Alarm data aggregation method and device, equipment and medium

Abstract

The invention discloses an alarm data aggregation method and device, equipment and a medium, and belongs to the technical field of computers. According to the method, the importance of condition attributes relative to each equivalence class corresponding to a preset decision attribute set is introduced, and according to the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the whole preset condition attribute set relative to the equivalence class, the equivalence class is determined. And determining an attribute weight of each condition attribute corresponding to the equivalence class, thereby identifying important attributes in respective associated condition attributes under different equivalence classes, and further judging whether the related alarm data is associated with the same attack classification according to the important attributes under each equivalence class. And the alarm data associated with the same attack classification is aggregated.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and specifically relates to an alarm data aggregation method, apparatus, device, and medium. Background Technology

[0002] As the scale of distributed storage continues to expand, the amount of alarm data generated is also growing rapidly. This results in a large amount of redundant and duplicate alarm data in distributed storage, thus affecting the efficiency of alarm analysis.

[0003] In related technologies, alarm data is mainly aggregated through expert experience. However, the aggregation results are easily influenced by the decision-maker's subjectivity, resulting in poor aggregation effect of alarm data. Summary of the Invention

[0004] The purpose of this application is to provide an alarm data aggregation method, apparatus, device, and medium that can solve the problem of poor alarm data aggregation effect in related technologies.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows: In a first aspect, embodiments of this application provide an alarm data aggregation method, the method comprising: Obtain the preset condition attribute set and preset decision attribute set corresponding to the alarm data; The alarm data to be aggregated are divided into equivalence classes corresponding to the preset decision attribute set; For each equivalence class corresponding to the preset decision attribute set, the importance of each condition attribute in the preset condition attribute set relative to the equivalence class is determined based on the conditional coarse entropy. For each equivalence class corresponding to the preset decision attribute set, the attribute weight of each condition attribute corresponding to the equivalence class is determined based on the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class. Based on the attribute weights of the condition attributes corresponding to each equivalence class in the preset decision attribute set, the alarm data corresponding to each equivalence class is aggregated.

[0006] Secondly, embodiments of this application provide an alarm data aggregation device, the device comprising: The attribute set acquisition module is used to acquire the preset condition attribute set and preset decision attribute set corresponding to the alarm data; The data partitioning module is used to partition the alarm data to be aggregated into equivalence classes corresponding to the preset decision attribute set; The importance determination module is used to determine the importance of each condition attribute in the preset condition attribute set relative to the equivalence class based on conditional coarse entropy for each equivalence class corresponding to the preset decision attribute set. The weight determination module is used to determine the attribute weight of each condition attribute corresponding to the equivalence class for each equivalence class corresponding to the preset decision attribute set, based on the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class. The alarm aggregation module is used to aggregate the alarm data corresponding to each equivalence class according to the attribute weight of each condition attribute corresponding to each equivalence class of the preset decision attribute set.

[0007] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the alarm data aggregation method as described in the first aspect.

[0008] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the alarm data aggregation method as described in the first aspect.

[0009] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the alarm data aggregation method as described in the first aspect.

[0010] In this embodiment, considering that different attack categories have different characteristics, the important attributes of the alarm data corresponding to different attack categories will also be different. Therefore, the importance of conditional attributes relative to each equivalence class corresponding to the preset decision attribute set is introduced. Based on the difference between the importance of each conditional attribute in the preset conditional attribute set relative to the equivalence class and the importance of the preset conditional attribute set as a whole relative to the equivalence class, the attribute weight of each conditional attribute corresponding to the equivalence class is determined. This allows the identification of important attributes among the associated conditional attributes under different equivalence classes. Furthermore, based on the important attributes under each equivalence class, it can be determined whether related alarm data are associated with the same attack category. Then, alarm data associated with the same attack category are aggregated. Thus, this application achieves alarm aggregation based on the objective characteristics of the alarm data itself, which can improve the aggregation effect of alarm data, effectively reduce redundant and duplicate alarm data, and thus improve the efficiency of alarm analysis. Attached Figure Description

[0011] Figure 1 A flowchart illustrating the implementation of an alarm data aggregation method provided in this application embodiment; Figure 2 A schematic diagram illustrating the effect of reducing recurring alarms in an embodiment of this application; Figure 3 A schematic diagram of an alarm data aggregation device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0013] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0014] First, to facilitate understanding of the technical solutions provided in this application, the main technical concepts involved in the embodiments of this application will be briefly explained below.

[0015] Conditional entropy H(Y|X): Represents the uncertainty of random variable Y given random variable X. Specifically, conditional entropy H(Y|X) is defined as the expected value of the entropy of the conditional probability distribution of Y with respect to X, given X.

[0016] Conditional coarse entropy is an extension or variant of conditional entropy, typically used to deal with fuzzy or coarse-grained probability distributions (e.g., in fuzzy set theory or rough set theory).

[0017] Knowledge granularity: The partitioning of the universe of discourse constitutes an approximate space of the rough set, and each partitioning unit is called a knowledge granularity. In a rough set, the finer the strength of the equivalence classes, the stronger its partitioning ability and the more precise the approximate set; otherwise, the partitioning ability is weak and the approximate set is coarser.

[0018] Rough sets are a set of theories used to study the representation, learning, and induction of incomplete data and imprecise knowledge. A key characteristic of rough set theory is its ability to analyze facts hidden within data without requiring additional information about the data itself. Its main idea is to derive decision or classification rules for problems through knowledge reduction while maintaining classification ability. From a mathematical perspective, rough sets study sets; from a programming perspective, rough sets study matrices, albeit special ones; from an artificial intelligence perspective, rough sets study decision tables.

[0019] The alarm data aggregation method, apparatus, device, and medium provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0020] See Figure 1 The diagram shown is an implementation flowchart of an alarm data aggregation method provided in this application embodiment. The method may include the following steps: Step S101: Obtain the preset condition attribute set and preset decision attribute set corresponding to the alarm data.

[0021] In this embodiment, attributes describing the characteristics of alarm data but not containing alarm-related decision results can be defined as conditional attributes. For example, attributes of alarm data such as alarm occurrence time, alarm memory keywords, and the device from which the alarm originates can be defined as conditional attributes. By summarizing the determined conditional attributes, the preset conditional attribute set can be obtained.

[0022] Accordingly, attributes used to describe alarm-related decision outcomes can be defined as decision attributes. For example, attributes of alarm data such as alarm type, alarm impact level, and whether manual intervention is required can be defined as decision attributes. By summarizing these defined decision attributes, the preset decision attribute set can be obtained.

[0023] After obtaining the preset condition attribute set and the preset decision attribute set, the preset condition attribute set and the preset decision attribute set can be stored in the database for subsequent retrieval.

[0024] Step S102: Divide the alarm data to be aggregated into equivalence classes corresponding to the preset decision attribute set.

[0025] In this embodiment of the application, after obtaining the preset decision attribute set, the alarm data are grouped according to each decision attribute in the preset decision attribute set. Specifically, one or more alarm data with the same value of each decision attribute are grouped into one group, and then each group is determined as the equivalence class corresponding to the preset decision attribute set.

[0026] Step S103: For each equivalence class corresponding to the preset decision attribute set, determine the importance of each condition attribute in the preset condition attribute set relative to the equivalence class based on conditional coarse entropy.

[0027] In this embodiment, it is considered that for a given information system, it is usually necessary to evaluate the roughness or uncertainty of its target object or target decision. Since the roughness of a rough set monotonically decreases as the knowledge granularity (i.e., knowledge particle size) decreases, this is consistent with human cognitive intuition. However, the roughness of the rough set does not change when the knowledge particles belonging to the positive or negative domain of the set are subdivided.

[0028] Therefore, combining roughness and knowledge granularity can more comprehensively describe the coarseness of knowledge. According to the meaning of knowledge roughness, the smaller the roughness of knowledge, the greater the average amount of information it provides. Subsequently, its average uncertainty and randomness will be smaller, and its coarse entropy should be lower.

[0029] Therefore, a conditional coarse entropy for decision information systems is proposed based on coarse entropy. This conditional coarse entropy can represent the rough entropy of conditional attributes relative to decision attributes. Specifically, the conditional coarse entropy H(Q|P) can represent the average uncertainty that knowledge Q (e.g., related equivalence classes) still exists when knowledge P (e.g., conditional attributes) is known. Based on the level of this average uncertainty, the importance of conditional attributes relative to the equivalence class (i.e., all alarm data under the equivalence class) can be measured.

[0030] Step S104: For each equivalence class corresponding to the preset decision attribute set, determine the attribute weight of each condition attribute corresponding to the equivalence class based on the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class.

[0031] In this embodiment, by calculating the difference between the importance of a conditional attribute relative to an equivalence class and the importance of the entire preset conditional attribute set relative to the equivalence class, the influence of the conditional attribute on the equivalence class can be measured. The smaller the difference, the closer the influence of the conditional attribute on the equivalence class is to the influence of the entire preset conditional attribute set on the equivalence class. Therefore, the conditional attribute is more important than other conditional attributes in the preset conditional attribute set, and its attribute weight will be higher.

[0032] Understandably, compared to the method in related technologies that determines the importance of attributes and assigns weights based on expert experience, this application analyzes the objective characteristics of attributes, measures their importance, and assigns weights accordingly. This avoids the results being influenced by the decision-maker's subjectivity, thereby ensuring the reliability of the results.

[0033] In some embodiments, the difference between the importance of each conditional attribute in the preset conditional attribute set relative to the equivalence class and the importance of the preset conditional attribute set as a whole relative to the equivalence class can be measured by methods such as subtraction, proportionality, or absolute value comparison.

[0034] In some embodiments, the difference in importance between the preset conditional attribute set as a whole and the equivalence class can be determined by summing or averaging, based on the importance of each conditional attribute in the preset conditional attribute set relative to the equivalence class.

[0035] Step S105: Aggregate the alarm data corresponding to each equivalence class according to the attribute weights of each condition attribute corresponding to each equivalence class of the preset decision attribute set.

[0036] In this embodiment, considering that different attack categories have different characteristics, the important attributes of the alarm data corresponding to different attack categories will also be different. Therefore, for each equivalence class, the important attributes associated with the equivalence class (i.e., the conditional attributes with higher attribute weights) can be identified by comparing the attribute weights of each conditional attribute corresponding to that equivalence class. Subsequently, for every two equivalence classes, it can be determined whether the two equivalence classes are associated with the same attack category based on the similarity of the important attributes associated with the two equivalence classes. Then, the alarm data under the two equivalence classes associated with the same attack category are aggregated, thereby reducing redundant and duplicate alarm data, reducing the number of alarms in the distributed storage system, thereby reducing maintenance and operation costs, reducing manpower input, and improving the alarm analysis efficiency of operation and maintenance personnel.

[0037] It should be noted that alarm data under different types (i.e., different attack categories) may exhibit different patterns in alarm features, but previous studies have overlooked this point. This application combines conditional coarse entropy, knowledge granularity, and real historical alarm data to extract important attributes and attribute weights for different attack categories. This allows for the aggregation of alarm data under the same attack category based on whether the patterns presented in alarm features are the same, thereby accurately reducing redundant alarms.

[0038] This application introduces the importance of conditional attributes relative to each equivalence class corresponding to the preset decision attribute set. Based on the difference between the importance of each conditional attribute in the preset conditional attribute set relative to the equivalence class and the overall importance of the preset conditional attribute set relative to the equivalence class, the attribute weight of each conditional attribute corresponding to the equivalence class is determined. This allows for the identification of important attributes among the associated conditional attributes under different equivalence classes. Furthermore, based on the important attributes under each equivalence class, it can be determined whether related alarm data are associated with the same attack category. Alarm data associated with the same attack category are then aggregated. Thus, this application achieves alarm aggregation based on the objective characteristics of the alarm data itself, improving the aggregation effect of alarm data, effectively reducing redundant and duplicate alarm data, and thereby improving the efficiency of alarm analysis.

[0039] As can be seen from the above technical solution, this application considers that while different attack categories have different characteristics, the important attributes of the alarm data corresponding to different attack categories will also be different. Therefore, it introduces the importance of conditional attributes relative to each equivalence class corresponding to the preset decision attribute set. Based on the difference between the importance of each conditional attribute in the preset conditional attribute set relative to the equivalence class and the importance of the preset conditional attribute set as a whole relative to the equivalence class, the attribute weight of each conditional attribute corresponding to the equivalence class is determined. This allows the identification of important attributes among the conditional attributes associated with different equivalence classes. Furthermore, it allows the determination of whether related alarm data are associated with the same attack category based on the important attributes under each equivalence class, and then aggregates the alarm data associated with the same attack category. Thus, this application achieves alarm aggregation based on the objective characteristics of the alarm data itself, which can improve the aggregation effect of alarm data, effectively reduce redundant and duplicate alarm data, and thus improve the efficiency of alarm analysis.

[0040] In some embodiments, the i-th equivalence class corresponding to the preset decision attribute set The corresponding j-th conditional attribute Attribute weight It is determined by the following formula:

[0041] in, express Compared to The importance of This indicates that the preset condition attribute set C as a whole is relative to... The importance of.

[0042] In this embodiment, a summation method is used to determine the difference between the importance of the preset condition attribute set as a whole relative to the equivalence class based on the importance of the condition attribute relative to the equivalence class; and a proportional operation method is used to measure the difference between the importance of the condition attribute relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class, thereby realizing the calculation of the attribute weight of the condition attribute.

[0043] For example, the pseudocode related to attribute weight calculation can be represented as follows: 1. Input knowledge base K=(U,R), R = C ∩ D, where U represents alarm dataset, C represents preset condition attribute set, and D represents preset decision attribute set.

[0044] 2. Calculate the equivalence classes corresponding to C and D respectively. and , where n represents the number of equivalence classes corresponding to C, and m represents the number of equivalence classes corresponding to D.

[0045] 3. for i in (1,m): for j in (1,n): calculate ; end calculate ; end In some embodiments, each condition attribute in the preset condition attribute set C The i-th equivalence class corresponding to the preset decision attribute set D Importance It is determined by the following formula:

[0046] Where Z represents Z is the set of decision attributes, where t represents the number of decision attributes in Z. Let z represent the z-th element in Z, and u represent... The corresponding baseline vector (such as a specific attribute value).

[0047] In some embodiments, the step of aggregating the alarm data corresponding to each equivalence class based on the attribute weights of each condition attribute corresponding to each equivalence class of the preset decision attribute set includes: For each pair of equivalence classes corresponding to the preset decision attribute set, the similarity between the alarm data corresponding to each pair of equivalence classes is determined by the objective formula. For each pair of equivalence classes corresponding to the preset decision attribute set, if the similarity between the alarm data corresponding to the two equivalence classes is higher than the preset similarity threshold, the alarm data corresponding to the two equivalence classes are aggregated. The target formula is expressed as follows:

[0048] in, This represents the similarity between the alarm data corresponding to two equivalence classes, where n represents the number of condition attributes in the preset condition attribute set. This represents the attribute weight of the i-th conditional attribute corresponding to either of the two equivalence classes. This represents the similarity between the i-th conditional attributes corresponding to the two equivalence classes.

[0049] In this embodiment, a weighted sum is calculated based on the attribute weights of each conditional attribute to obtain the similarity between the alarm data corresponding to each of the two equivalence classes. If the similarity is higher than a preset similarity threshold, the alarm data corresponding to each of the two equivalence classes can be aggregated. Thus, alarm data that meet the similarity requirements can be aggregated, thereby eliminating redundant and duplicate alarms.

[0050] In some embodiments, when the similarity between two alarm data within the same time interval is higher than a preset similarity threshold, the one with the later time can be deleted to achieve alarm data aggregation.

[0051] In some embodiments, when the attribute weights of the corresponding conditional attributes of two equivalence classes are different, the attribute with the higher or lower value can be selected to participate in the similarity calculation between the alarm data corresponding to the two equivalence classes.

[0052] In some embodiments, the similarity between the i-th conditional attributes corresponding to the two equivalence classes is... It is determined by the following formula:

[0053] In this embodiment, the similarity between the i-th conditional attribute can be directly determined based on whether the conditional attribute is of equal importance to the two equivalence classes. Then, the similarity between the alarm data corresponding to the two equivalence classes can be calculated only based on the attribute weight values ​​of the conditional attributes that are of equal importance to the two equivalence classes, which can reduce the computational complexity of alarm data similarity.

[0054] In some embodiments, the method further includes: Before dividing the alarm data to be aggregated into the equivalence classes corresponding to the preset decision attribute set, perform at least one of the following attribute preprocessing operations: Item A-1: ​​Convert the non-numeric attributes of each alarm data into numeric attributes; Item A-2: Map all attributes of the aforementioned alarm data to the same scale; Item A-3: Convert the continuous attributes of each alarm data into discrete attributes.

[0055] In this embodiment of the application, for item A-1, considering that alarm data may contain some non-numeric attributes, such as timestamps, alarm counts, alarm levels, alarm resource pools, or alarm types, in order to facilitate subsequent calculations, the non-numeric attributes of the alarm data can be converted into numeric attributes in advance, such as converting character attributes into numeric attributes.

[0056] For item A-2, a statistical distribution of a uniform sample can be determined, and all attributes of the alarm data can be mapped to the same scale to achieve data normalization. This can prevent certain attributes of the alarm data from becoming dominant due to their different dimensions.

[0057] Regarding item A-3: Considering that rough set theory, as an inductive learning method, is only applicable to discrete data, continuous attributes can be converted into discrete attributes (using discretization operations such as clustering discretization) before calculating attribute weights.

[0058] In some embodiments, the discretization operation mainly includes: dividing the value range of a continuous attribute into multiple discrete intervals; and then using different characters (such as symbols or integer values) to represent the continuous attribute falling into each discrete interval.

[0059] Specifically, the discretization operation involves two processes: determining the number of categories n; and mapping continuous attribute values ​​to n category intervals.

[0060] In some embodiments, continuous attribute discretization methods such as equal-width discretization, equal-frequency discretization, and cluster discretization can be used to convert the continuous attributes of alarm data into discrete attributes.

[0061] In some embodiments, converting the continuous attributes of the various alarm data into discrete attributes includes: The K-Means clustering method is used to map the continuous attributes of each alarm data to a preset number of categories; Different characters are used to represent continuous attributes in different categories.

[0062] In this embodiment, the K-Means clustering method can better discretize continuous attributes, so that rough set and knowledge granularity methods can be used to mine data features, thereby determining attribute weights and attribute similarity.

[0063] Understandably, the K-Means clustering method, as a non-hierarchical partitioning clustering algorithm, can operate on a set of data points and assume that the number of clusters (k) to be determined is given, and then cluster the data points based on a continuous similarity metric of distance.

[0064] The main idea of ​​the K-Means clustering method is roughly as follows: Initially, k data points (e.g., continuous attributes) are randomly assigned as cluster centers. Then, each data point in a given set is associated with the nearest cluster center, thus generating the initial distribution of the clusters.

[0065] Then, the average value of all data points in each cluster is calculated as the new cluster center. Each data point is then reassigned to the nearest cluster center to form a new cluster.

[0066] Repeat the above two steps of cluster center selection and sampling point division until the cluster center no longer changes, and the classification result can be obtained.

[0067] This application used the alarm data of Elastic Storage in August as the dataset for experiments. First, the corresponding attribute weight of each alarm was calculated according to the above algorithm. Here we selected 5 representative severe and disaster alarms. Table 1 shows the distribution results of the attribute weights.

[0068] Table 1. Distribution of attribute weights

[0069] This application also defines an alarm aggregation rate to measure the effectiveness of alarm aggregation. Assuming the original number of alarms is N and the remaining number of alarms after aggregation is n, then the alarm aggregation rate is... It can be represented as .

[0070] Alarm aggregation rate describes the efficiency of aggregation algorithms in reducing redundant and duplicate data. To simplify the experiment, we randomly selected alarm data from the dataset over a period of time. Taking a real-world dataset from a company as an example, we calculated the similarity between alarm data based on the distribution of alarm attribute weights, and compared the aggregation results using four different similarity values ​​(i.e., preset similarity thresholds). Figure 2 A schematic diagram illustrating the effect of reducing recurring alarms is shown.

[0071] analyze Figure 2It can be seen that the alarm aggregation rate decreases as the preset similarity threshold increases. When the preset similarity threshold is 0.6, the optimal alarm aggregation rate of 98.64% can be achieved.

[0072] Furthermore, while the average aggregation rate of the four preset similarity thresholds is approximately 97.83%, setting the preset similarity thresholds too low may result in the deletion of non-redundant data. Therefore, a higher similarity threshold should be set according to the specific circumstances to ensure the integrity of alarms, reduce information loss during the aggregation process, and thus ensure the effective elimination of duplicate alarms, providing higher-quality data for the next data aggregation layer.

[0073] In summary, this application can select appropriate important attributes based on the characteristics of the alarm itself, which has a certain degree of flexibility and targeting. It can improve the alarm aggregation rate more comprehensively to a certain extent, reduce information loss during the aggregation process, thereby effectively reducing redundant alarms and helping operation and maintenance personnel improve work efficiency.

[0074] It should be noted that the alarm data aggregation method provided in this application embodiment can be executed by an alarm data aggregation device, or a control module within the alarm data aggregation device for executing the alarm data aggregation loading method. This application embodiment uses the execution of the alarm data aggregation loading method by an alarm data aggregation device as an example to illustrate the alarm data aggregation method provided in this application embodiment.

[0075] This application also provides an alarm data aggregation device, such as... Figure 3 As shown, the device includes: The attribute set acquisition module is used to acquire the preset condition attribute set and preset decision attribute set corresponding to the alarm data; The data partitioning module is used to partition the alarm data to be aggregated into equivalence classes corresponding to the preset decision attribute set; The importance determination module is used to determine the importance of each condition attribute in the preset condition attribute set relative to the equivalence class based on conditional coarse entropy for each equivalence class corresponding to the preset decision attribute set. The weight determination module is used to determine the attribute weight of each condition attribute corresponding to the equivalence class for each equivalence class corresponding to the preset decision attribute set, based on the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class. The alarm aggregation module is used to aggregate the alarm data corresponding to each equivalence class according to the attribute weight of each condition attribute corresponding to each equivalence class of the preset decision attribute set.

[0076] Optionally, the i-th equivalence class corresponding to the preset decision attribute set The corresponding j-th conditional attribute Attribute weight It is determined by the following formula:

[0077] in, express Compared to The importance of This indicates that the preset condition attribute set C as a whole is relative to... The importance of.

[0078] Optionally, each condition attribute in the preset condition attribute set C The i-th equivalence class corresponding to the preset decision attribute set D Importance It is determined by the following formula:

[0079] Where Z represents Z is the set of decision attributes, where t represents the number of decision attributes in Z. Let z represent the z-th element in Z, and u represent... The corresponding reference vector.

[0080] Optionally, the alarm aggregation module is further configured to perform the following steps: For each pair of equivalence classes corresponding to the preset decision attribute set, the similarity between the alarm data corresponding to each pair of equivalence classes is determined by the objective formula. For each pair of equivalence classes corresponding to the preset decision attribute set, if the similarity between the alarm data corresponding to the two equivalence classes is higher than the preset similarity threshold, the alarm data corresponding to the two equivalence classes are aggregated. The target formula is expressed as follows:

[0081] in, This represents the similarity between the alarm data corresponding to two equivalence classes, where n represents the number of condition attributes in the preset condition attribute set. This represents the attribute weight of the i-th conditional attribute corresponding to either of the two equivalence classes. This represents the similarity between the i-th conditional attributes corresponding to the two equivalence classes.

[0082] Optionally, the similarity between the i-th conditional attributes corresponding to the two equivalence classes. It is determined by the following formula:

[0083] Optionally, the device further includes: The attribute preprocessing module is used to perform at least one of the following attribute preprocessing operations before dividing each alarm data to be aggregated into equivalence classes corresponding to the preset decision attribute set: Convert the non-numeric attributes of each alarm data into numeric attributes; Map all attributes of each alarm data to the same scale; The continuous attributes of each alarm data are converted into discrete attributes.

[0084] Optionally, the attribute preprocessing module is further configured to perform the following steps: The K-Means clustering method is used to map the continuous attributes of each alarm data to a preset number of categories; Different characters are used to represent continuous attributes in different categories.

[0085] As can be seen from the above technical solution, this application considers that while different attack categories have different characteristics, the important attributes of the alarm data corresponding to different attack categories will also be different. Therefore, it introduces the importance of conditional attributes relative to each equivalence class corresponding to the preset decision attribute set. Based on the difference between the importance of each conditional attribute in the preset conditional attribute set relative to the equivalence class and the importance of the preset conditional attribute set as a whole relative to the equivalence class, the attribute weight of each conditional attribute corresponding to the equivalence class is determined. This allows the identification of important attributes among the conditional attributes associated with different equivalence classes. Furthermore, it allows the determination of whether related alarm data are associated with the same attack category based on the important attributes under each equivalence class, and then aggregates the alarm data associated with the same attack category. Thus, this application achieves alarm aggregation based on the objective characteristics of the alarm data itself, which can improve the aggregation effect of alarm data, effectively reduce redundant and duplicate alarm data, and thus improve the efficiency of alarm analysis.

[0086] The alarm data aggregation device in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0087] The alarm data aggregation device in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0088] The alarm data aggregation device provided in this application embodiment can achieve... Figure 1 To avoid repetition, the various processes implemented in the alarm data aggregation method embodiment shown will not be described again here.

[0089] Optionally, this application embodiment also provides an electronic device, including a processor 110, a memory 109, and a program or instructions stored in the memory 109 and executable on the processor 110. When the program or instructions are executed by the processor 110, they implement the various processes of the above-described alarm data aggregation method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0090] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0091] Figure 4 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of this application. The electronic device 100 includes, but is not limited to, components such as: radio frequency unit 101, network module 102, audio output unit 103, input unit 104, sensor 105, display unit 106, user input unit 107, interface unit 108, memory 109, and processor 110.

[0092] Those skilled in the art will understand that the electronic device 100 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 110 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 4 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here. The processor 110 is used to perform the following steps: Obtain the preset condition attribute set and preset decision attribute set corresponding to the alarm data; The alarm data to be aggregated are divided into equivalence classes corresponding to the preset decision attribute set; For each equivalence class corresponding to the preset decision attribute set, the importance of each condition attribute in the preset condition attribute set relative to the equivalence class is determined based on the conditional coarse entropy. For each equivalence class corresponding to the preset decision attribute set, the attribute weight of each condition attribute corresponding to the equivalence class is determined based on the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class. Based on the attribute weights of the condition attributes corresponding to each equivalence class in the preset decision attribute set, the alarm data corresponding to each equivalence class is aggregated.

[0093] As can be seen from the above technical solution, this application considers that while different attack categories have different characteristics, the important attributes of the alarm data corresponding to different attack categories will also be different. Therefore, it introduces the importance of conditional attributes relative to each equivalence class corresponding to the preset decision attribute set. Based on the difference between the importance of each conditional attribute in the preset conditional attribute set relative to the equivalence class and the importance of the preset conditional attribute set as a whole relative to the equivalence class, the attribute weight of each conditional attribute corresponding to the equivalence class is determined. This allows the identification of important attributes among the conditional attributes associated with different equivalence classes. Furthermore, it allows the determination of whether related alarm data are associated with the same attack category based on the important attributes under each equivalence class, and then aggregates the alarm data associated with the same attack category. Thus, this application achieves alarm aggregation based on the objective characteristics of the alarm data itself, which can improve the aggregation effect of alarm data, effectively reduce redundant and duplicate alarm data, and thus improve the efficiency of alarm analysis.

[0094] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described alarm data aggregation method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0095] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0096] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described alarm data aggregation method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0097] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0098] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0099] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0100] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for aggregating alarm data, characterized in that, The method includes: Obtain the preset condition attribute set and preset decision attribute set corresponding to the alarm data; The alarm data to be aggregated are divided into equivalence classes corresponding to the preset decision attribute set; For each equivalence class corresponding to the preset decision attribute set, the importance of each condition attribute in the preset condition attribute set relative to the equivalence class is determined based on the conditional coarse entropy. For each equivalence class corresponding to the preset decision attribute set, the attribute weight of each condition attribute corresponding to the equivalence class is determined based on the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class. Based on the attribute weights of the condition attributes corresponding to each equivalence class in the preset decision attribute set, the alarm data corresponding to each equivalence class is aggregated.

2. The method according to claim 1, characterized in that, The i-th equivalence class corresponding to the preset decision attribute set The corresponding j-th conditional attribute Attribute weight It is determined by the following formula: in, express Compared to The importance of This indicates that the preset condition attribute set C as a whole is relative to... The importance of.

3. The method according to claim 1, characterized in that, Each condition attribute in the preset condition attribute set C The i-th equivalence class corresponding to the preset decision attribute set D Importance It is determined by the following formula: Where Z represents Z is the set of decision attributes, where t represents the number of decision attributes in Z. Let z represent the z-th element in Z, and u represent... The corresponding reference vector.

4. The method according to claim 1, characterized in that, The step of aggregating the alarm data corresponding to each equivalence class based on the attribute weights of each condition attribute corresponding to each equivalence class of the preset decision attribute set includes: For each pair of equivalence classes corresponding to the preset decision attribute set, the similarity between the alarm data corresponding to each pair of equivalence classes is determined by the objective formula. For each pair of equivalence classes corresponding to the preset decision attribute set, if the similarity between the alarm data corresponding to the two equivalence classes is higher than the preset similarity threshold, the alarm data corresponding to the two equivalence classes are aggregated. The target formula is expressed as follows: in, This represents the similarity between the alarm data corresponding to two equivalence classes, where n represents the number of condition attributes in the preset condition attribute set. This represents the attribute weight of the i-th conditional attribute corresponding to either of the two equivalence classes. This represents the similarity between the i-th conditional attributes corresponding to the two equivalence classes.

5. The method according to claim 4, characterized in that, Similarity between the i-th conditional attributes corresponding to the two equivalence classes It is determined by the following formula: 。 6. The method according to any one of claims 1-5, characterized in that, The method further includes: Before dividing the alarm data to be aggregated into the equivalence classes corresponding to the preset decision attribute set, perform at least one of the following attribute preprocessing operations: Convert the non-numeric attributes of each alarm data into numeric attributes; Map all attributes of each alarm data to the same scale; The continuous attributes of each alarm data are converted into discrete attributes.

7. The method according to claim 6, characterized in that, The step of converting the continuous attributes of each alarm data into discrete attributes includes: The K-Means clustering method is used to map the continuous attributes of each alarm data to a preset number of categories; Different characters are used to represent continuous attributes in different categories.

8. An alarm data aggregation device, characterized in that, The device includes: The attribute set acquisition module is used to acquire the preset condition attribute set and preset decision attribute set corresponding to the alarm data; The data partitioning module is used to partition the alarm data to be aggregated into equivalence classes corresponding to the preset decision attribute set; The importance determination module is used to determine the importance of each condition attribute in the preset condition attribute set relative to the equivalence class based on conditional coarse entropy for each equivalence class corresponding to the preset decision attribute set. The weight determination module is used to determine the attribute weight of each condition attribute corresponding to the equivalence class for each equivalence class corresponding to the preset decision attribute set, based on the difference between the importance of each condition attribute in the preset condition attribute set relative to the equivalence class and the importance of the preset condition attribute set as a whole relative to the equivalence class. The alarm aggregation module is used to aggregate the alarm data corresponding to each equivalence class according to the attribute weight of each condition attribute corresponding to each equivalence class of the preset decision attribute set.

9. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the alarm data aggregation method as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the alarm data aggregation method as described in any one of claims 1-7.

Images