originating from different network security devices, servers, and application systems.

[0032] Optionally, the M log fields include at least general fields obtained by general parsing the target log, and special fields obtained by parsing the target log based on the log type.

[0033] Optionally, the general fields are used to characterize at least the time of occurrence and processing result of the alarm event, as well as the network address, port number, and protocol type of the network security device.

[0034] Optionally, the special field is one of the following:

[0035] The first dedicated field is used to characterize at least the session duration, data transmission volume, and TCP flags in the network traffic log;

[0036] The second dedicated field is used at least to represent the username, authentication method, and login result of the identity authentication log;

[0037] The third special field is used to identify at least the process identifier, command-line arguments, and file path of the system operation log.

[0038] Optionally, the tagging system performs layered parsing of the target logs to obtain M log fields, which have the following functions:

[0039] (1) Refined information extraction: Layered parsing can extract key information from logs more comprehensively and accurately, providing a richer data foundation for subsequent analysis.

[0040] (2) Standardized fields: Extracting M log fields helps to transform heterogeneous alarm event information into a consistent and comparable format, which facilitates subsequent automated processing and analysis.

[0041] Step S102: Based on M log fields, determine the first label of the target log, where the first label is used to characterize the attack strategy / attack technique for launching a security attack on each network security device.

[0042] Optionally, the first label refers to a label used to describe the nature, strategy, or technique of a security attack, such as mapping the attack to tactics and techniques within the ATT&CK (Adversarial Tactics, Techniques & Common Knowledge, a framework for describing network attack strategies, techniques, and processes).

[0043] Optionally, the marking system, by determining the first label, has the following functions:

[0044] (1) Standardized attack description: The first tag provides a standardized description of the attack event, which makes it easier for the security team to understand and identify the attack methods and improve the efficiency and accuracy of threat analysis.

[0045] (2) Attack technique coverage: By matching M log fields with a predefined attack strategy database, it is possible to identify known and some unknown attack techniques, thereby improving the ability to respond to new threats.

[0046] Step S103: Based on the target log and the first tag, determine the second tag of the target log, wherein the second tag is used to characterize the association relationship between entities in the target log.

[0047] Optionally, the second label is used to describe the relationships between entities in the log, such as the relationships between host assets, network devices, and user accounts.

[0048] Optionally, the marking system, by determining the second label, has the following functions:

[0049] (1) Association analysis: The second label helps analysts discover the full picture of the attack and potential lateral movement paths by identifying the associations between entities, thus improving their understanding of complex network attacks.

[0050] (2) Context-dependent analysis: Through the second tag, it is possible to analyze based on rich context information and identify threat patterns that are difficult to discover based on a single event.

[0051] Step S104: Based on the target log, the first tag, and the second tag, determine the third tag of the target log. The third tag is used to characterize at least the attack score, attack type, vulnerability type, attack device identifier, and defense measures for each network security device.

[0052] Optionally, it includes a detailed description of the alert event, such as attack score (probability of malice), attack type, associated vulnerability information, attack tool traces, and defense measure recommendations.

[0053] Optionally, the marking system, by determining the third label, has the following functions:

[0054] (1) Decision support: The third tag provides detailed threat intelligence, including the severity of the attack, the specific type, and possible defense strategies, providing a basis for the security team to respond quickly.

[0055] (2) Semantic richness: Through comprehensive analysis, the third tag can gain a deeper understanding of the semantic information of the log and improve the ability to parse unstructured text data.

[0056] Step S105: Determine the tagging result of the target log based on the first tag, second tag, and third tag of the target log.

[0057] Optionally, the tagging system determines the tagging results of the target log based on the first tag, the second tag, and the third tag. The tagging results include a comprehensive description of the nature, relevance, and threat level of the alarm event, providing a comprehensive assessment of the alarm events in the target log from multiple angles and levels. Furthermore, the tagging system automatically outputs the tagging results, automating the entire tagging process and reducing the time and cost of manual analysis. In addition, the richness and accuracy of the tagging results provide high-quality support for security decision-making, helping technical personnel to quickly identify and respond to threat events.

[0058] As described above, this application employs a layered parsing approach. By extracting and analyzing multiple fields of the target log, it identifies a first label describing the attack strategy and techniques, achieving preliminary identification of complex attack methods. Next, through in-depth analysis of the target log and the first label, it identifies a second label reflecting the relationships between entities, thus enabling cross-login attack chain correlation analysis and identification of context-dependent threats. Finally, by combining the target log, the first label, and the second label, this application generates a third label containing attack scores, types, vulnerability information, and defense recommendations. This enriches the labeling results and enhances decision support capabilities, achieving in-depth and multi-dimensional evaluation of alarm events. It addresses the technical shortcomings of existing technologies, such as low coverage of labeling results due to labeling based solely on preset rules in the rule base, and poor interpretability of labeling results due to labeling based on traditional machine learning models. This, in turn, solves the technical problem of low accuracy in labeling alarm logs using existing technologies.

[0059] In one optional embodiment, before performing hierarchical parsing on the target log to obtain M log fields, the tagging system first collects raw alarm logs corresponding to L network security devices. The raw alarm logs include structured event data corresponding to alarm events and unstructured payload data. Then, the tagging system performs data cleaning on the raw alarm logs to obtain a first alarm log. The data cleaning is used at least to remove duplicate and blank data from the raw alarm logs. Then, the tagging system performs standardization processing on the first alarm log to obtain the target log. The standardization processing is used at least to unify the data format and timestamp format of the first alarm log.

[0060] Optionally, the labeling system directly collects alarm logs from multiple source devices, ensuring the comprehensiveness of the security analysis coverage data and the diversity of the analysis data, providing raw data support for subsequent in-depth analysis.

[0061] Optionally, the labeling system can remove or correct redundant or irrelevant information in the original alarm logs by performing data cleaning, including duplicate data and blank data. Duplicate data refers to the same or similar records that appear multiple times in the dataset, which may be caused by misconfiguration of the device or communication failure. Blank data refers to records in the logs that are missing or have not filled in key fields, which will affect the accuracy of subsequent labeling results.

[0062] Optionally, the tagging system cleans the original alarm logs, eliminating redundancy and errors, thus improving the overall quality and analyzability of the alarm log data. At the same time, by removing duplicate and blank data, it reduces the computational burden of subsequent processing steps, thereby improving the system's processing efficiency and response speed.

[0063] Optionally, the tagging system standardizes the first alarm log to obtain a target log with a unified data format, which has the following functions:

[0064] (1) Compatibility and comparability: Standardized processing ensures that log data from different devices are compatible with each other, which facilitates comparison and correlation analysis and improves the efficiency of alarm event analysis.

[0065] (2) Time sequence analysis capability: The unified timestamp format supports accurate time sequence analysis, which helps to track the timeline of attack events and discover the order of attacks and possible attack chains.

[0066] (3) Preparation for automated processing: The standardized target log format is uniform, which facilitates subsequent automated processing and analysis and reduces the programming complexity caused by differences in data format.

[0067] In summary, through the steps described in the above embodiments, the tagging system ensures the quality and consistency of alarm log data throughout the entire process, from the collection of raw data to preprocessing and standardization. This lays a solid foundation for subsequent automated tagging and in-depth security analysis. This processing method improves the efficiency of data analysis, reduces false alarms and false negatives, and enhances the overall effectiveness of security operations.

[0068] In one optional embodiment, during the hierarchical parsing of the target log, the tagging system first performs a first parsing operation on the target log to obtain general fields. These general fields are used to characterize at least the occurrence time and processing result of the alarm event, as well as the network address, port number, and protocol type of the network security device. Then, based on the log type, the tagging system performs a second parsing operation on the target log to obtain special fields. Finally, the tagging system uses the general fields and special fields corresponding to the target log as M log fields.

[0069] Optionally, the special field is one of the following:

[0070] The first dedicated field is used to characterize at least the session duration, data transmission volume, and TCP flags in the network traffic log;

[0071] The second dedicated field is used at least to represent the username, authentication method, and login result of the identity authentication log;

[0072] The third special field is used to identify at least the process identifier, command-line arguments, and file path of the system operation log.

[0073] Optionally, the first parsing operation refers to the preliminary parsing of the target log, which aims to extract common information from multi-source alarm logs to determine common fields, including but not limited to the time of occurrence (timestamp) of the alarm event, the processing result, and the network address, port number, and protocol type corresponding to the network security device.

[0074] Optionally, the tagging system obtains a general field by performing the first parsing operation. This field provides basic time and source information of the event, which is key metadata in the alarm log and can be used to quickly locate and initially understand the alarm event.

[0075] Optionally, the second parsing operation is a deeper parsing of the target log based on the log type. It aims to extract detailed information from specific logs according to their type (network traffic, authentication, system operations, etc.). Depending on the log type, the second parsing operation will extract different detailed information, for example:

[0076] The first dedicated field, derived from network traffic logs, includes session duration, data transmission volume, and TCP flags. This information helps the tagging system understand the characteristics of network communication.

[0077] The second dedicated field, derived from the identity authentication log, includes the username, the authentication method used, and the login result. These fields support the tagging system in performing identity security verification on users.

[0078] The third special field, derived from the system operation log, includes process identifiers, command-line arguments, and file paths, thereby helping the tagging system reveal details of internal system operations.

[0079] Optionally, the tagging system obtains specialized fields by performing a second parsing operation, enabling the system to perform in-depth analysis based on the specific type of log, identifying specific details of the event, such as the transmission characteristics of network attacks, the reasons for authentication failures, and abnormal behavior of system operations. By extracting specialized fields related to specific log types, the system can more accurately identify and classify alarm events, improving its ability to identify different types of threats. Furthermore, the specialized fields provide the security team with more detailed event context, helping to understand the full picture of the event and make more accurate threat assessments and response decisions.

[0080] Optionally, the tagging system uses the general and special fields corresponding to the target log as M log fields, achieving comprehensive coverage of field information: the M log fields contain general information and specific type information of the event, enabling the tagging system to have a comprehensive and in-depth understanding of the alarm event.

[0081] In summary, the tagging system extracts general fields through the first parsing operation and obtains specific fields through the second parsing operation, and then integrates them into M log fields. This process enables in-depth and detailed analysis of alarm logs, ensuring that the system can accurately identify, understand and respond to various alarm events. This layered parsing method not only improves the efficiency of data processing, but also enhances the pertinence and accuracy of security analysis.

[0082] In one optional embodiment, in order to determine the first label of the target log, the labeling system first performs rule matching in a preset rule base based on M log fields to obtain preset rules that match the target log. Then, the labeling system detects the similarity between each log field in the M log fields and each preset label corresponding to the matching preset rule. Then, if the similarity is greater than or equal to a preset similarity threshold, the labeling system takes the preset label corresponding to the similarity as the first label of the target log.

[0083] Optionally, the preset rule base refers to a set of rules compiled based on known attack patterns, used to guide the tagging system in log analysis and threat identification. Each preset tag corresponding to a preset rule is used to describe the attack strategy, technique or intent represented by the alarm event that matches the preset rule.

[0084] Optionally, by matching M log fields with rules in a preset rule base, the tagging system can complete a large amount of log analysis in a short time, quickly identify anticipated threat patterns, and speed up the tagging system's processing speed for alarm events.

[0085] Optionally, if the similarity is greater than or equal to a preset similarity threshold, the labeling system uses the preset label corresponding to that similarity as the first label of the target log. This step has the following effect:

[0086] (1) Standardized threat description: The first tag is based on a preset rule base and provides a standardized description of threats, enabling security teams to quickly understand and locate problems, and also facilitating the sharing of threat intelligence with other systems.

[0087] (2) Initial screening function: By setting a similarity threshold, the labeling system can automatically filter out most of the irrelevant or obviously mismatched alarms, reducing the workload of security analysts.

[0088] (3) Improve processing speed: The preset rule base is built in advance based on historical data and expert experience. This means that the tagging system can directly use the accumulated knowledge to identify threats. The tagging system does not need to learn from scratch, thereby improving the processing speed of the tagging system for alarm events.

[0089] In summary, the tagging system, through rule matching and similarity detection based on M log fields, not only improves the speed and accuracy of threat identification, but also ensures the standardization and interpretability of alarm event tagging.

[0090] In an optional embodiment, to determine the second label of the target log, the labeling system first identifies P entities based on the target log, where each entity's entity type is one of the following: host asset, network device, user account, alarm event. Then, based on the target log and the first label, the labeling system determines all relationships between the P entities, where each relationship's relationship type is one of the following: network connection, permission granting, data access, event triggering. Next, based on the P entities and all relationships between them, the labeling system creates a target knowledge graph, performs entity parsing on the target knowledge graph to obtain the entity features of each entity, where the target knowledge graph is stored using a time-series graph database. Subsequently, based on the entity features of each entity, the labeling system performs multi-hop queries on the target knowledge graph to obtain Q attack paths, where Q is a positive integer, and each attack path's attack type is one of the following: lateral movement path, data leakage channel. Finally, the labeling system performs community detection on the subgraph to which each attack path belongs in the target knowledge graph to obtain the second label of the target log, where the community detection operation is used to detect the attack type of each attack path.

[0091] Optionally, P entities, all key objects identified from the target logs, including but not limited to host assets, network devices, user accounts, and security events themselves, constitute nodes in the knowledge graph.

[0092] Optionally, the existence of relationships between the P entities includes, but is not limited to, network connections, permission granting, data access, event triggering, etc., and these relationships form the edges in the knowledge graph.

[0093] Optionally, by constructing a target knowledge graph and performing entity parsing, the tagging system can deeply analyze the complex relationships between entities and discover hidden threats that are difficult to reveal in a single log. Subsequently, the tagging system performs entity parsing on the target knowledge graph to obtain the entity features of each entity, thereby transforming the various attributes and features of the entity into node attributes in the graph, so as to better understand and analyze the role and impact of the entity.

[0094] Optionally, multi-hop query refers to the tagging system exploring the relationships between entities in the graph in depth, which can discover indirect connections that are many steps away, thereby identifying complex attack paths. Multi-hop query technology makes attack paths visible, which makes it easier for security analysts to intuitively understand the progress of the attack and the possible scope of impact, and improves the efficiency of threat tracking.

[0095] Optionally, community discovery operations refer to the tagging system finding and separating closely connected clusters of entities in the network graph. These clusters represent specific attack patterns (such as lateral movement or data leakage) or communities of cyber threats, helping security analysts focus on key threats.

[0096] Optionally, the target knowledge graph is stored in a time-series graph database, which allows the tagging system to track changes in entities and relationships over time. This enables the system to understand the development of attack techniques and predict future attack trends. Furthermore, the structure of the graph database is well-suited for multi-hop queries and community discovery, thereby enhancing the system's ability to process large-scale network data.

[0097] In summary, the tagging system achieves in-depth correlation analysis of network security alerts by constructing and analyzing target knowledge graphs. This mechanism can not only identify direct attack activities, but also uncover potential and complex threat patterns, thereby providing security teams with more comprehensive and refined threat intelligence.

[0098] In one optional embodiment, in order to determine the third label of the target log, the labeling system first extracts features from the payload data in the target log to obtain data features. Based on the data features, it determines the data label corresponding to the payload data. The data features are used to characterize at least the entropy value of the payload data. Then, if the data label is a preset label, the labeling system performs a replay attack test on the payload data in a preset sandbox environment to obtain a test label. The preset label is used to characterize the presence of security attack information in the payload data, and the test label is used to characterize the actual behavior information of the payload data. Then, if the test label and the data label are consistent, the labeling system determines the third label of the target log based on the data label, the first label, and the second label.

[0099] Optionally, the tagging system can use the target model to extract features from the payload data in the target log to obtain data features. Based on the data features, the system can determine the data labels corresponding to the payload data. The target model refers to a large language model (LLM) trained on historical alarm log data from L network security devices. The large language model can deeply understand the semantic information in the payload data, not only identifying explicit attack commands but also capturing hidden malicious attacks, thereby improving the accuracy and detailed description of threat detection.

[0100] Optionally, payload data, the valid data carried in network traffic, which may be malicious code, commands, or packet content from attackers, is a key object in security analysis.

[0101] Optionally, data features, such as entropy values, are information extracted from the features of the payload data to quantify the randomness and complexity of the data. Entropy analysis in the data features can help identify encrypted or obfuscated attack code and detect potential threats even when the payload data is deliberately obscured.

[0102] Optionally, data labels refer to labels automatically assigned by the target model based on data characteristics to describe the nature of the payload data, such as whether malicious attack information may exist.

[0103] Optionally, a pre-set sandbox environment refers to an isolated virtual testing environment used to securely replay and observe the behavior of payload data to verify its actual effect without affecting the real business system. By using the sandbox environment to conduct replay attack tests, the behavior of payload data can be observed in practice, thereby verifying whether the judgment of the large model is accurate and improving the reliability of the final third label.

[0104] Optionally, test labels, which are labels derived from the replay results in the sandbox environment, describe the behavior of the payload data in a real-world environment, such as whether it attempts to gain unauthorized access, tamper with files, or initiate a network scan.

[0105] Optionally, the third label refers to a comprehensive description of the alert event that integrates data labels, the first label (rule-based attack type label), and the second label (knowledge graph-based attack path label). It includes at least the security attack score, type, potential vulnerability information, traces of the attack tools used, and recommended defense measures. When the test label matches the data label, the labeling system combines the first and second labels to comprehensively evaluate the event from multiple dimensions such as text semantics, standard attack patterns, and entity relationships, and determine a more accurate and comprehensive third label, thereby enhancing the depth and breadth of security analysis.

[0106] In summary, the tagging system uses a large language model for feature extraction and security testing of payload data. Combined with the results of rule matching and knowledge graph analysis, it achieves multi-dimensional and in-depth analysis of cybersecurity incidents. Empirical verification ensures the reliability of the analysis results. In particular, the generation process of the third tag fully considers various aspects of the alarm information, providing the security team with accurate threat intelligence and helping to quickly locate and respond to complex cyberattacks.

[0107] In one optional embodiment, in order to determine the labeling result of the target log, the labeling system first obtains the label weights corresponding to the first label, the second label, and the third label, wherein the label weight is used to characterize the confidence level of each of the three labels. Then, the labeling system performs weighted fusion of the first label, the second label, and the third label based on the confidence level of each of the three labels to obtain the labeling result of the target log.

[0108] Optionally, label weight refers to the weight assigned by the labeling system to each label (first label, second label, third label) during the dynamic fusion of labeling results, representing the confidence level corresponding to that label.

[0109] In summary, the tagging system, by weightedly fusing tags from different sources (first tag, second tag, and third tag), can integrate the analysis results of preset rules (first tag), the association analysis results based on knowledge graphs (second tag), and the deep semantic analysis results based on large models (third tag). This enables multi-angle and multi-level security event assessment, improving the comprehensiveness and accuracy of the analysis. During the result fusion process, the tagging system analyzes the confidence level of each tag, enabling a more accurate weighting of the output results of different analysis methods, thus enhancing the flexibility and reliability of alarm event tagging results.

[0110] In one optional embodiment, an automated tagging method for alarm events and logs is provided. Figure 2 This is a flowchart of an optional automated tagging method for alarm events and logs according to an embodiment of this application, such as... Figure 2 As shown, multi-source heterogeneous log data flows from top to bottom, undergoing collection buffering, core processing and multi-level labeling, in-depth analysis and verification, and finally the fusion and display of labeling results. This method includes the following steps:

[0111] (1) Multi-source log collection and preprocessing: Heterogeneous logs from network security devices, servers and application systems are received through standardized interfaces. Supported protocols and formats include Syslog (System Log Protocol), JSON (JavaScript Object Notation), CSV (Comma-Separated Values), etc. The collected logs are parsed to extract metadata such as timestamps, log levels, and source devices. Subsequently, data cleaning is performed, including removing duplicate logs, correcting format errors and unifying timestamp formats. For unstructured log text, natural language processing technology is used to extract key information.

[0112] (2) Multi-level structured processing and ATT&CK mapping: A layered processing architecture is adopted to perform deep parsing on the preprocessed logs.

[0113] Optionally, the first-level processing extracts common security fields, including event time, source / destination IP address, port number, protocol type, and operation result.

[0114] Optionally, the second-level processing extracts specific fields based on log type: for network traffic logs, it extracts session duration, data transmission volume, and TCP (Transmission Control Protocol) flags; for authentication logs, it extracts username, authentication method, and login result; for system operation logs, it extracts process ID, command-line arguments, and file path. After field extraction, a built-in rule base containing hundreds of detection rules based on ATT&CK technology is used to calculate the similarity between log features and ATT&CK technology descriptions using a graph-based matching algorithm, generating corresponding tactical and technical identifiers (e.g., mapping a large number of failed logins to T1110-brute-force attack), thereby labeling each security event with a standardized ATT&CK tag.

[0115] (3) Knowledge Graph Construction and Association Analysis: A threat knowledge graph is constructed based on structured data. The graph pattern defines various entity types (including host assets, network devices, user accounts, and security events) and relationship types (including network connections, permission granting, data access, and event triggering). The tagging system automatically identifies the relationships between entities, such as multiple login behaviors of the same user, network communication patterns between hosts, and causal relationships between events. The graph is stored in a time-series graph database, supports multi-hop queries and path analysis, and performs maintenance operations such as entity parsing, relationship weight calculation, and community discovery to discover hidden threat patterns such as lateral movement paths and data leakage channels.

[0116] (4) Deep Semantic Analysis Based on a Large Model: For network traffic and security events containing payload data, preprocessing is first performed, including binary-to-text encoding conversion, feature extraction (such as entropy calculation and pattern matching), and sequence segmentation. Then, the processed data is input into a specially trained large language model. This model performs multi-task learning based on pre-trained security knowledge, identifies malicious features in the payload (such as shell code patterns, exploit signatures, and obfuscation techniques), and understands the semantic information of the attack (such as attack techniques, targets, and stages). The model outputs a rich set of semantic labels, including: malice score (confidence between 0 and 1), attack type classification (such as buffer overflow, SQL injection, and remote code execution), associated vulnerability information (including CVE (Common Vulnerabilities and Exposures) numbers and vulnerability types), attack tool fingerprints, and defense recommendations (such as mitigation measures and detection rules).

[0117] (5) Automated verification and continuous optimization: Establish a closed loop for verification and optimization. For payloads that the model determines to be malicious, the verification process is automatically triggered, that is, the attack payload is replayed in the sandbox environment to monitor its system behavior (such as file operations, network connections, registry modifications); the accuracy of the model's judgment is evaluated in combination with the behavioral analysis results; the verification results are added to the training dataset, and the large model optimization adopts an incremental learning method, and the model is fine-tuned regularly using new verification data; at the same time, a manual feedback mechanism is introduced, and the correction results of security analysts are also included in the training data to continuously improve the accuracy and reliability of the model.

[0118] (6) Results Fusion and Visualization: A confidence-based weighted fusion algorithm is adopted to integrate rule matching results (ATT & CK tags), graph association analysis results, and model semantic analysis results to generate a unified security assessment conclusion. The fused results are displayed through a visualization platform, including interactive interfaces such as a security event dashboard, attack chain graph, and threat hunting workbench, supporting multiple analysis perspectives such as time series, topology, and details. All analysis results and tagging information are provided to downstream security systems and devices through standard API interfaces to achieve efficient emergency response and automated handling.

[0119] As can be seen from the above, the beneficial effects achieved by the technical solutions in the above embodiments are as follows:

[0120] (1) Improve the accuracy and coverage of labeling: By utilizing the powerful pattern recognition and semantic understanding capabilities of large language models, it is possible to effectively identify unknown, variant and complex attacks, and reduce the false alarm rate and false alarm rate of labeling results.

[0121] (2) Achieve automation and reduce labor costs: The end-to-end automation from log parsing, context association, deep analysis to final tagging has been completed, reducing the manual burden on security analysts.

[0122] (3) Enhanced the richness and interpretability of the tagging results: The tagging results not only include classification conclusions, but also standardized attack framework identifiers, associated vulnerability information and contextual paths, providing sufficient basis for the judgment of alarm events.

[0123] (4) It has the ability to continuously adapt and evolve: Through the feedback data generated by the automated verification closed loop, the model can be continuously optimized, enabling the labeling system to adapt to the ever-changing threat environment.

[0124] (5) Improve security operation efficiency: The target knowledge graph supports drilling down to explore the full picture of the attack, and the rich semantic tags accelerate the qualitative analysis and response decision-making of events, thereby shortening the handling time of alarm events.

[0125] Example 2

[0126] This application embodiment can also provide an alarm log tagging device. It should be noted that the alarm log tagging device of this application embodiment can be used to execute the alarm log tagging method provided in this application embodiment. The alarm log tagging device provided in this application embodiment will be described below.

[0127] According to an embodiment of this application, an apparatus for implementing the above-described alarm log tagging method is also provided. Figure 3 This is a schematic diagram of an optional alarm log marking device according to an embodiment of this application, such as... Figure 3 As shown, the device includes: a layered parsing unit 301, a first label determination unit 302, a second label determination unit 303, a third label determination unit 304, and a labeling result determination unit 305.

[0128] Optionally, the hierarchical parsing unit 301 is used to perform hierarchical parsing on the target log to obtain M log fields, wherein the target log is used to record alarm events corresponding to L network security devices, where L and M are both positive integers, and the M log fields are used to characterize the event information of the alarm events; the first label determination unit 302 is used to determine the first label of the target log based on the M log fields, wherein the first label is used to characterize the attack strategy / attack technique for security attacks on each network security device; the second label determination unit 303 is used to determine the second label of the target log based on the target log and the first label, wherein the second label is used to characterize the relationship between entities in the target log; the third label determination unit 304 is used to determine the third label of the target log based on the target log, the first label, and the second label, wherein the third label is used to characterize at least the attack score, attack type, vulnerability type, attack device identifier, and defense measures for security attacks on each network security device; and the labeling result determination unit 305 is used to determine the labeling result of the target log based on the first label, the second label, and the third label of the target log.

[0129] In one optional embodiment, the alarm log tagging device further includes: an original alarm log acquisition unit, a data cleaning unit, and a standardization processing unit.

[0130] Optionally, the raw alarm log collection unit is used to collect raw alarm logs corresponding to L network security devices, wherein the raw alarm logs include structured event data corresponding to alarm events and unstructured payload data; the data cleaning unit is used to clean the raw alarm logs to obtain a first alarm log, wherein the data cleaning is used to remove duplicate data and blank data from the raw alarm logs; and the standardization processing unit is used to standardize the first alarm logs to obtain a target log, wherein the standardization processing is used to unify the data format and timestamp format of the first alarm logs.

[0131] In one optional embodiment, the hierarchical parsing unit 301 includes: a first parsing operation subunit, a second parsing operation subunit, and a log field determination subunit.

[0132] Optionally, the first parsing operation subunit is used to perform a first parsing operation on the target log to obtain general fields, wherein the general fields are at least used to characterize the occurrence time and processing result of the alarm event, and the network address, port number, and protocol type of the network security device; the second parsing operation subunit is used to perform a second parsing operation on the target log based on the log type to obtain special fields, wherein the special fields are one of the following: the first special field, which is at least used to characterize the session duration, data transmission volume, and TCP flag bits of the network traffic log; the second special field, which is at least used to characterize the username, authentication method, and login result of the authentication log; the third special field, which is at least used to characterize the process identifier, command line parameters, and file path of the system operation log; and the log field determination subunit is used to take the general fields and special fields corresponding to the target log as M log fields.

[0133] In one optional embodiment, the first label determination unit 302 includes: a rule matching subunit, a similarity detection subunit, and a first label determination subunit.

[0134] Optionally, the rule matching subunit is used to perform rule matching in a preset rule base based on M log fields to obtain preset rules for matching the target log; the similarity detection subunit is used to detect the similarity between each log field in the M log fields and each preset tag corresponding to the matched preset rule; the first tag determination subunit is used to take the preset tag corresponding to the similarity as the first tag of the target log when the similarity is greater than or equal to a preset similarity threshold.

[0135] In one optional embodiment, the second label determination unit 303 includes: an entity determination subunit, an association determination subunit, a knowledge graph creation subunit, a multi-hop query subunit, and a second label determination subunit.

[0136] Optionally, the entity determination subunit is used to determine P entities based on the target logs, wherein the entity type of each entity is one of the following: host asset, network device, user account, alarm event; the relationship determination subunit is used to determine all relationships between the P entities based on the target logs and the first tag, wherein the relationship type of each relationship is one of the following: network connection, permission granting, data access, event triggering; the knowledge graph creation subunit is used to create a target knowledge graph based on the P entities and all relationships between the P entities, and to perform entity... The analysis process yields the entity features of each entity, with the target knowledge graph stored in a time-series graph database. A multi-hop query subunit performs multi-hop queries on the target knowledge graph based on the entity features of each entity, resulting in Q attack paths, where Q is a positive integer. Each attack path's attack type is one of the following: lateral movement path, data leakage channel. A second label determination subunit performs community detection on the subgraph to which each attack path belongs in the target knowledge graph, obtaining the second label of the target log. The community detection operation is used to detect the attack type of each attack path.

[0137] In an optional embodiment, the third label determination unit 304 includes: a feature extraction subunit, a sandbox testing subunit, and a third label determination subunit.

[0138] Optionally, the feature extraction subunit is used to extract features from the payload data in the target log to obtain data features, and to determine the data label corresponding to the payload data based on the data features, wherein the data features are used to characterize at least the entropy value of the payload data; the sandbox testing subunit is used to perform replay attack tests on the payload data based on a preset sandbox environment when the data label is a preset label, to obtain a test label, wherein the preset label is used to characterize the existence of security attack information in the payload data, and the test label is used to characterize the actual behavior information of the payload data; the third label determination subunit is used to determine the third label of the target log based on the data label, the first label, and the second label when the test label and the data label are consistent.

[0139] In an optional embodiment, the labeling result determination unit 305 includes: a label weight acquisition subunit and a weighted fusion subunit.

[0140] Optionally, the label weight acquisition subunit is used to acquire the label weights corresponding to the first label, the second label, and the third label, wherein the label weight is used to represent the confidence level of each of the three labels; the weighted fusion subunit is used to perform weighted fusion on the first label, the second label, and the third label based on the confidence level of each of the three labels to obtain the labeling result of the target log.

[0141] It should be noted that the above-mentioned hierarchical parsing unit 301, first label determination unit 302, second label determination unit 303, third label determination unit 304 and labeling result determination unit 305 correspond to steps S101 to S105 in the method embodiment. The above units and corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments.

[0142] Example 3

[0143] Embodiments of this application can also provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application, such as... Figure 4 As shown, the electronic device includes: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0144] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and devices in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the above-mentioned alarm log tagging method.

[0145] The memory may include high-speed random access memory (RAM), and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, which can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks (LANs), mobile communication networks, and combinations thereof.

[0146] The processor can access information and applications stored in memory via a transmission device to execute the following steps: hierarchical parsing of the target log to obtain M log fields, where the target log records alarm events corresponding to L network security devices, where L and M are both positive integers, and the M log fields characterize the event information of the alarm events; determining a first label for the target log based on the M log fields, where the first label characterizes the attack strategy / attack technique used to launch a security attack on each network security device; determining a second label for the target log based on the target log and the first label, where the second label characterizes the relationships between entities in the target log; determining a third label for the target log based on the target log, the first label, and the second label, where the third label at least characterizes the attack score, attack type, vulnerability type, attack device identifier, and defense measures used to launch a security attack on each network security device; and determining the labeling result of the target log based on the first, second, and third labels.

[0147] This application provides a tagging scheme for alarm logs. It employs a layered parsing approach, extracting and analyzing multiple fields from the target log to determine a first tag describing attack strategies and techniques, achieving preliminary identification of complex attack methods. Next, through in-depth analysis of the target log and the first tag, a second tag reflecting the relationships between entities is determined, enabling cross-log source attack chain correlation analysis and identification of context-dependent threats. Finally, combining the target log, the first tag, and the second tag, a third tag is generated containing attack scores, types, vulnerability information, and defense recommendations. This enriches the tagging results, enhances decision support capabilities, and achieves in-depth and multi-dimensional evaluation of alarm events. It addresses the technical shortcomings of existing technologies, such as low coverage due to tagging based solely on preset rules in a rule base, and poor interpretability due to tagging based on traditional machine learning models. This solves the problem of low accuracy in alarm log tagging based on existing technologies.

[0148] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, PDAs, mobile internet devices, PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0149] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0150] Example 4

[0151] Embodiments of this application may also provide a storage medium.

[0152] Optionally, in this embodiment of the application, the storage medium can be used to store the program code executed by the alarm log tagging method provided in the above method embodiment.

[0153] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0154] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of a tagging method for alarm logs.

[0155] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0156] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0157] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0158] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0159] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0160] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0161] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method of marking an alarm log, characterized by, The method comprises the following steps: hierarchical analysis is performed on a target log to obtain M log fields, wherein the target log is used to record alarm events corresponding to L network security devices, L and M are positive integers, and the M log fields are used to represent event information of the alarm events; based on the M log fields, a first label of the target log is determined, wherein the first label is used to represent an attack strategy / attack technology for performing a security attack on each network security device; based on the target log and the first label, a second label of the target log is determined, wherein the second label is used to represent an association relationship between entities in the target log; based on the target log, the first label and the second label, a third label of the target log is determined, wherein the third label is used to represent at least an attack score, an attack type, a vulnerability type, an attack device identifier and a defense measure for performing a security attack on the each network security device; based on the first label, the second label and the third label of the target log, a marking result of the target log is determined.

2. The method of claim 1, wherein, Before the hierarchical analysis is performed on the target log to obtain the M log fields, the marking method of the alarm log further comprises the following steps: original alarm logs corresponding to the L network security devices are collected, wherein the original alarm logs comprise event data corresponding to structured alarm events and payload data which is unstructured; data cleaning is performed on the original alarm logs to obtain first alarm logs, wherein the data cleaning is used to at least remove duplicate data and blank data in the original alarm logs; standardization processing is performed on the first alarm logs to obtain the target log, wherein the standardization processing is used to at least unify data formats and timestamp formats of the first alarm logs.

3. The method of claim 1, wherein, The hierarchical analysis is performed on the target log to obtain the M log fields, comprising: a first analysis operation is performed on the target log to obtain general fields, wherein the general fields are used to at least represent a time of occurrence, a processing result of the alarm event, and a network address, a port number and a protocol type of the network security device; based on a log type, a second analysis operation is performed on the target log to obtain special fields, wherein the special fields are one of the following: a first special field is used to at least represent a session duration, a data transmission amount and a TCP flag of a network flow log; a second special field is used to at least represent a username, an authentication method and a login result of an identity authentication log; a third special field is used to at least represent a process identifier, a command line parameter and a file path of a system operation log; the general fields and the special fields of the target log are taken as the M log fields.

4. The method of claim 1, wherein, Based on the M log fields, the first label of the target log is determined, comprising: based on the M log fields, rule matching is performed in a preset rule library to obtain a preset rule matched by the target log; similarities between each log field in the M log fields and each preset label corresponding to the matched preset rule are detected. In a case where the similarity is greater than or equal to a preset similarity threshold, a preset label corresponding to the similarity is taken as a first label of the target log.

5. The method of claim 1, wherein, Based on the target log and the first label, a second label of the target log is determined, including: Based on the target log, P entities are determined, wherein an entity type of each entity is one of the following: host asset, network device, user account, and alarm event. Based on the target log and the first label, all association relationships between the P entities are determined, wherein a relationship type of each association relationship is one of the following: network connection, permission granting, data access, and event triggering. Based on the P entities and all association relationships between the P entities, a target knowledge graph is created, entity analysis is performed on the target knowledge graph, and entity features of the each entity are obtained, wherein the target knowledge graph is stored by using a time sequence graph database. Based on the entity features of the each entity, multi-hop queries are performed on the target knowledge graph, and Q attack paths are obtained, wherein Q is a positive integer, and an attack type of each attack path is one of the following: horizontal movement path and data leakage channel. Community discovery operations are performed on subgraphs to which each attack path in the target knowledge graph belongs, and a second label of the target log is obtained, wherein the community discovery operations are used to detect the attack type of each attack path.

6. The method of claim 1, wherein, Based on the target log, the first label, and the second label, a third label of the target log is determined, including: Data features are extracted from payload data in the target log, a data label corresponding to the payload data is determined based on the data features, wherein the data features are used to at least represent an entropy value of the payload data. In a case where the data label is a preset label, a replay attack test is performed on the payload data based on a preset sandbox environment, and a test label is obtained, wherein the preset label is used to represent that there is security attack information in the payload data, and the test label is used to represent actual behavior information of the payload data. In a case where the test label is consistent with the data label, the third label of the target log is determined based on the data label, the first label, and the second label.

7. The method of claim 1, wherein, Based on the first label, the second label, and the third label of the target log, a labeling result of the target log is determined, including: Label weights corresponding to the first label, the second label, and the third label are obtained, wherein the label weights are used to represent confidence degrees of each of the three labels. Based on the confidence degrees of each of the three labels, the first label, the second label, and the third label are weighted and fused to obtain the labeling result of the target log.

8. A marking device for an alarm log, characterized in that including: A hierarchical analysis unit is configured to perform hierarchical analysis on a target log to obtain M log fields, wherein the target log is used to record alarm events corresponding to L network security devices, L and M are both positive integers, and the M log fields are used to represent event information of the alarm events. The first label determination unit is configured to determine a first label of the target log based on the M log fields, wherein the first label is used to represent an attack strategy / attack technology for performing a security attack on each network security device. The second label determination unit is configured to determine a second label of the target log based on the target log and the first label, wherein the second label is used to represent an association relationship between entities in the target log. The third label determination unit is configured to determine a third label of the target log based on the target log, the first label, and the second label, wherein the third label is used to represent at least an attack score, an attack type, a vulnerability type, an attack device identifier, and a defense measure for performing a security attack on each network security device. The labeling result determination unit is configured to determine a labeling result of the target log based on the first label, the second label, and the third label of the target log.

9. A computer program product, characterised in that, The computer program product comprises a computer program, wherein the computer program controls the computer program product to execute the labeling method of the alarm log according to any one of claims 1 to 7 when the computer program is running.

10. An electronic device, comprising: The computer program product comprises a computer program, wherein the computer program controls the computer program product to execute the labeling method of the alarm log according to any one of claims 1 to 7 when the computer program is running. The computer program product comprises a computer program, wherein the computer program controls the computer program product to execute the labeling method of the alarm log according to any one of claims 1 to 7 when the computer program is running.

Images