Network security event processing method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a network security event processing method and device, electronic equipment and a readable storage medium. The method comprises the following steps: acquiring a network security event and extracting event information of the network security event; performing association rule matching on the event information by utilizing a preset association rule base to obtain an association rule matching result; the preset association rule base comprises one or a combination of more of a time sequence association rule, a cross-device collaborative association rule, an attribute association rule and a frequent item set association rule; for each association rule matching result, determining a confidence coefficient calculation rule used by a preset association rule corresponding to the association rule matching result, and performing confidence coefficient calculation on the association rule calculation result to obtain the confidence coefficient of the association rule matching result; and outputting a target association rule matching result of which the confidence exceeds a standard threshold, a target network security event corresponding to the target association rule matching result, and event information of the target network security event. According to the scheme, quicker and more accurate network security event processing can be realized.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular to a network security incident handling method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] With the continuous development of computer and network technologies, network security issues are becoming increasingly numerous and dangerous, and are receiving more and more attention. Common network security devices such as firewalls, EDRs, and IPS generate various alerts during use. However, with gradual development, alerts from different data sources have accumulated into massive amounts of information data. This aggregated alert information from various data sources can be collectively referred to as raw security events. Obviously, it is impractical for security managers to manually process such a massive amount of highly redundant and complex information.

[0003] Therefore, how to achieve faster and more accurate handling of cybersecurity incidents, and thus effectively ensure cybersecurity, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this application is to provide a network security incident handling method that can achieve faster and more accurate network security incident handling, thereby further effectively ensuring network security. Another purpose of this application is to provide a network security incident handling device, electronic device, and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0005] Firstly, this application discloses a method for handling network security incidents, including:

[0006] Obtain network security events and extract event information from the network security events;

[0007] The event information is matched with association rules using a preset association rule library to obtain association rule matching results; the preset association rule library includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules.

[0008] For each association rule matching result, determine the confidence calculation rule used by the preset association rule corresponding to the association rule matching result, and use the confidence calculation rule to calculate the confidence of the association rule matching result to obtain the confidence of the association rule matching result;

[0009] Output the target association rule matching result with a confidence level exceeding the standard threshold, the target network security event corresponding to the target association rule matching result, and the event information of the target network security event.

[0010] Optionally, before extracting the event information of the network security event, the method further includes:

[0011] Extract the fingerprint information of the network security incident;

[0012] The fingerprint information is matched using a preset fingerprint information database to obtain fingerprint matching results; the preset fingerprint information database includes attack fingerprint information for each preset attack event;

[0013] When the fingerprint matching result indicates that the fingerprint information matches the preset fingerprint information database, the step of extracting the event information of the network security event is executed;

[0014] When the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, the network security event is determined to be a non-attack event.

[0015] Optionally, fingerprint matching is performed on the fingerprint information using a preset fingerprint information database to obtain fingerprint matching results, including:

[0016] The similarity between the fingerprint information and each attack fingerprint information in the preset fingerprint information database is calculated.

[0017] When there is an attack fingerprint in the preset fingerprint information database whose similarity to the fingerprint information exceeds a preset threshold, the fingerprint matching result is determined to be that the fingerprint information hits the preset fingerprint information database;

[0018] When there is no attack fingerprint information in the preset fingerprint information database that has a similarity exceeding a preset threshold with the fingerprint information, the fingerprint matching result is determined to be that the fingerprint information does not match the preset fingerprint information database.

[0019] Optionally, before extracting the event information of the network security event, the method further includes:

[0020] Extract the attribute information of the network security event;

[0021] The attribute information is statistically analyzed using a preset baseline model to obtain statistical analysis results; the statistical analysis based on the preset baseline model includes single attribute frequency statistics, attribute combination frequency statistics, time series distribution statistics, and cross-device collaborative statistics;

[0022] When the statistical analysis result indicates that the attribute information is an abnormal attribute, the step of extracting the event information of the network security event is executed;

[0023] When the statistical analysis result indicates that the attribute information is a normal attribute, the network security event is determined to be a non-attack event.

[0024] Optionally, before extracting the event information of the network security event, the method further includes:

[0025] Extract the fingerprint and attribute information of the network security incident;

[0026] The fingerprint information is matched using a preset fingerprint information database to obtain the fingerprint matching result;

[0027] The attribute information is statistically analyzed using a preset baseline model to obtain the statistical analysis results;

[0028] When the fingerprint matching result is that the fingerprint information matches the preset fingerprint information database and the statistical analysis result is that the attribute information is an abnormal attribute, or when the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, but the statistical analysis result is that the attribute information is an abnormal attribute, the step of extracting the event information of the network security event is executed;

[0029] When the fingerprint matching result indicates that the fingerprint information matches the preset fingerprint information database, but the statistical analysis result indicates that the attribute information is a normal attribute, the network security event is entered into the manual review queue.

[0030] When the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, and the statistical analysis result is that the attribute information is a normal attribute, the network security event is determined to be a non-attack event.

[0031] Optionally, the network security incident handling method further includes:

[0032] Within a preset time period, the output results corresponding to the preset association rule base and the review results of each network security event in the manual review queue are statistically analyzed.

[0033] The preset association rule base and / or the preset fingerprint information base and / or the preset baseline model are updated based on the output results and the verification results.

[0034] Optionally, the association rule matching result of the time-series association rule is the event information of the preceding and / or subsequent associated events of the network security event; the association rule matching result of the cross-device collaborative association rule is the event information of the device associated events of the network security event; the association rule matching result of the attribute association rule is the event information of the attribute associated events of the network security event; and the association rule matching result of the frequent itemset association rule is the event information of other network security events in the frequent itemset to which the network security event belongs.

[0035] Secondly, this application discloses a network security incident handling device, comprising:

[0036] An extraction module is used to acquire network security events and extract event information from the network security events;

[0037] The matching module is used to perform association rule matching on the event information using a preset association rule library to obtain association rule matching results; the preset association rule library includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules.

[0038] The calculation module is used to determine the confidence calculation rule used by the preset association rule corresponding to each association rule matching result for each association rule matching result, and to calculate the confidence of the association rule matching result by using the confidence calculation rule to calculate the confidence of the association rule matching result.

[0039] The output module is used to output the target association rule matching result with a confidence level exceeding the standard threshold, the target network security event corresponding to the target association rule matching result, and the event information of the target network security event.

[0040] Thirdly, this application discloses an electronic device, including:

[0041] Memory, used to store computer programs;

[0042] A processor, used to execute the computer program to implement any of the network security incident handling methods described above.

[0043] Fourthly, this application discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the network security incident handling methods described above.

[0044] This application provides a method for handling network security incidents, comprising: acquiring a network security incident and extracting incident information from the network security incident; performing association rule matching on the incident information using a preset association rule library to obtain an association rule matching result; the preset association rule library includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules; for each association rule matching result, determining the confidence calculation rule used by the preset association rule corresponding to the association rule matching result, and performing confidence calculation on the association rule calculation result using the confidence calculation rule to obtain the confidence of the association rule matching result; outputting a target association rule matching result whose confidence exceeds a standard threshold, the target network security incident corresponding to the target association rule matching result, and the incident information of the target network security incident.

[0045] By applying the technical solution provided in this application, for each network security event occurring within a network system, event information can be extracted as the basis for processing the corresponding network security event. First, the event information is matched using a pre-defined association rule base to obtain corresponding association rule matching results, including but not limited to time-series association rule matching results, cross-device collaborative association rule matching results, attribute association rule matching results, and frequent itemset association rule matching results. Then, the confidence level of the corresponding association rule matching results is calculated according to the confidence level of each association rule. This allows the determination of the security attribute (attack event or non-attack event) of the network security event based on the confidence level, thereby achieving effective identification of network security events. Therefore, this technical solution achieves network security event identification by analyzing the association information of network security events, eliminating reliance on manual intervention and effectively ensuring the accuracy and efficiency of network security event processing, further guaranteeing network security.

[0046] The network security incident handling device, electronic device, and computer-readable storage medium provided in this application also have the above-mentioned technical effects, and will not be described in detail here. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the prior art and the embodiments of this application, the accompanying drawings used in the description of the prior art and the embodiments of this application will be briefly introduced below. Of course, the accompanying drawings described below with respect to the embodiments of this application are only a part of the embodiments in this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort, and such other drawings also fall within the protection scope of this application.

[0048] Figure 1 A flowchart illustrating a network security incident handling method provided in an embodiment of this application;

[0049] Figure 2 This is a schematic diagram of the structure of a network security incident handling system provided in an embodiment of this application;

[0050] Figure 3 A flowchart illustrating another network security incident handling method provided in an embodiment of this application;

[0051] Figure 4 This is a schematic diagram of the structure of a network security incident handling device provided in an embodiment of this application;

[0052] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0053] The core of this application is to provide a network security incident handling method, which can achieve faster and more accurate network security incident handling and further effectively ensure network security; another core aspect of this application is to provide a network security incident handling device, electronic device, and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0054] To provide a clearer and more complete description of the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0055] This application provides a method for handling network security incidents.

[0056] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a network security incident handling method provided in an embodiment of this application. The network security incident handling method may include, but is not limited to, the following S101~S104.

[0057] S101: Obtain network security incidents and extract incident information.

[0058] This step aims to acquire network security events and extract their information. Network security events refer to various alarm messages generated within the network system. The event information to be extracted can be configured according to actual needs. One possible implementation may include, but is not limited to, basic identifiers of the network security event (such as event ID, generation timestamp, security device type and ID, etc.), attack attributes (such as attack source (e.g., source IP / domain / MAC), attack target (e.g., target IP / hostname / port / asset type), attack type (e.g., port scanning, SQL injection, etc.), threat level, attack signature, etc.), and status labels (completed correlation analysis, incomplete correlation analysis, pending correlation analysis, etc.). For example, the event information of a network security event might be: "Event ID=E001, Generation Time=2025-12-01 10:05:30, Device Type=Firewall, Attack Source=192.168.1.100, Attack Target=10.0.0.5:22, Attack Type=Port Scan, Threat Level=Medium, Status Label=Pending Correlation Analysis."

[0059] Understandably, extracting event information from cybersecurity incidents aims to enable subsequent correlation analysis and processing of cybersecurity incidents. Extracting comprehensive and accurate event information helps ensure the efficiency and accuracy of correlation analysis and processing of cybersecurity incidents.

[0060] S102: Use a preset association rule base to perform association rule matching on event information to obtain association rule matching results; the preset association rule base includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules.

[0061] This step aims to achieve association rule matching of event information. Specifically, an association rule library can be pre-created, namely the aforementioned preset association rule library, to store various types of association rules, such as time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules, as mentioned above. By matching the event information of network security events with each association rule in the preset association rule library, the association rule matching result corresponding to each association rule can be obtained. Thus, network security event identification can be achieved by referring to the matching results of each association rule, that is, determining the security attribute (attack event or non-attack event) of the network security event.

[0062] (1) Temporal association rules describe the inevitable or high-probability relationship of "preceding attack → subsequent attack" based on the order of attack behavior. That is, event A → event B. After the attack behavior of event A occurs, the attack behavior of event B may occur in a short period of time. For example, "port scanning (event A) → weak password cracking (event B) → malicious login (event C)", where event A is the preparatory action of the attacker to explore the target asset, event B is the core action to break through identity authentication, and event C is the subsequent action to obtain control of the asset. There is a clear temporal dependency among the three. Another example is "SQL injection attempt (event A) → database privilege escalation (event B) → sensitive data download (event C)", which is a typical chain of Web attacks.

[0063] (2) Cross-device collaborative association rules describe the cross-node association relationship of "device A alarm → device B alarm" based on the alarm coverage of different security devices. That is, device 1 has event A and device 2 has event B, and there is an association relationship between A and B. For example, "firewall (device 1) detects abnormal port access from source IP XXXX (event A) → EDR (device 2) detects malicious process creation from source IP XXXX (event B)", the former is a network layer attack attempt and the latter is an end-point attack landing. The two point to the same attack source and are collaborative actions. Another example is "IPS (device 1) intercepts malicious payload transmission (event A) → WAF (device 2) detects SQL injection request from the same source IP (event B)", which reflects the attacker's multi-method probing behavior.

[0064] (3) Attribute association rules describe the relationship of "overlapping attributes → event association" based on the core attributes of the event (such as attack source, target, port, threat level, etc.). For example, two alarm events (event A and event B) with "same attack source IP + same target asset + attack time interval ≤ 5 minutes" are associated; another example is that alarm events (event A and event B) with "threat level is 'critical' + attack type is 'ransomware related' + occurred in the same network segment" are associated.

[0065] (4) Frequent itemset association rules refer to multiple alarm events that are frequently executed consecutively based on the same attack target. For example, "port scanning (event A) + weak password cracking (event B) + malicious login (event C)" constitutes a frequent itemset, and the three together serve the attack target of "gaining control of the host"; another example is that "phishing email click (event A) + malware download (event B) + C2 communication (event C) + data encryption (event D)" constitutes a typical frequent itemset of "ransomware attack".

[0066] Based on this, the matching result of the association rule of the time sequence association rule is the event information of the preceding and / or subsequent associated events of the network security event; the matching result of the association rule of the cross-device collaborative association rule is the event information of the device associated events of the network security event; the matching result of the association rule of the attribute association rule is the event information of the attribute associated events of the network security event; and the matching result of the association rule of the frequent itemset association rule is the event information of other network security events in the frequent itemset to which the network security event belongs.

[0067] (1) Temporal association rules are divided into pre-association rules and post-association rules.

[0068] Post-event association rule matching: If the attack attributes of the event E001 to be analyzed match the "pre-event features" of a certain rule R, then the "post-event features" of that rule ("time constraints", "confidence level", etc. can also be extracted) are extracted as association clues. For example, if event E001 (port scan, target port 22) matches rule R001 (pre-event features: port scan + target 22 / 3389), then the post-event features "weak password cracking + target 22 / 3389", time constraint "within 10 minutes", and confidence level "92%" are extracted to clarify the potential subsequent associated event features of E001.

[0069] Pre-event association rule matching: If the attack attributes of the event E001 to be analyzed match the "post-event features" of a certain rule R, then the "pre-event features" of that rule ("time constraint" and "confidence level" as association clues) are extracted. For example, if event E001 (weak password cracking, target port 22) matches the post-event features of rule R001, then the pre-event features "port scan + target 22 / 3389" and the time constraint "≤10 minutes after the pre-event" are extracted to identify the potential pre-event association features of E002.

[0070] (2) Cross-device collaborative association rule matching: If the event E001 to be analyzed in security device 1 matches the "event E002 of associated device 2" of a certain rule R, then the "event E002" feature of "associated device 2" is extracted. For example, if the security device to which event E001 belongs is "firewall", then the event feature of event E002 in associated device "EDR" is extracted.

[0071] (3) Attribute association rule matching: Perform attribute matching on events within the aggregate set and filter out events that meet the "attribute association conditions" with E001: A. Same attack source; B. Same attack target (IP / asset); C. Attack type belongs to the same frequent itemset. For example, the attack sources of E001 and E003 are both 192.168.1.100, the attack targets are both 10.0.0.5:22, and the attack types both belong to the IS001 itemset, so they can be determined as "attribute association events".

[0072] (4) Frequent itemset association rule matching: If the event E001 to be analyzed belongs to one of the behaviors of a frequent itemset IS, then all other behavioral features and association rules in the itemset are extracted to form "itemset-level association clues". For example: if the event E001 (port scanning) belongs to the itemset IS001 (scanning + cracking + login), then the behavioral features of "cracking" and "login" in the itemset are extracted.

[0073] S103: For each association rule matching result, determine the confidence calculation rule used by the preset association rule corresponding to the association rule matching result, and use the confidence calculation rule to calculate the confidence of the association rule matching result to obtain the confidence of the association rule matching result.

[0074] This step aims to calculate the confidence level of the association rule matching results. This confidence level is used to characterize the credibility of the corresponding association rule matching results. Obviously, the higher the confidence level, the higher the credibility of the association rule matching results, and the more reliable the corresponding association rule, that is, the more credible / accurate the handling results of the current network security incident. Conversely, the lower the confidence level, the lower the credibility of the association rule matching results, and the less reliable the corresponding association rule, that is, the less credible / inaccurate the handling results of the current network security incident.

[0075] Different association rules in the preset association rule base correspond to different confidence calculation rules. The core indicator for determining whether an association rule is valid is used to filter high-reliability associations and avoid misjudgments based on low-confidence rules. Taking time-series association rules as an example, for the association rule "Event A → Event B" (A is the preceding event, B is the following event), the confidence = (frequency of A and B occurring simultaneously) / (total frequency of A occurring) × 100%. For example, if a port scan (Event A) occurs 1000 times, and weak password cracking (Event B) occurs 920 times in the following 10 minutes, then the confidence of the rule "Event A → Event B" = 920 / 1000 × 100% = 92%; as another example, if a firewall detects access to port 445 (Event A) 500 times, and EDR detects ransomware (Event B) 440 times in the following 30 minutes, then the confidence of the rule "Event A → Event B" = 440 / 500 × 100% = 88%.

[0076] S104: Output the target association rule matching result with a confidence level exceeding the standard threshold, the target network security event corresponding to the target association rule matching result, and the event information of the target network security event.

[0077] This step aims to achieve effective output of network security incident handling results. As mentioned above, the higher the confidence level, the more reliable the association rule matching result; the lower the confidence level, the less reliable the association rule matching result. Based on this, target association rule matching results with confidence levels exceeding the standard threshold can be filtered out, and the target association rule matching result, the corresponding target network security event, and the event information of the target network security event can be output accordingly. Obviously, association rule matching results with confidence levels below the standard threshold have low reliability, meaning their corresponding network security incident handling results are unreliable and do not need to be output. Alternatively, a risk warning can be output along with the relevant results (association rule matching result, the corresponding network security event, and the event information of the network security event) to remind staff to conduct manual judgment. Of course, the specific value of the standard threshold does not affect the implementation of this technical solution and can be set by technical personnel according to the actual situation; this application does not impose any restrictions on this.

[0078] As can be seen, the network security incident handling method provided in this application can extract event information from various network security incidents occurring within a network system as the basis for handling the corresponding network security incidents. First, it uses a preset association rule base to match the event information, obtaining corresponding association rule matching results, including but not limited to time-series association rule matching results, cross-device collaborative association rule matching results, attribute association rule matching results, and frequent itemset association rule matching results. Then, it calculates the confidence level of the corresponding association rule matching results by referring to the confidence level calculation rules corresponding to each association rule. This allows the determination of the security attribute (attack event or non-attack event) of the network security incident based on the confidence level, thereby achieving effective identification of network security incidents. Therefore, this technical solution achieves network security incident identification by analyzing the association information of network security incidents, eliminating reliance on manual intervention and effectively ensuring the accuracy and efficiency of network security incident handling, further guaranteeing network security.

[0079] Based on the above embodiments:

[0080] In one embodiment of this application, before extracting event information of a network security event, the process may further include:

[0081] Extract fingerprint information from cybersecurity incidents;

[0082] Fingerprint information is matched using a preset fingerprint information database to obtain fingerprint matching results; the preset fingerprint information database includes attack fingerprint information for each preset attack event;

[0083] When the fingerprint matching result shows that the fingerprint information matches the preset fingerprint information database, the step of extracting the event information of the network security event is executed;

[0084] When the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, the network security event is determined to be a non-attack event.

[0085] In this embodiment, to further improve the efficiency of handling network security incidents, a pre-processing method for network security incidents based on a preset fingerprint information database is proposed. In other words, before performing correlation matching analysis on network security incidents, a preliminary identification can be performed using the preset fingerprint information database. Based on the results of this preliminary identification, it can be determined whether to continue with subsequent correlation matching analysis of the network security incidents. This can improve both the efficiency and accuracy of network security incident handling results. Specifically, various specific attack behaviors and methods in network attacks are extracted, and their key and core fingerprint information is extracted to form a network attack fingerprint information database (preset fingerprint information database). Then, the fingerprint information of the network security incident is compared and analyzed one by one with the data in the fingerprint information database. Clearly, this comparative analysis forms a rule-based model analysis technique.

[0086] The process of matching fingerprint information using a preset fingerprint database to obtain fingerprint matching results may include: calculating the similarity between the fingerprint information and each attack fingerprint in the preset fingerprint database; when an attack fingerprint with a similarity exceeding a preset threshold exists in the preset fingerprint database, the fingerprint matching result is determined to be a match between the fingerprint information and the preset fingerprint database; when no attack fingerprint with a similarity exceeding the preset threshold exists in the preset fingerprint database, the fingerprint matching result is determined to be a match between the fingerprint information and the preset fingerprint database. Similarly, the specific value of the preset threshold does not affect the implementation of this technical solution and can be set by technical personnel according to actual conditions; this application does not impose any limitations on this.

[0087] In one embodiment of this application, before extracting event information of a network security event, the process may further include:

[0088] Extract attribute information from cybersecurity incidents;

[0089] The attribute information is statistically analyzed using a preset baseline model to obtain the statistical analysis results. The statistical analysis based on the preset baseline model includes single attribute frequency statistics, attribute combination frequency statistics, time series distribution statistics, and cross-device collaborative statistics.

[0090] When the statistical analysis results indicate that the attribute information is abnormal, the step of extracting event information of the network security event is executed;

[0091] When the statistical analysis results show that the attribute information is normal, the network security incident is determined to be a non-attack incident.

[0092] In this embodiment of the application, to further improve the processing efficiency of network security incidents, a pre-processing method for network security incidents based on a preset baseline model is proposed. In other words, before performing correlation matching analysis on network security incidents, a preliminary identification can be performed using a preset baseline model. Based on the results of this preliminary identification, it can be determined whether to continue with subsequent correlation matching analysis of network security incidents. This can improve both the efficiency and accuracy of network security incident processing results.

[0093] Understandably, extracting and statistically analyzing key attributes from a large number of cybersecurity incidents yields a common set of features. Applying this set to cybersecurity incident analysis forms a statistical model analysis technique. Key attributes are the core attributes extracted from the original cybersecurity incidents, including but not limited to: alarm event type (e.g., port scanning, malicious code attack), attack source IP address, attack destination IP address, attack port (e.g., port 80, port 443), event timestamp, security device identifier (e.g., firewall A, EDR device B), threat level (low / medium / high / severe), and attack behavior description. Statistical dimensions can include, but are not limited to: single attribute frequency statistics (e.g., the total number of alarms from the same source IP), attribute combination frequency statistics (e.g., the frequency of occurrence of the combination "source IP + attack type + destination port"), time-series distribution statistics (e.g., the occurrence density of a certain type of alarm within one hour), and cross-device collaborative statistics (e.g., the alarm synchronization rate of the same attack behavior on firewalls and IPS). The baseline and thresholds involved in the statistical analysis are as follows: A statistical baseline is established based on historical data from a normal network environment. For example, the average frequency of port scan alarms during normal periods is 5 times per hour, and the alarm trigger probability of legitimate office IPs is less than 0.01%. Anomaly detection thresholds are set, such as a single IP having more than three times the baseline's daily alarm frequency, or alarms occurring during non-working hours (22:00-06:00) accounting for more than 60%. Therefore, by filtering effective features from the statistical results, a statistical model library can be formed. This can include, but is not limited to, high-frequency attribute combinations (such as "Source IP: 192.168.1.XXX + Attack Type: SQL Injection + Destination Port: 3306"), abnormal features deviating from the baseline (such as a single IP having 50 alarms per day, far exceeding the baseline of 10 times per day), and time-series correlation features (such as the same IP triggering port scan and malicious login alarms consecutively within 10 minutes).

[0094] In one embodiment of this application, before extracting event information of a network security event, the process may further include:

[0095] Extract fingerprint and attribute information of cybersecurity incidents;

[0096] Fingerprint information is matched using a pre-set fingerprint database to obtain fingerprint matching results;

[0097] The attribute information is statistically analyzed using a pre-defined baseline model to obtain the statistical analysis results;

[0098] When the fingerprint matching result is that the fingerprint information matches the preset fingerprint information database and the statistical analysis result is that the attribute information is an abnormal attribute, or when the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, but the statistical analysis result is that the attribute information is an abnormal attribute, the step of extracting the event information of the network security event is executed.

[0099] When the fingerprint matching result is that the fingerprint information matches the preset fingerprint information database, but the statistical analysis result is that the attribute information is normal, the network security event will be entered into the manual review queue.

[0100] When the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, and the statistical analysis result is that the attribute information is normal, the network security incident is determined to be a non-attack incident.

[0101] In this embodiment of the application, to further improve the processing efficiency of network security incidents, a pre-processing method for network security incidents based on a preset fingerprint information database and a preset baseline model is proposed. In other words, before performing correlation matching analysis on network security incidents, a preliminary identification can be performed using the preset fingerprint information database and the preset baseline model. Based on the results of this preliminary identification, it can be determined whether to continue with subsequent correlation matching analysis of the network security incidents. This can improve both the efficiency and accuracy of network security incident processing results.

[0102] The preliminary identification process based on a preset fingerprint database and a preset baseline model may include:

[0103] (1) Initial screening of rule model: The original network security event information is compared with the fingerprint information database of the rule model one by one, and candidate events with a matching degree of ≥85% are retained, while invalid alarms that do not match are excluded (such as alarms triggered by known legitimate software upgrades).

[0104] (2) Statistical model verification: Extract the above key attributes from the candidate events, calculate the corresponding statistical indicators, such as the source IP alarm frequency of the candidate event, the time-series distribution density of similar events, etc., and compare them with the statistical feature set and the anomaly judgment threshold.

[0105] (3) Fusion determination rules (as shown in Table 1):

[0106] If a candidate event meets both the "rule model matching condition" and the "statistical model anomaly judgment condition", it is judged as a "high confidence event" and can directly proceed to the subsequent correlation model analysis.

[0107] If a candidate event meets the "rule model matching condition" but does not meet the "statistical model anomaly judgment condition", it is marked as a "suspected false alarm event", temporarily stored in the review queue, and not entered into the association analysis;

[0108] If a candidate event does not meet the "rule model matching condition" but meets the "statistical model anomaly judgment condition", it is marked as a "potential missed event", added to the candidate event queue, and entered into the correlation analysis.

[0109] Table 1. Fusion Judgment Rule Table Based on Rule Model and Statistical Model

[0110]

[0111] Furthermore, the network security incident handling method may also include: within a preset time period, statistically analyzing the output results corresponding to the preset association rule base and the review results of each network security incident in the manual review queue; and updating the preset association rule base and / or preset fingerprint information base and / or preset baseline model based on each output result and each review result.

[0112] In this application embodiment, to further improve the accuracy of network security incident handling, a data update method is proposed, namely, an update method based on a preset association rule base and / or a preset fingerprint information base and / or a preset baseline model based on a preset time interval (preset duration). For example, the overlay model (rule model + statistical model) can be optimized weekly based on the analysis results of the association model: if a "suspected false alarm event" is confirmed as a valid event after manual review, the rule matching threshold is lowered to 80%; if the statistical baseline deviates due to changes in the network environment, the historical data for the past 3 months is recalculated to update the baseline.

[0113] For example, embodiments of this application provide a method for handling network security incidents.

[0114] First, please refer to Figure 2 , Figure 2 A schematic diagram of the structure of a network security incident handling system provided in this application embodiment mainly includes:

[0115] (1) Rule Model Analysis Module:

[0116] Analysis and matching are performed based on a rule base, which contains built-in rule information and can be customized and added through the analysis module page. Each rule contains basic information, basic configuration information, and model configuration information (input information and output information).

[0117] Basic information: such as model name, model location, etc.;

[0118] Basic configuration information: such as data configuration information (data source, data type, scope), model configuration information (fingerprint information database configuration, calculation configuration, threshold configuration), etc.

[0119] Input information: Raw security event structured data, such as event ID, generation timestamp (yyyy-MM-dd HH:mm:ss), device type, attack source IP, attack target IP:port, attack behavior description, attack signature, protocol type, etc.

[0120] Output information includes: all fields of the original event, matching degree, category tag, matching fingerprint ID, matching details, etc.

[0121] (2) Statistical Model Analysis Module:

[0122] The statistical model library records various statistical models. It contains built-in model information and can also be customized and added through the analysis module page. Each statistical model information includes basic information, basic configuration information, and model configuration information (input information and output information).

[0123] Basic information: such as model name, model positioning, applicable scenarios (0DAY attacks, mutation attacks, low-frequency abnormal behavior, etc.);

[0124] Basic configuration information: such as statistical dimension configuration (data source, data type, scope), baseline configuration (time window, statistical conditions, statistical indicators), threshold configuration (e.g., 0.9 times the baseline, such as adjusting the original baseline from 3 times / hour to 2.7 times / hour), and running configuration (≤500 records per second), etc.

[0125] Input information: Raw security event structured data, such as event ID, generation timestamp (yyyy-MM-dd HH:mm:ss), device type, attack source IP, attack target IP:port, attack behavior description, attack signature, protocol type, etc.

[0126] Output information includes: all fields of the original event, matching degree, classification tag, matching fingerprint ID, core statistical indicators (such as 28 alarms per IP per day, time-series density of 10 times / hour), matching details, etc.

[0127] (3) Association Model Analysis Module: An association rule library is built based on association rules, frequent itemsets, confidence levels, etc. Each rule contains basic information such as device information, field matching conditions, and time window constraints (input information and output information).

[0128] (4) Model task scheduling module: flexibly schedules the rule model module, statistical model module, correlation model module and event module.

[0129] (5) Event module: Stores raw security event information and outputs event information after analysis by various analysis models.

[0130] For further information, please refer to [link / reference]. Figure 3 , Figure 3 The following is a flowchart illustrating another network security incident handling method provided in an embodiment of this application.

[0131] (1) Rule-based task scheduling:

[0132] First, the model task scheduling module schedules the event module to filter out the raw event information to be analyzed and add it to the analysis queue. Next, the model task scheduling module checks if the rule model switch is on. If it's off, the data added to the analysis queue doesn't need to be analyzed by the rule model; if it's on, it matches the data in the analysis queue with the rules in the rule model using a matching algorithm. The raw event information after rule analysis is marked to generate new event information, which is then added to a new event information queue. Finally, the model task scheduling module calls the association analysis module to analyze the new event information queue. The analyzed data is marked with a unique tag from the association analysis module, generating new event information again, which is then output.

[0133] (2) Statistical model task scheduling:

[0134] First, the model task scheduling module determines whether the statistical model switch is on. If the switch is off, it means that the data added to the analysis queue this time does not need to be analyzed by the statistical model. If it is on, the statistical model uses different statistical rules to analyze the data in the analysis queue one by one. The original event information after statistical model analysis is marked to generate new event information, which is then added to a new event information queue. Further, the model task scheduling module calls the correlation analysis module to analyze the new event information queue. The analyzed data is marked with a unique tag from the correlation analysis module to generate new event information again, which is then output.

[0135] (3) Task scheduling in the association model:

[0136] If neither the rule model analysis switch nor the statistical model analysis switch is turned on, the association model will be called directly. The association model will analyze the original event information that is added to the analysis queue for the first time. The analyzed data will be marked with a unique tag of the association analysis module to generate new event information and output it.

[0137] As can be seen, the network security incident handling method provided in this application can extract event information as the basis for handling various network security incidents occurring within a network system. First, it uses a preset association rule base to match the event information, obtaining corresponding association rule matching results, including but not limited to time-series association rule matching results, cross-device collaborative association rule matching results, attribute association rule matching results, and frequent itemset association rule matching results. Then, it calculates the confidence level of the corresponding association rule matching results by referring to the confidence level calculation rules corresponding to each association rule. This allows the determination of the security attribute (attack event or non-attack event) of the network security incident based on the confidence level, thereby achieving effective identification of network security incidents. Therefore, this technical solution achieves network security incident identification by analyzing the association information of network security incidents, eliminating reliance on manual intervention and effectively ensuring the accuracy and efficiency of network security incident handling, further guaranteeing network security.

[0138] This application provides a network security incident handling device.

[0139] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of a network security incident handling device provided in an embodiment of this application. The network security incident handling device may include:

[0140] Extraction module 1 is used to acquire network security events and extract event information of network security events;

[0141] Matching module 2 is used to perform association rule matching on event information using a preset association rule library to obtain association rule matching results; the preset association rule library includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules;

[0142] The calculation module 3 is used to determine the confidence calculation rule used by the preset association rule corresponding to each association rule matching result for each association rule matching result, and to calculate the confidence of the association rule matching result by using the confidence calculation rule.

[0143] Output module 4 is used to output the target association rule matching result with a confidence level exceeding the standard threshold, the target network security event corresponding to the target association rule matching result, and the event information of the target network security event.

[0144] As can be seen, the network security incident processing device provided in this application can extract event information as the basis for processing various network security incidents occurring within the network system. First, it uses a preset association rule base to match the event information, obtaining corresponding association rule matching results, including but not limited to time-series association rule matching results, cross-device collaborative association rule matching results, attribute association rule matching results, and frequent itemset association rule matching results. Then, it calculates the confidence level of the corresponding association rule matching results by referring to the confidence level calculation rules corresponding to each association rule. This allows the determination of the security attribute (attack event or non-attack event) of the network security incident based on the confidence level, thereby achieving effective identification of network security incidents. Therefore, this technical solution achieves network security incident identification by analyzing the association information of network security incidents, eliminating reliance on manual intervention and effectively ensuring the accuracy and efficiency of network security incident processing, further guaranteeing network security.

[0145] In one embodiment of this application, the network security incident processing device may further include a fingerprint matching module, used to extract fingerprint information of the network security incident before extracting the incident information of the network security incident; perform fingerprint matching on the fingerprint information using a preset fingerprint information database to obtain a fingerprint matching result; the preset fingerprint information database includes attack fingerprint information of each preset attack incident; when the fingerprint matching result is that the fingerprint information matches the preset fingerprint information database, the step of extracting the incident information of the network security incident is executed; when the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, the network security incident is determined to be a non-attack incident.

[0146] In one embodiment of this application, the fingerprint matching module can be specifically used to calculate the similarity between the fingerprint information and each attack fingerprint information in the preset fingerprint information database; when there is an attack fingerprint information in the preset fingerprint information database whose similarity to the fingerprint information exceeds a preset threshold, the fingerprint matching result is determined to be that the fingerprint information hits the preset fingerprint information database; when there is no attack fingerprint information in the preset fingerprint information database whose similarity to the fingerprint information exceeds a preset threshold, the fingerprint matching result is determined to be that the fingerprint information does not hit the preset fingerprint information database.

[0147] In one embodiment of this application, the network security incident processing device may further include a statistical analysis module, used to extract attribute information of the network security incident before extracting the event information of the network security incident; perform statistical analysis on the attribute information using a preset baseline model to obtain statistical analysis results; the statistical analysis based on the preset baseline model includes single attribute frequency statistics, attribute combination frequency statistics, time series distribution statistics, and cross-device collaborative statistics; when the statistical analysis result indicates that the attribute information is an abnormal attribute, the step of extracting the event information of the network security incident is executed; when the statistical analysis result indicates that the attribute information is a normal attribute, the network security incident is determined to be a non-attack incident.

[0148] In one embodiment of this application, the network security incident processing device may further include a collaborative processing module, used to extract fingerprint information and attribute information of the network security incident before extracting the incident information; perform fingerprint matching on the fingerprint information using a preset fingerprint information database to obtain fingerprint matching results; perform statistical analysis on the attribute information using a preset baseline model to obtain statistical analysis results; when the fingerprint matching result is that the fingerprint information matches the preset fingerprint information database and the statistical analysis result is that the attribute information is an abnormal attribute, or when the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database but the statistical analysis result is that the attribute information is an abnormal attribute, the step of extracting the incident information of the network security incident is executed; when the fingerprint matching result is that the fingerprint information matches the preset fingerprint information database but the statistical analysis result is that the attribute information is a normal attribute, the network security incident is input into a manual review queue; when the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database and the statistical analysis result is that the attribute information is a normal attribute, the network security incident is determined to be a non-attack incident.

[0149] In one embodiment of this application, the network security incident processing device may further include an update module, which is used to statistically analyze the output results corresponding to the preset association rule base and the review results of each network security incident in the manual review queue within a preset time period; and update the preset association rule base and / or preset fingerprint information base and / or preset baseline model according to each output result and each review result.

[0150] In one embodiment of this application, the association rule matching result of the time-series association rule is the event information of the preceding and / or subsequent associated events of the network security event; the association rule matching result of the cross-device collaborative association rule is the event information of the device associated events of the network security event; the association rule matching result of the attribute association rule is the event information of the attribute associated events of the network security event; and the association rule matching result of the frequent itemset association rule is the event information of other network security events in the frequent itemset to which the network security event belongs.

[0151] For a description of the apparatus provided in the embodiments of this application, please refer to the above method embodiments; further details will not be repeated here.

[0152] This application provides an electronic device.

[0153] Please refer to Figure 5 , Figure 5 This application provides a schematic diagram of the structure of an electronic device, which may include:

[0154] Memory 11 is used to store computer programs;

[0155] The processor 10 is configured to execute computer programs to implement the steps of any of the network security incident handling methods described above.

[0156] like Figure 5 The diagram shows the structural composition of an electronic device, which may include a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, memory 11, and communication interface 12 all communicate with each other through the communication bus 13.

[0157] In this embodiment, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic devices.

[0158] The processor 10 can call programs stored in the memory 11. Specifically, the processor 10 can execute operations in the embodiments of the network security incident handling method.

[0159] The memory 11 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 11 stores at least a program for implementing the following functions:

[0160] The system acquires network security events and extracts event information. It then uses a pre-defined association rule base to match the event information using association rules, obtaining matching results. The pre-defined association rule base includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules. For each association rule matching result, the system determines the confidence calculation rule used by the pre-defined association rule corresponding to the matching result, and uses this rule to calculate the confidence of the matching result. Finally, it outputs the target association rule matching result whose confidence exceeds a standard threshold, the target network security event corresponding to the target association rule matching result, and the event information of the target network security event.

[0161] In one possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0162] In addition, memory 11 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0163] Communication interface 12 can be an interface for the communication module, used to connect with other devices or systems.

[0164] Of course, it should be noted that, Figure 5 The structure shown does not constitute a limitation on the electronic device in the embodiments of this application. In practical applications, the electronic device may include more than Figure 5 More or fewer components as shown, or combinations of certain components.

[0165] This application provides a computer-readable storage medium.

[0166] The computer-readable storage medium provided in this application embodiment stores a computer program, which, when executed by a processor, can implement the steps of any of the network security incident handling methods described above.

[0167] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0168] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0169] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0170] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0171] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0172] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for handling network security incidents, characterized in that, include: Obtain network security events and extract event information from the network security events; The event information is matched with association rules using a preset association rule base to obtain the association rule matching results; The preset association rule base includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules. For each association rule matching result, determine the confidence calculation rule used by the preset association rule corresponding to the association rule matching result, and use the confidence calculation rule to calculate the confidence of the association rule matching result to obtain the confidence of the association rule matching result; Output the target association rule matching result with a confidence level exceeding the standard threshold, the target network security event corresponding to the target association rule matching result, and the event information of the target network security event.

2. The network security incident handling method according to claim 1, characterized in that, Before extracting the event information of the network security incident, the process also includes: Extract the fingerprint information of the network security incident; The fingerprint information is matched using a preset fingerprint information database to obtain fingerprint matching results; the preset fingerprint information database includes attack fingerprint information for each preset attack event; When the fingerprint matching result indicates that the fingerprint information matches the preset fingerprint information database, the step of extracting the event information of the network security event is executed; When the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, the network security event is determined to be a non-attack event.

3. The network security incident handling method according to claim 2, characterized in that, Fingerprint matching is performed on the fingerprint information using a preset fingerprint information database to obtain fingerprint matching results, including: The similarity between the fingerprint information and each attack fingerprint information in the preset fingerprint information database is calculated. When there is an attack fingerprint in the preset fingerprint information database whose similarity to the fingerprint information exceeds a preset threshold, the fingerprint matching result is determined to be that the fingerprint information hits the preset fingerprint information database; When there is no attack fingerprint information in the preset fingerprint information database that has a similarity exceeding a preset threshold with the fingerprint information, the fingerprint matching result is determined to be that the fingerprint information does not match the preset fingerprint information database.

4. The network security incident handling method according to claim 1, characterized in that, Before extracting the event information of the network security incident, the process also includes: Extract the attribute information of the network security event; The attribute information is statistically analyzed using a preset baseline model to obtain statistical analysis results; the statistical analysis based on the preset baseline model includes single attribute frequency statistics, attribute combination frequency statistics, time series distribution statistics, and cross-device collaborative statistics; When the statistical analysis result indicates that the attribute information is an abnormal attribute, the step of extracting the event information of the network security event is executed; When the statistical analysis result indicates that the attribute information is a normal attribute, the network security event is determined to be a non-attack event.

5. The network security incident handling method according to claim 1, characterized in that, Before extracting the event information of the network security incident, the process also includes: Extract the fingerprint and attribute information of the network security incident; The fingerprint information is matched using a preset fingerprint information database to obtain the fingerprint matching result; The attribute information is statistically analyzed using a preset baseline model to obtain the statistical analysis results; When the fingerprint matching result is that the fingerprint information matches the preset fingerprint information database and the statistical analysis result is that the attribute information is an abnormal attribute, or when the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, but the statistical analysis result is that the attribute information is an abnormal attribute, the step of extracting the event information of the network security event is executed; When the fingerprint matching result indicates that the fingerprint information matches the preset fingerprint information database, but the statistical analysis result indicates that the attribute information is a normal attribute, the network security event is entered into the manual review queue. When the fingerprint matching result is that the fingerprint information does not match the preset fingerprint information database, and the statistical analysis result is that the attribute information is a normal attribute, the network security event is determined to be a non-attack event.

6. The network security incident handling method according to claim 5, characterized in that, Also includes: Within a preset time period, the output results corresponding to the preset association rule base and the review results of each network security event in the manual review queue are statistically analyzed. The preset association rule base and / or the preset fingerprint information base and / or the preset baseline model are updated based on the output results and the verification results.

7. The network security incident handling method according to claim 1, characterized in that, The association rule matching result of the time-series association rule is the event information of the preceding and / or subsequent associated events of the network security event; the association rule matching result of the cross-device collaborative association rule is the event information of the device associated events of the network security event; the association rule matching result of the attribute association rule is the event information of the attribute associated events of the network security event. The association rule matching result of the frequent itemset association rule is the event information of other network security events in the frequent itemset to which the network security event belongs.

8. A network security incident handling device, characterized in that, include: An extraction module is used to acquire network security events and extract event information from the network security events; The matching module is used to perform association rule matching on the event information using a preset association rule library to obtain the association rule matching result; The preset association rule base includes one or more combinations of time-series association rules, cross-device collaborative association rules, attribute association rules, and frequent itemset association rules. The calculation module is used to determine the confidence calculation rule used by the preset association rule corresponding to each association rule matching result for each association rule matching result, and to calculate the confidence of the association rule matching result by using the confidence calculation rule to calculate the confidence of the association rule matching result. The output module is used to output the target association rule matching result with a confidence level exceeding the standard threshold, the target network security event corresponding to the target association rule matching result, and the event information of the target network security event.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the network security incident handling method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the network security incident handling method as described in any one of claims 1 to 7.

Images