Equipment configuration alarm method and system
By obtaining a list of accessible sites and generating a list of target sites based on a preset resource scheduling strategy, semantic parsing and multi-dimensional difference analysis of device configuration data are performed to generate structured configuration information. This solves the problem of low accuracy of device configuration alarms in existing technologies and achieves accurate device configuration alarms.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-19
- Publication Date
- 2026-03-13
AI Technical Summary
Existing technologies for device configuration alarms suffer from a lack of understanding of the semantics of configuration terms, leading to false alarms and an inability to identify complex security threats, resulting in low accuracy.
By obtaining a list of accessible sites, a target site list is generated based on a preset resource scheduling strategy. Semantic parsing and multi-dimensional difference analysis of device configuration data are performed to generate structured configuration information. Fusion analysis is then conducted to generate accurate device configuration alarm information.
It improves the accuracy of device configuration alarms, reduces false alarms and false negatives, and can identify complex security threats.
Smart Images
Figure CN121664608A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of equipment management technology, and in particular relates to a method and system for equipment configuration alarm. Background Technology
[0002] Traditional solutions rely on static text comparison of configuration files or rules based on fixed thresholds for alarm detection. However, due to the system's inability to understand configuration semantics, it is difficult to distinguish between harmless changes such as comment modifications or parameter order adjustments and illegal changes such as genuine security policy violations or misconfigurations, resulting in a large number of invalid alarms. Therefore, traditional solutions have a high false alarm rate.
[0003] Existing technologies use algorithms to learn historical patterns in normal device configurations and dynamically predict normal fluctuation ranges, replacing the fixed thresholds of traditional solutions to reduce false alarms caused by normal business fluctuations. However, this existing technology relies solely on historical patterns in device configuration for alarm generation, resulting in a single analytical dimension. The system still cannot understand the semantic information contained in device configurations. Furthermore, existing technologies do not analyze the correlation between device configuration changes scattered across different configuration items, making it difficult to identify complex combined attack intentions such as adding user accounts and modifying network policies. Therefore, when dealing with covert and complex security threats, existing technologies still result in a large number of false negatives and false alarms, significantly reducing the accuracy of device configuration alarms. Summary of the Invention
[0004] The present invention aims to provide a device configuration alarm method and system to solve the above-mentioned technical problems and improve the accuracy of device configuration alarms.
[0005] To address the aforementioned technical problems, this invention provides a device configuration alarm method, comprising the following steps: Obtain a list of accessible sites, and based on the list of accessible sites under a preset resource scheduling strategy, obtain a list of target sites; For each site in the target site list, the alarm generation steps are executed sequentially under the preset category alarm view until the alarm generation steps have been executed for each site, and the updated category alarm view is obtained. Based on the updated classification alarm view, the device configuration alarm results are obtained; The alarm generation step includes: Based on the current target site, the target device is obtained, and the configuration data corresponding to the target device is acquired; The configuration data is semantically parsed to generate structured configuration information; Based on the structured configuration information, a multi-dimensional difference analysis is performed under the preset compliance baseline configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items. Based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item, a fusion analysis is performed to generate the original alarm information corresponding to the target device; Based on the original alarm information, the categorized alarm view is updated according to the preset classification rules.
[0006] The above solution performs semantic parsing of configuration data, extracting its semantic and logical features to generate structured configuration information that represents the true business meaning and internal relationships of the device configuration. Based on this structured configuration information, this solution performs multi-dimensional difference analysis under a preset compliance baseline configuration. This analysis yields security access differences representing unauthorized access permission changes or security policy violations; network configuration differences representing abnormal network connectivity or service configuration risks; integrity differences representing tampering with critical configuration files or non-compliant system versions; and compliance configuration differences representing violations of mandatory industry compliance requirements. Furthermore, this solution performs fusion analysis based on these multi-dimensional differences, ensuring that the generated original alarm information accurately reflects the comprehensive risks and potential security intent of device configuration changes, thereby improving the accuracy of device configuration alarms. Therefore, based on this original alarm information, the final device configuration alarm results obtained by this solution have a higher accuracy rate, improving the overall accuracy of device configuration alarms.
[0007] Furthermore, the step of obtaining the list of accessible sites and obtaining the target site list based on the list of accessible sites under a preset resource scheduling strategy includes: obtaining the user permission range and filtering the list of accessible sites based on the user permission range under a preset site list to obtain the list of accessible sites; and randomly selecting the target site list based on the list of accessible sites under a preset number of concurrent accesses.
[0008] In the above scheme, after obtaining the list of accessible sites, the target site list is randomly selected under the preset number of concurrent accesses for the subsequent device configuration alarm process. The random selection of accessible sites in this scheme promotes the balanced distribution of access resources and can avoid blind spots in device configuration alarm monitoring caused by long-term neglect of certain sites, thereby improving the accuracy of device configuration alarms.
[0009] Furthermore, the step of semantically parsing the configuration data to generate structured configuration information includes: performing deep semantic parsing and feature extraction based on the logical paragraphs and syntax of the configuration data to obtain a configuration feature vector set; constructing a context association model based on the key features in the configuration feature vector set; and forming structured configuration information based on the context association model and the configuration feature vector set.
[0010] The above-mentioned solution, based on the inherent logical paragraphs and syntax of the configuration data, performs deep semantic parsing to identify the semantic units of each configuration item in the configuration data. It then extracts and quantifies each semantic unit into a configuration feature vector, and constructs a configuration feature vector set from all these vectors. Thus, this solution transforms the difficult-to-compute and compare textual information of configuration data into a configuration feature vector set that can characterize the device configuration status and facilitate subsequent comparison and analysis. Based on the obtained configuration feature vector set, this solution constructs a contextual association model for key features within the configuration feature vector set. This allows the solution to understand the relationships between various configuration items in the configuration data based on the contextual association model. Therefore, the structured configuration information formed by this solution, based on the contextual association model and the configuration feature vector set, can better preserve the original business semantics and inherent logic of the configuration data, laying the foundation for subsequent accurate multi-dimensional difference analysis and fusion analysis.
[0011] Further, the step of performing multi-dimensional difference analysis based on the structured configuration information under a preset compliance benchmark configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items includes: comparing access control information in the structured configuration information under a preset compliance benchmark configuration to obtain security access difference items; comparing network-related information in the structured configuration information under a preset compliance benchmark configuration to obtain network configuration difference items; confirming that the hash value of the key configuration file in the structured configuration information does not match the preset compliance benchmark configuration or that the device version number in the structured configuration information does not match the preset compliance benchmark configuration, then an integrity difference item is set as having integrity violation difference; confirming that the enabled data of the configuration items in the structured configuration information does not match the preset compliance benchmark configuration, then a compliance configuration difference item is set as having compliance deviation difference.
[0012] Further, the step of comparing the access control information in the structured configuration information under a preset compliance baseline configuration to obtain security access difference items includes: obtaining the access rule set, administrator account set, and password policy in the structured configuration information; obtaining a new access rule set based on the access rule set under the preset baseline configuration; confirming that the allowed access range corresponding to the new access rule set exceeds the preset access range baseline threshold, then obtaining a security access difference item set as having a high-risk difference; otherwise, determining whether there are unauthorized administrator accounts in the administrator account set under the preset baseline configuration; confirming that there are unauthorized administrator accounts in the administrator account set under the preset baseline configuration, then obtaining a security access difference item set as having a high-risk difference; otherwise, determining whether the password requirements corresponding to the password policy meet the preset password requirements of the preset baseline configuration; confirming that the password requirements corresponding to the password policy do not meet the preset password requirements of the preset baseline configuration, then obtaining a security access difference item set as having a high-risk difference; otherwise, obtaining a security access difference item set as having no high-risk difference.
[0013] Furthermore, the comparison of network-related information in the structured configuration information under a preset compliance baseline configuration to obtain network configuration difference items includes: Obtain the core routing entries, active ports, and critical service information from the structured configuration information; based on the core routing entries, active ports, and critical service information under a preset baseline configuration, obtain the core routing entry status, unauthorized port status, and critical service status; if the core routing entry status is confirmed to be deleted or modified, then a network configuration difference item is set to have a difference affecting service; otherwise, determine whether the unauthorized port status is enabled; if the unauthorized port status is confirmed to be enabled, then a network configuration difference item is set to have a difference affecting service; otherwise, determine whether the critical service status is unexpectedly suspended; if the critical service status is confirmed to be unexpectedly suspended, then a network configuration difference item is set to have a difference affecting service; otherwise, a network configuration difference item is set to have no difference affecting service.
[0014] Further, the step of performing a fusion analysis based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item to generate the original alarm information corresponding to the target device includes: performing a correlation analysis based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item to obtain a correlation analysis result; obtaining a risk intent based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item under a preset risk intent identification strategy; obtaining a first weight corresponding to the security access difference item, a second weight corresponding to the network configuration difference item, a third weight corresponding to the integrity difference item, and a fourth weight corresponding to the compliance configuration difference item based on the correlation analysis result; weighting the security access difference item, the network configuration difference item, the integrity difference item, the compliance configuration difference item, the first weight, the second weight, the third weight, and the fourth weight under a preset base score to generate an alarm level; and generating the original alarm information corresponding to the target device based on the correlation analysis result, the risk intent, and the alarm level.
[0015] In the above solution, correlation analysis is performed based on security access differences, network configuration differences, integrity differences, and compliance configuration differences. This yields correlation analysis results that demonstrate the relationships between these differences. Subsequently, different weights are assigned to each difference based on the correlation analysis results, and each difference and its corresponding weight are weighted under a preset base score to obtain a quantitatively graded alarm level. This solution, based on correlation analysis results and risk intent, can effectively distinguish between malicious attacks and normal operational operations. It can abnormally correlate discrete differences in device configuration data into meaningful threat events, thereby reducing false positives and false negatives in device configuration alarms. Therefore, the original alarm information generated by this solution based on correlation analysis results, risk intent, and alarm levels is more accurate, thus improving the accuracy of device configuration alarms.
[0016] Further, updating the categorized alarm view based on the original alarm information under preset classification rules includes: obtaining the user permission range and filtering the original alarm information based on the user permission range to obtain a valid alarm information set; obtaining the first creation time and current status of each alarm information in the valid alarm information set; obtaining a non-recovered alarm information set based on the alarm information whose current status is pending; obtaining a set of newly added alarm information for the day based on the alarm information whose current status is pending and whose first creation time is the current date; obtaining a set of recovered alarm information for the day based on the alarm information whose current status is processed and whose first creation time is the current date; and updating the categorized alarm view based on the non-recovered alarm information set, the newly added alarm information set for the day, and the recovered alarm information set for the day.
[0017] Furthermore, after updating the categorized alarm view based on the non-recovered alarm information set, the newly added alarm information set of the day, and the recovered alarm information set of the day, the method further includes: in response to a user's troubleshooting instruction, obtaining a troubleshooting alarm information set, and updating the preset compliance baseline configuration based on the troubleshooting alarm information set; and updating the categorized alarm view based on the troubleshooting alarm information set and the valid alarm information set.
[0018] In the above scheme, responding to the user's defect elimination instruction indicates that the user has made defect elimination adjustments to some alarm information in each alarm information set. Therefore, in response to the user's defect elimination instruction, the alarm information that the user has made defect elimination adjustments to is obtained, and the preset compliance benchmark configuration is updated based on the defect elimination alarm information set. This ensures that when the next target site performs the alarm generation step, the configuration data corresponding to the defect elimination alarm information will no longer trigger an alarm, thereby reducing false alarms in device configuration alarms and improving the accuracy of device configuration alarms.
[0019] This invention also provides a device configuration alarm system for implementing any of the device configuration alarm methods described above, comprising: a target site selection module for obtaining an accessible site list and, based on the accessible site list under a preset resource scheduling strategy, obtaining a target site list; a categorized alarm view update module for sequentially executing alarm generation steps for each site in the target site list under a preset categorized alarm view, until each site has executed the alarm generation steps, obtaining an updated categorized alarm view; and a configuration alarm result acquisition module for obtaining a device configuration alarm result based on the updated categorized alarm view; wherein the alarm generation step includes: obtaining a target device based on the current target site and obtaining the configuration data corresponding to the target device; The configuration data is semantically parsed to generate structured configuration information. Based on the structured configuration information, multi-dimensional difference analysis is performed under a preset compliance baseline configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items. The security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items are fused and analyzed to generate the original alarm information corresponding to the target device. Based on the original alarm information, the classified alarm view is updated under preset classification rules.
[0020] The above solution integrates and analyzes security access differences, network configuration differences, integrity differences, and compliance configuration differences. This enables the generated raw alarm information to accurately reflect the comprehensive risks and potential security intent of device configuration changes, thereby improving the accuracy of device configuration alarms. Therefore, based on this raw alarm information, the final device configuration alarm results obtained by this solution have a higher accuracy rate, thus improving the accuracy of device configuration alarms. Attached Figure Description
[0021] Figure 1 A flowchart illustrating the steps of a device configuration alarm method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a device configuration alarm system provided in an embodiment of the present invention. Detailed Implementation
[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0023] Please see Figure 1 This embodiment provides a device configuration alarm method, including the following steps: Step S1: Obtain the list of accessible sites, and based on the list of accessible sites, obtain the list of target sites under a preset resource scheduling strategy; Step S2: For each site in the target site list, execute the alarm generation step sequentially under the preset category alarm view until the alarm generation step has been executed for each site, and obtain the updated category alarm view; Step S3: Obtain the device configuration alarm results based on the updated classification alarm view; The alarm generation step includes: Based on the current target site, the target device is obtained, and the configuration data corresponding to the target device is acquired; The configuration data is semantically parsed to generate structured configuration information; Based on the structured configuration information, a multi-dimensional difference analysis is performed under the preset compliance baseline configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items. Based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item, a fusion analysis is performed to generate the original alarm information corresponding to the target device; Based on the original alarm information, the categorized alarm view is updated according to the preset classification rules.
[0024] The above embodiments perform semantic parsing of configuration data, extracting its semantic and logical features to generate structured configuration information that represents the true business meaning and internal relationships of the device configuration. Based on this structured configuration information, this embodiment performs multi-dimensional difference analysis under a preset compliance baseline configuration. This analysis yields security access differences representing unauthorized access permission changes or security policy violations, network configuration differences representing abnormal network connectivity or service configuration risks, integrity differences representing tampering with critical configuration files or non-compliant system versions, and compliance configuration differences representing violations of mandatory industry compliance requirements. Furthermore, this embodiment performs fusion analysis based on these multi-dimensional differences, enabling the generated original alarm information to accurately reflect the comprehensive risks and potential security intentions of device configuration changes, thereby improving the accuracy of device configuration alarms. Therefore, based on this original alarm information, the final device configuration alarm result obtained in this embodiment has a higher accuracy rate, improving the overall accuracy of device configuration alarms.
[0025] Furthermore, the step of obtaining the list of accessible sites and obtaining the target site list based on the list of accessible sites under a preset resource scheduling strategy includes: obtaining the user permission range and filtering the list of accessible sites based on the user permission range under a preset site list to obtain the list of accessible sites; and randomly selecting the target site list based on the list of accessible sites under a preset number of concurrent accesses.
[0026] In the above embodiments, after obtaining the list of accessible sites, the target site list is randomly selected under a preset number of concurrent accesses for the subsequent device configuration alarm process. The random selection of accessible sites in this embodiment promotes the balanced allocation of access resources and can avoid blind spots in device configuration alarm monitoring caused by neglecting certain sites for a long time, thereby improving the accuracy of device configuration alarms.
[0027] In one embodiment, the user first logs into the system by entering their username, password, and other credentials. The system then simultaneously performs identity authentication and permission verification. During this verification process, the system precisely defines the user's permission scope based on their preset role and responsibilities (e.g., operations manager, general staff member). This permission scope includes specific sites (e.g., substations, power plants) and designated equipment types (e.g., switches, firewalls). Therefore, by filtering based on the user's permission scope, a list of sites accessible to the user can be obtained.
[0028] In one embodiment, the preset concurrent access count is 5. Therefore, in this embodiment, 5 accessible sites are randomly selected from the list of accessible sites as the target site list for subsequent device configuration alarm analysis.
[0029] Furthermore, the step of semantically parsing the configuration data to generate structured configuration information includes: performing deep semantic parsing and feature extraction based on the logical paragraphs and syntax of the configuration data to obtain a configuration feature vector set; constructing a context association model based on the key features in the configuration feature vector set; and forming structured configuration information based on the context association model and the configuration feature vector set.
[0030] The above embodiments, based on the inherent logical paragraphs and syntax of the configuration data, perform deep semantic parsing to identify the semantic units (such as functions, attributes, parameters, and their values) of each configuration item in the configuration data. Feature extraction is then performed to extract and quantify each semantic unit into a configuration feature vector, and all configuration feature vectors are combined to form a configuration feature vector set. Thus, this embodiment transforms the difficult-to-computate and compare configuration data text information into a configuration feature vector set that can characterize the device configuration status and facilitate subsequent comparison and analysis. Based on the obtained configuration feature vector set, this embodiment constructs a context association model for key features within the configuration feature vector set, enabling it to understand the relationships between configuration items in the configuration data. Therefore, the structured configuration information formed by this embodiment based on the context association model and the configuration feature vector set can better preserve the original configuration data's business semantics and inherent logic, laying the foundation for subsequent accurate multi-dimensional difference analysis and fusion analysis.
[0031] In the above embodiments, the context association model can characterize deep logic such as "access allowed by the firewall rule corresponding to a certain configuration feature vector depends on the network reachability defined by the routing entry corresponding to another configuration feature vector".
[0032] Further, the step of performing multi-dimensional difference analysis based on the structured configuration information under a preset compliance benchmark configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items includes: comparing access control information in the structured configuration information under a preset compliance benchmark configuration to obtain security access difference items; comparing network-related information in the structured configuration information under a preset compliance benchmark configuration to obtain network configuration difference items; confirming that the hash value of the key configuration file in the structured configuration information does not match the preset compliance benchmark configuration or that the device version number in the structured configuration information does not match the preset compliance benchmark configuration, then an integrity difference item is set as having integrity violation difference; confirming that the enabled data of the configuration items in the structured configuration information does not match the preset compliance benchmark configuration, then a compliance configuration difference item is set as having compliance deviation difference.
[0033] In one embodiment, if the hash values of the system startup configuration file and security policy file in the critical configuration file do not match the baseline value corresponding to the preset compliance baseline configuration, it indicates that the content of the critical configuration file has been tampered with or damaged, and the integrity difference item needs to be set to indicate that there is an integrity violation difference. If the device version number is different from the baseline security version required by the preset compliance baseline configuration, the integrity difference item needs to be set to indicate that there is an integrity violation difference.
[0034] In one embodiment, if the configuration item data corresponding to the industry mandatory compliance rule set in the configuration item enabled data is found to be inconsistent with the compliance baseline corresponding to its preset compliance benchmark configuration, then the compliance configuration difference item is set to have a compliance deviation difference. If, after comparing the configuration item enabled data with the preset compliance benchmark configuration, it is found that the audit log retention time is not up to standard or the necessary encryption protocol is not enabled, then the compliance configuration difference item is set to have a compliance deviation difference.
[0035] Further, the step of comparing the access control information in the structured configuration information under a preset compliance baseline configuration to obtain security access difference items includes: obtaining the access rule set, administrator account set, and password policy in the structured configuration information; obtaining a new access rule set based on the access rule set under the preset baseline configuration; confirming that the allowed access range corresponding to the new access rule set exceeds the preset access range baseline threshold, then obtaining a security access difference item set as having a high-risk difference; otherwise, determining whether there are unauthorized administrator accounts in the administrator account set under the preset baseline configuration; confirming that there are unauthorized administrator accounts in the administrator account set under the preset baseline configuration, then obtaining a security access difference item set as having a high-risk difference; otherwise, determining whether the password requirements corresponding to the password policy meet the preset password requirements of the preset baseline configuration; confirming that the password requirements corresponding to the password policy do not meet the preset password requirements of the preset baseline configuration, then obtaining a security access difference item set as having a high-risk difference; otherwise, obtaining a security access difference item set as having no high-risk difference.
[0036] In one embodiment, if it is confirmed that the allowed access range corresponding to the newly added access rule set exceeds the preset access range baseline threshold, it indicates that an access rule with an excessively large allowed access range has been added, and the security access difference item needs to be set to "high-risk difference". If it is confirmed that there is an unauthorized administrator account in the administrator account set under the preset baseline configuration, it indicates that the unauthorized administrator account has configured the device, which poses a significant risk, and the security access difference item needs to be set to "high-risk difference". If it is confirmed that the password requirement corresponding to the password policy does not meet the preset password requirement of the preset baseline configuration, it indicates that the password policy has been modified to a weak password requirement, and the device configuration is vulnerable to attack and modification, and the security access difference item needs to be set to "high-risk difference".
[0037] Further, the comparison of network-related information in the structured configuration information under a preset compliance baseline configuration to obtain network configuration difference items includes: obtaining core routing entries, active ports, and critical business services in the structured configuration information; obtaining the status of core routing entries, unauthorized ports, and critical business services under a preset baseline configuration based on the core routing entries, active ports, and critical business services; confirming that the status of the core routing entries has been deleted or modified, then obtaining a network configuration difference item set to have a difference affecting services; otherwise, determining whether the status of the unauthorized ports is enabled; confirming that the status of the unauthorized ports is enabled, then obtaining a network configuration difference item set to have a difference affecting services; otherwise, determining whether the status of the critical business services has been unexpectedly suspended; confirming that the status of the critical business services has been unexpectedly suspended, then obtaining a network configuration difference item set to have a difference affecting services; otherwise, obtaining a network configuration difference item set to have no difference affecting services.
[0038] In the above embodiments, the core routing entry includes IP address, router entry, and VLAN segmentation; the active port includes the port number activated on the target device; and the critical service includes a list of services running in the system background. Based on a comparison of the core routing entry, active port, and critical service under a preset baseline configuration, the status of the core routing entry, the status of the unauthorized port, and the status of the critical service are obtained. If the core routing entry status is deleted or modified, network reachability will change, and the network configuration difference item needs to be set to indicate that there is a difference affecting services. If the unauthorized port status is enabled, the network configuration difference item needs to be set to indicate that there is a difference affecting services. If the critical service status is unexpectedly suspended, the network configuration difference item needs to be set to indicate that there is a difference affecting services.
[0039] Further, the step of performing a fusion analysis based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item to generate the original alarm information corresponding to the target device includes: performing a correlation analysis based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item to obtain a correlation analysis result; obtaining a risk intent based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item under a preset risk intent identification strategy; obtaining a first weight corresponding to the security access difference item, a second weight corresponding to the network configuration difference item, a third weight corresponding to the integrity difference item, and a fourth weight corresponding to the compliance configuration difference item based on the correlation analysis result; weighting the security access difference item, the network configuration difference item, the integrity difference item, the compliance configuration difference item, the first weight, the second weight, the third weight, and the fourth weight under a preset base score to generate an alarm level; and generating the original alarm information corresponding to the target device based on the correlation analysis result, the risk intent, and the alarm level.
[0040] In the above embodiments, correlation analysis is performed based on security access differences, network configuration differences, integrity differences, and compliance configuration differences to obtain correlation analysis results that reflect the relationships between the differences. Subsequently, different weights are assigned to each difference based on the correlation analysis results, and each difference and its corresponding weight are weighted under a preset base score to obtain a quantitatively graded alarm level. This embodiment can effectively distinguish between malicious attacks and normal operation and maintenance based on correlation analysis results and risk intent. It can abnormally correlate discrete differences in device configuration data into meaningful threat events, thereby reducing false alarms and false negatives in device configuration alarms. Therefore, the original alarm information generated by this embodiment based on correlation analysis results, risk intent, and alarm level is more accurate, thus improving the accuracy of device configuration alarms.
[0041] In one embodiment, the occurrence time, context, and logical information of each of the security access difference item, network configuration difference item, integrity difference item, and compliance configuration difference item are examined to obtain the correlation analysis results. As an example, and not a limitation, if a high-risk difference is identified in the security access difference item, and this high-risk difference is caused by "adding an unauthorized administrator account," and within a short period, a difference affecting business operations is also identified in the network configuration difference item, and this difference affecting business operations is caused by "opening a remote access port (such as SSH or RDP)," and a correlation analysis result of "suspected lateral movement attempt" is generated; if an integrity difference item has an integrity violation difference, and this integrity violation difference is caused by "key configuration file hash value mismatch," but the compliance configuration difference item has no compliance deviation difference, and other differences have no corresponding differences, then a correlation analysis result of "potential configuration corruption" is generated.
[0042] In one embodiment, a risk intent is obtained based on security access differences, network configuration differences, integrity differences, and compliance configuration differences under a preset risk intent identification strategy. This is an example, not a limitation. If a corresponding difference exists in the network configuration difference but no corresponding difference exists in the security access difference, it may indicate an operational error, and the risk intent is inferred to be "configuration error." If only the compliance configuration difference has a corresponding difference, the risk intent is inferred to be "compliance adjustment." If both the integrity and security access differences have corresponding differences, it may indicate malicious activity, and the risk intent is inferred to be "suspected attack behavior."
[0043] In one embodiment, security access differences, network configuration differences, integrity differences, and compliance configuration differences each have a corresponding base risk score under a preset base score. For example, the base risk score for a security access difference with high risk is 10, and the base risk score for a network configuration difference with business impact is 5. This solution adjusts the weights of each difference based on the correlation analysis results, causing the base risk scores for each difference to be adjusted accordingly, resulting in a superimposed risk score. The corresponding alarm level is then determined by comparing the risk score with a preset threshold. This embodiment generates the original alarm information corresponding to the target device based on the correlation analysis results, risk intent, and alarm level.
[0044] In one embodiment, the original alarm information includes an alarm title, an alarm level, and a detailed description. As an example, and not a limitation, the generated original alarm information includes an alarm title generated based on risk intent, such as "Multi-dimensional configuration changes: Potential attack attempts"; an alarm level of alert, warning, or critical; and a detailed description generated based on various discrepancies and correlation analysis results, such as "A new account and network service were detected to have opened a remote port under a security policy; correlation analysis indicates a possible establishment of a covert channel."
[0045] Further, updating the categorized alarm view based on the original alarm information under preset classification rules includes: obtaining the user permission range and filtering the original alarm information based on the user permission range to obtain a valid alarm information set; obtaining the first creation time and current status of each alarm information in the valid alarm information set; obtaining a non-recovered alarm information set based on the alarm information whose current status is pending; obtaining a set of newly added alarm information for the day based on the alarm information whose current status is pending and whose first creation time is the current date; obtaining a set of recovered alarm information for the day based on the alarm information whose current status is processed and whose first creation time is the current date; and updating the categorized alarm view based on the non-recovered alarm information set, the newly added alarm information set for the day, and the recovered alarm information set for the day.
[0046] In one embodiment, the user permission scope is obtained based on a pre-constructed dynamic permission relationship graph. In this graph, nodes encompass entities such as users, teams, sites, devices, network regions, and business applications, while edges represent complex permissions and relationships between entities, with weights indicating the strength of these relationships. This embodiment first matches high-strength direct relationships between users and alarm-related devices / sites based on the dynamic permission relationship graph and filters core resource alarms. Then, starting with the user, it explores multiple paths, identifying indirectly related alarms (including alarms related to upstream and downstream nodes, business-bearing devices, and historically high-frequency processing objects) based on topological associations, business impact, and historical collaboration rules. Based on these indirectly related alarms and core resource alarms with high-strength direct relationships between users and alarm-related devices / sites, the user permission scope is obtained. Subsequently, this embodiment filters the original alarm information based on the user permission scope to obtain a valid alarm information set. This valid alarm information set removes irrelevant alarm data outside the user permission scope from the original alarm information, retaining only alarm information that the user has the authority to process.
[0047] Furthermore, after updating the categorized alarm view based on the non-recovered alarm information set, the newly added alarm information set of the day, and the recovered alarm information set of the day, the method further includes: in response to a user's troubleshooting instruction, obtaining a troubleshooting alarm information set, and updating the preset compliance baseline configuration based on the troubleshooting alarm information set; and updating the categorized alarm view based on the troubleshooting alarm information set and the valid alarm information set.
[0048] In the above embodiments, responding to a user's troubleshooting instruction indicates that the user has made troubleshooting adjustments to a portion of the alarm information in each alarm information set. Therefore, in response to the user's troubleshooting instruction, the alarm information for which the user has made troubleshooting adjustments is obtained, and the preset compliance benchmark configuration is updated based on the troubleshooting alarm information set. This ensures that when the next target site performs the alarm generation step, the configuration data corresponding to the troubleshooting alarm information will no longer trigger an alarm, thereby reducing false alarms in device configuration alarms and improving the accuracy of device configuration alarms.
[0049] In one embodiment, in response to a user's troubleshooting instruction, alarm information whose status has been updated from un-troubleshooted and unprocessed to troubleshooted and processed is obtained as a troubleshooting alarm information set; the preset compliance baseline configuration is updated according to the configuration data corresponding to the troubleshooting alarm information in the troubleshooting alarm information set; and the classified alarm view is updated again according to the troubleshooting alarm information set and the valid alarm information set.
[0050] Please see Figure 2 This embodiment also provides a device configuration alarm system for implementing any of the device configuration alarm methods described above, including: a target site selection module for obtaining an accessible site list and, based on the accessible site list under a preset resource scheduling strategy, obtaining a target site list; a classification alarm view update module for sequentially executing alarm generation steps for each site in the target site list under a preset classification alarm view, until each site has executed the alarm generation steps, obtaining an updated classification alarm view; and a configuration alarm result acquisition module for obtaining a device configuration alarm result based on the updated classification alarm view; the alarm generation step includes: obtaining a target device based on the current target site and obtaining the configuration data corresponding to the target device; The configuration data is semantically parsed to generate structured configuration information. Based on the structured configuration information, multi-dimensional difference analysis is performed under a preset compliance baseline configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items. The security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items are fused and analyzed to generate the original alarm information corresponding to the target device. Based on the original alarm information, the classified alarm view is updated under preset classification rules.
[0051] The above embodiments perform fusion analysis based on security access differences, network configuration differences, integrity differences, and compliance configuration differences. This enables the generated original alarm information to accurately reflect the comprehensive risks and potential security intentions of device configuration changes, thereby improving the accuracy of device configuration alarms. Therefore, based on this original alarm information, the final device configuration alarm result obtained in this embodiment has a higher alarm accuracy rate, thus improving the accuracy of device configuration alarms.
[0052] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.
Claims
1. A device configuration alarm method, characterized in that, Includes the following steps: Obtain a list of accessible sites, and based on the list of accessible sites under a preset resource scheduling strategy, obtain a list of target sites; For each site in the target site list, the alarm generation steps are executed sequentially under the preset category alarm view until the alarm generation steps have been executed for each site, and the updated category alarm view is obtained. Based on the updated classification alarm view, the device configuration alarm results are obtained; The alarm generation step includes: Based on the current target site, the target device is obtained, and the configuration data corresponding to the target device is acquired; The configuration data is semantically parsed to generate structured configuration information; Based on the structured configuration information, a multi-dimensional difference analysis is performed under the preset compliance baseline configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items. Based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item, a fusion analysis is performed to generate the original alarm information corresponding to the target device; Based on the original alarm information, the categorized alarm view is updated according to the preset classification rules.
2. The device configuration alarm method as described in claim 1, characterized in that, The step of obtaining the list of accessible sites and, based on the list of accessible sites under a preset resource scheduling strategy, obtaining the list of target sites includes: Obtain the user's permission scope, and filter the list of accessible sites based on the user's permission scope; The target site list is obtained by randomly selecting sites from the list of accessible sites under a preset number of concurrent accesses.
3. The device configuration alarm method as described in claim 1, characterized in that, The step of semantically parsing the configuration data to generate structured configuration information includes: Based on the logical paragraphs and syntax of the configuration data, deep semantic parsing and feature extraction are performed to obtain a configuration feature vector set; Based on the key features in the configuration feature vector set, a context association model is constructed; Based on the context association model and the configuration feature vector set, structured configuration information is formed.
4. The device configuration alarm method as described in claim 1, characterized in that, Based on the structured configuration information, a multi-dimensional difference analysis is performed under a preset compliance baseline configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items, including: Based on the access control information in the structured configuration information, a comparison is made under the preset compliance benchmark configuration to obtain security access difference items; Based on the network-related information in the structured configuration information, a comparison is made under a preset compliance benchmark configuration to obtain network configuration differences. If it is confirmed that the hash value of the key configuration file in the structured configuration information does not match the preset compliance benchmark configuration or the device version number in the structured configuration information does not match the preset compliance benchmark configuration, then an integrity difference item is set as having an integrity violation difference. If it is confirmed that the enabled data of the configuration items in the structured configuration information does not match the preset compliance benchmark configuration, then the compliance configuration difference item is set as having a compliance deviation difference.
5. The device configuration alarm method as described in claim 4, characterized in that, The comparison is performed based on the access control information in the structured configuration information under a preset compliance baseline configuration to obtain security access difference items, including: Obtain the access rule set, administrator account set, and password policy from the structured configuration information; Based on the aforementioned access rule set under a preset baseline configuration, a new access rule set is obtained; If the allowed access range corresponding to the newly added access rule set exceeds the preset access range baseline threshold, then a security access difference item with high risk difference is obtained; otherwise, it is determined whether there is an unauthorized administrator account in the administrator account set under the preset baseline configuration. If it is confirmed that there are unauthorized administrator accounts in the administrator account set under the preset baseline configuration, then a security access difference item with high risk difference is obtained; otherwise, it is determined whether the password requirements corresponding to the password policy meet the preset password requirements of the preset baseline configuration. If it is confirmed that the password requirements corresponding to the password policy do not meet the preset password requirements of the preset baseline configuration, then a security access difference item with high risk difference is obtained; otherwise, a security access difference item without high risk difference is obtained.
6. The device configuration alarm method as described in claim 4, characterized in that, The comparison of network-related information in the structured configuration information under a preset compliance baseline configuration yields network configuration differences, including: Obtain the core routing entries, activation ports, and key business services from the structured configuration information; Based on the core routing entries, the activated ports, and the critical business services under a preset baseline configuration, the status of the core routing entries, the status of the unauthorized ports, and the status of the critical business services are obtained. If the status of the core routing entry is confirmed to be deleted or modified, then the network configuration difference item that affects service differences is obtained; otherwise, it is determined whether the status of the unauthorized port is enabled. If the unauthorized port is confirmed to be open, then the network configuration difference item that affects the service is obtained; otherwise, it is determined whether the critical service status is unexpectedly suspended. If the critical business service status is confirmed to be unexpectedly suspended, then a network configuration difference item is obtained that has an impact on the business; otherwise, a network configuration difference item is obtained that has no impact on the business.
7. The device configuration alarm method as described in claim 1, characterized in that, The method involves fusing and analyzing the security access differences, network configuration differences, integrity differences, and compliance configuration differences to generate the original alarm information corresponding to the target device, including: Based on the security access differences, network configuration differences, integrity differences, and compliance configuration differences, a correlation analysis is performed to obtain the correlation analysis results. Based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item, a risk intent is obtained under a preset risk intent identification strategy; Based on the correlation analysis results, the first weight corresponding to the security access difference item, the second weight corresponding to the network configuration difference item, the third weight corresponding to the integrity difference item, and the fourth weight corresponding to the compliance configuration difference item are obtained. Based on the security access difference item, the network configuration difference item, the integrity difference item, the compliance configuration difference item, the first weight, the second weight, the third weight, and the fourth weight, an alarm level is generated by weighting the data under a preset base score. Based on the correlation analysis results, the risk intent, and the alarm level, the original alarm information corresponding to the target device is generated.
8. The device configuration alarm method as described in claim 1, characterized in that, The step of updating the categorized alarm view based on the original alarm information and under preset classification rules includes: Obtain the user permission scope, and filter the original alarm information based on the user permission scope to obtain a set of valid alarm information; Obtain the initial creation time and current status of each alarm in the valid alarm information set; Based on the alarm information that is currently pending processing, a set of non-recovered alarm information is obtained; Based on the alarm information whose current status is pending and whose first creation time is the current date, a set of newly added alarm information for the day is obtained; Based on the alarm information whose current status is "processed" and whose initial creation time is the current date, the set of alarm information for the day's regression is obtained; Update the categorized alarm view based on the non-recovered alarm information set, the newly added alarm information set for the day, and the recovered alarm information set for the day.
9. The device configuration alarm method as described in claim 8, characterized in that, After updating the categorized alarm view based on the non-recovered alarm information set, the newly added alarm information set for the day, and the recovered alarm information set for the day, the method further includes: In response to a user's defect elimination command, obtain a defect elimination alarm information set, and update the preset compliance benchmark configuration based on the defect elimination alarm information set; Update the categorized alarm view based on the defect elimination alarm information set and the valid alarm information set.
10. A device configuration alarm system, characterized in that, A device configuration alarm method as described in any one of claims 1 to 9, comprising: The target site selection module is used to obtain a list of accessible sites and, based on the list of accessible sites, obtain a list of target sites under a preset resource scheduling strategy. The category alarm view update module is used to sequentially execute alarm generation steps under a preset category alarm view for each site in the target site list until the alarm generation steps have been executed for each site, and obtain the updated category alarm view. The alarm result acquisition module is used to obtain the device configuration alarm result based on the updated classified alarm view; The alarm generation step includes: Based on the current target site, the target device is obtained, and the configuration data corresponding to the target device is acquired; The configuration data is semantically parsed to generate structured configuration information; Based on the structured configuration information, a multi-dimensional difference analysis is performed under the preset compliance baseline configuration to generate security access difference items, network configuration difference items, integrity difference items, and compliance configuration difference items. Based on the security access difference item, the network configuration difference item, the integrity difference item, and the compliance configuration difference item, a fusion analysis is performed to generate the original alarm information corresponding to the target device; Based on the original alarm information, the categorized alarm view is updated according to the preset classification rules.