Intelligent aggregation noise reduction and risk assessment method and system for network security alarm

Abstract

The invention relates to the technical field of network security, and discloses an intelligent aggregation noise reduction and risk assessment method and system for network security alarms, and the method comprises the steps: firstly collecting a multi-source heterogeneous security alarm log, and converting the log into structured data in a unified format; extracting basic semantics, time-space association and asset risk multi-dimensional features, and generating an alarm feature vector through fusion of an attention gating mechanism; then constructing a network security heterogeneous dynamic atlas containing multiple entity types, and dynamically updating the atlas structure and weight by using a time sequence attenuation model; performing feature learning on the atlas by using a type-aware adaptive graph attention network, generating an atlas representation vector, executing alarm clustering and risk sorting, and outputting aggregated security events; and finally, collecting an artificial feedback signal, and constructing a double-loop feedback mechanism to carry out iterative optimization on the model. According to the method, through multi-dimensional feature fusion, dynamic map correlation analysis and man-machine collaborative feedback, accurate aggregation noise reduction and risk quantitative evaluation of massive alarms are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for intelligent aggregation, noise reduction, and risk assessment of network security alarms. Background Technology

[0002] As cyberattacks become increasingly sophisticated and automated, enterprises and organizations deploy various security devices, including firewalls, intrusion detection systems, and web application protection systems. These devices generate massive amounts of alert logs during daily operation, forming the primary data source for security operations centers. However, existing alert processing and analysis technologies still face numerous challenges in practical applications when confronted with the exponentially growing alert data.

[0003] Traditional alert analysis methods primarily rely on predefined signature rules or single-dimensional statistical thresholds. This approach typically only matches keywords in logs or simply counts frequencies within a time period, lacking an understanding of the deep semantic information within the alert payload and failing to fully integrate contextual information such as the business value of the protected assets, vulnerability status, and the spatiotemporal environment in which the alert occurred. This lack of multi-dimensional feature mining leads to a large number of low-risk scanning and probing behaviors or normal business operations being falsely reported as serious threats, generating significant background noise and making it difficult for security analysts to sift through massive alerts to identify truly destructive attacks.

[0004] Furthermore, modern cyberattacks are typically characterized by being cross-device, cross-phase, and long-lasting, with attackers often using different types of assets as springboards for lateral movement. Existing correlation analysis techniques often struggle to effectively construct dependencies between heterogeneous entities when dealing with such complex attacks. Many solutions treat alerts as independent events or only construct simple, homogeneous network graphs, ignoring the differences in interactions between different types of network nodes (such as IPs, accounts, and devices). This prevents the system from reconstructing a complete attack chain from related alerts scattered across different devices and time points, resulting in fragmented security events and hindering the assessment and tracing of the full attack picture.

[0005] Furthermore, the cyber threat environment is constantly evolving, with new attack variants emerging one after another. Existing intelligent analysis models mostly employ offline training and static deployment, lacking an efficient mechanism to integrate feedback and experience gained by security operations personnel in daily operations. When models need to be updated to adapt to new attacks, they often face the problems of high retraining costs and "catastrophic forgetting"—that is, losing the ability to identify historical attack characteristics while learning new patterns. Due to the lack of an effective human-machine co-evolution mechanism, existing systems struggle to maintain historical knowledge accumulation while rapidly responding to new threat changes, making it difficult to maintain the long-term accuracy of the models. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides an intelligent aggregation, noise reduction, and risk assessment method and system for network security alarms. It solves the problems of existing technologies, such as high false alarm noise due to reliance on single-dimensional features, fragmentation of complex attack behaviors due to difficulty in handling heterogeneous node topological relationships, and catastrophic forgetting during model iteration and optimization due to the lack of an efficient human-computer feedback mechanism.

[0007] The first aspect of this invention provides a method for intelligent aggregation, noise reduction, and risk assessment of network security alarms.

[0008] This method addresses the problems of massive numbers of network security alerts, high false alarm rates, and difficulties in cross-device correlation analysis. It achieves accurate alert aggregation and risk quantification through multi-source data fusion, dynamic graph construction, and adaptive feedback learning mechanisms. The method includes the following steps: S101. Collect multi-source heterogeneous security alarm log data through a unified data interface, standardize and clean the security alarm log data, and convert the cleaned data into structured data in a unified format. This process eliminates the differences in log formats between different security devices.

[0009] S102. Perform multi-dimensional feature extraction on structured data. The extraction process covers basic semantic features, spatiotemporal correlation features, and asset risk features. An attention gating mechanism is used to fuse these features to generate an alarm feature vector.

[0010] S103. Based on alarm feature vectors and structured data, construct a heterogeneous dynamic network security graph containing multiple entity types, and dynamically update the edge structure and weights in the graph according to a time-series decay model. This step transforms discrete alarm data into graph structure data with topological relationships.

[0011] S104. Utilize a type-aware adaptive graph attention network model to perform feature learning on the heterogeneous dynamic graph of network security, generating graph representation vectors for alarms. Based on the graph representation vectors, perform alarm clustering and risk ranking, and output the aggregated security events.

[0012] S105. Collect human feedback signals for security incidents, construct a dual-loop feedback mechanism that includes real-time parameter adjustment and periodic structural updates, and iteratively optimize the type-aware adaptive graph attention network model based on the feedback signals.

[0013] In one possible implementation, the process of extracting basic semantic features involves deep quantization of the text data. Specifically, the alarm description text, protocol type, and alarm type fields are obtained from the structured data. These fields are then segmented to generate a word sequence, and a weighted word embedding algorithm is used to calculate the feature vector of each word unit in the word sequence. During the calculation, it is determined whether the word unit belongs to a pre-defined cybersecurity domain-specific attack dictionary: if it does, it is assigned a domain weight coefficient containing a domain enhancement factor; otherwise, it is assigned a default weight coefficient. The standard embedding vector of the word unit in the general semantic space is multiplied by the domain weight coefficient. Finally, a weighted summation based on an attention mechanism is performed on the feature vectors of all word units in the word sequence to obtain the basic semantic feature vector.

[0014] In one possible implementation, spatiotemporal correlation features are extracted by quantifying the disorder and suddenness of temporal distribution and the logical distance in space.

[0015] In the time dimension, a sliding time window is set and divided into multiple equal-length sub-intervals. The alarm distribution probability of each sub-interval is calculated. The trend entropy is obtained by calculating the negative of the sum of the products of the alarm distribution probability and its logarithmic value. At the same time, the maximum, mean, and standard deviation of the number of alarms in the sub-intervals within the sliding time window are statistically analyzed. The ratio of the difference between the maximum and the mean to the sum of the standard deviation and the smoothing term is calculated to obtain the outbreak intensity.

[0016] In the spatial dimension, the system calls upon the geographic location information database and routing trajectory data to calculate the logical distance and network hop count between the source Internet Protocol address and the destination Internet Protocol address.

[0017] Finally, the trend entropy, burst intensity, logical distance, and network hop count are combined to construct a spatiotemporal correlation feature vector.

[0018] In one possible implementation, the process of extracting asset risk characteristics and fusing those characteristics takes into account the vulnerability and importance of the asset itself.

[0019] Access the configuration management database via API to query the attribute information of asset objects corresponding to Internet Protocol addresses in the structured data. Using a linear weighted summation method, the vulnerability severity score, business core level value, and normalized value of historical attack frequency of the asset object are multiplied by their corresponding preset weight coefficients to obtain the asset risk feature vector.

[0020] In the feature fusion stage, the basic semantic feature vector, spatiotemporal correlation feature vector, and asset risk feature vector are concatenated to obtain a concatenated feature vector. Using an attention gating unit, the concatenated feature vector undergoes a linear transformation and a bias is added. Then, a sigmoid activation function is used to calculate the gating weight vector. Finally, the alarm feature vector is generated by performing element-wise multiplication between the gating weight vector and the concatenated feature vector.

[0021] In one possible implementation, the dynamic updating of the edge structure and weights in the graph employs a time-decay mechanism to reflect the time-varying characteristics of network attacks.

[0022] Define a set of nodes that includes Internet Protocol addresses, security devices, user accounts, business systems, and attack types, as well as a set of edges that includes communication relationships, detection relationships, attribution relationships, and association relationships.

[0023] The edge weights at the current moment are calculated using a time-decaying weighted model. The calculation process includes three components: the first component is the product of the number of interactions between nodes and a time factor containing an exponential decay term, where the exponential decay term is calculated based on the time difference between the current moment and the moment the most recent event occurred; the second component is the sum of the risk level values ​​of all alarms associated with the nodes; and the third component is the recent activity score of the node. The edge weights are obtained by weighted summing of the first, second, and third components.

[0024] When the calculated edge weight is lower than the preset pruning threshold, the edge is removed from the current computation graph and archived to maintain the sparsity of the graph and computational efficiency.

[0025] In one possible implementation, a flow-adaptive sliding window mechanism is used to manage the data update cycle when constructing the data graph. The current alarm flow density is monitored in real time: when the alarm flow density is higher than a preset high flow threshold, the sliding window size is set to a preset minimum window duration; when the alarm flow density is lower than a preset low flow threshold, the sliding window size is set to a preset maximum window duration; when the alarm flow density is between the two, the sliding window size is calculated using a linear interpolation function.

[0026] In one possible implementation, a type-aware adaptive graph attention network model is used for feature learning, which solves the problem of large differences in feature distribution between different types of nodes in heterogeneous graphs.

[0027] Specifically, this includes: identifying the types of neighboring nodes of a target node in the graph, and selecting a dedicated feature projection matrix corresponding to the type to perform a linear transformation on the features of the neighboring nodes.

[0028] Using the attention vector corresponding to the type, the correlation score between the target node and the concatenated feature vector of the neighboring nodes is calculated, and the attention coefficient is obtained by normalizing the correlation score through a non-linear activation function and a softmax function.

[0029] The features of neighboring nodes are weighted and aggregated based on the attention coefficient, and the embedding vector of the target node is updated by an activation function.

[0030] The global graph representation vector of alarms is generated by using a subgraph mask attention mechanism. This involves calculating the nonlinear transformation value of each node feature in the subgraph after interacting with the alarm feature vector, normalizing it to obtain the contribution weight, and then weighting and summing the subgraph node features according to the contribution weight.

[0031] In one possible implementation, the alarm clustering and risk ranking are performed using a density peaking strategy that does not require a preset number of clusters.

[0032] A density-peak-based clustering strategy is employed to calculate the local density and relative distance of each alarm point. The local density is the sum of the truncated kernel function values ​​of other alarm points within a predefined distance range, and the relative distance is the minimum distance to a higher-density point. Points whose product of local density and relative distance is greater than a predefined benchmark are selected as initial cluster centers for clustering.

[0033] The mean cosine similarity of all alarm point vector pairs between the two generated clusters is used as the inter-cluster similarity. When the inter-cluster similarity is higher than the dynamic merging threshold, the two clusters are merged. The comprehensive risk value of each aggregated event is calculated based on three dimensions: event urgency, asset importance, and attack threat level, and then sorted in descending order of comprehensive risk value.

[0034] In one possible implementation, a double-loop feedback mechanism ensures the continuous evolution of the model.

[0035] Discrete label feedback, semantic feedback, and operational behavior feedback are collected. The operational behavior feedback reward is added to the weighted semantic feedback reward to obtain a comprehensive reward function. The operational behavior feedback reward is calculated using an exponential decay function based on the action type and processing time, while the semantic feedback reward is calculated based on the cosine similarity between the annotated text mapping vector and the predicted vector.

[0036] In the real-time feedback loop operation, reinforcement learning agent units are used, with alarm feature vectors as states and fine-tuning of attention head weight vectors as actions. The policy network is updated based on the comprehensive reward function, and the fine-tuning is applied to the model attention layer in real time.

[0037] In the cyclic optimization loop operation, the structural parameters of the graph neural network are updated using incremental data and a knowledge distillation strategy, and this update is achieved by minimizing the total loss function. The total loss function is obtained by weighted summation of the supervised classification loss function based on the fine-tuning dataset and the knowledge distillation loss function. The knowledge distillation loss function is calculated based on the divergence between the output probability distribution of the current model and the output probability distribution of the historical models.

[0038] A second aspect of this invention provides an intelligent aggregation noise reduction and risk assessment system for network security alarms.

[0039] The system is configured to perform the method described in the first aspect above, and the system includes: The data access module is configured to collect multi-source heterogeneous security alarm log data through a unified data interface, perform standardized cleaning on the security alarm log data, and convert the cleaned data into structured data in a unified format. The feature extraction module is configured to perform multi-dimensional feature extraction on structured data, extracting basic semantic features, spatiotemporal correlation features and asset risk features, and then using an attention gating mechanism to fuse the basic semantic features, spatiotemporal correlation features and asset risk features to generate an alarm feature vector. The dynamic graph construction module is configured to build a heterogeneous dynamic network security graph containing multiple entity types based on alarm feature vectors and structured data, and dynamically update the edge structure and weights in the graph according to the time-series decay model. The alarm aggregation module is configured to use a type-aware adaptive graph attention network model to perform feature learning on the heterogeneous dynamic graph of network security, generate graph representation vectors of alarms, and perform alarm clustering and risk ranking based on the graph representation vectors, and output the aggregated security events. The feedback learning module is configured to collect human feedback signals for security incidents, construct a dual-loop feedback mechanism that includes real-time parameter adjustment and periodic structural updates, and iteratively optimize the type-aware adaptive graph attention network model based on the feedback signals. The application output module is configured to output an aggregated list of security incidents, the results of the incident risk level ranking, and the corresponding attack tracing graph.

[0040] This invention provides a method and system for intelligent aggregation, noise reduction, and risk assessment of network security alarms. It has the following beneficial effects: 1. This invention integrates multi-dimensional features such as basic semantics, spatiotemporal correlation, and asset risk, and uses an attention gating mechanism to dynamically weight and fuse these features. This overcomes the limitations of traditional alarm analysis, which relies solely on single-dimensional rules or statistical features. By introducing a dedicated dictionary for the cybersecurity field, it enhances the understanding of attack description texts. Furthermore, by combining the importance of assets with the entropy changes in spatiotemporal distribution, it can more accurately quantify the actual threat level of alarms, filter out a large amount of background noise and low-risk alarms, and improve the distinguishability and noise reduction effect of alarm features.

[0041] 2. This invention constructs a heterogeneous dynamic network security graph containing multiple entity types and uses a type-aware adaptive graph attention network to process complex topological relationships between nodes. By applying exclusive feature projection and attention calculation to different types of neighbor nodes, it solves the problem of poor interoperability caused by indiscriminate feature distribution in heterogeneous networks. Combined with a time-decay-based edge weight update mechanism and a density peak clustering strategy, the system can automatically detect cross-device and cross-time period related attack behaviors in dynamically changing network traffic, restore fragmented isolated alarms to complete security events, and improve the ability to perceive complex attack scenarios.

[0042] 3. This invention designs a dual-loop feedback mechanism that includes real-time parameter adjustment and periodic structural updates, realizing human-machine co-evolution of the model. The real-time feedback loop uses reinforcement learning strategies to fine-tune the model's attention weights in real time based on human intervention, enabling rapid response to new attacks or correction of false alarms. The periodic optimization loop uses a knowledge distillation strategy to update the model structure on incremental data. By constraining the output divergence between the current model and historical models, it retains the ability to identify historical attack patterns while absorbing new knowledge, avoiding catastrophic forgetting problems during model iteration, and ensuring the long-term stability and adaptability of the system. Attached Figure Description

[0043] Figure 1 This is a diagram of the overall system architecture of the present invention; Figure 2 This is a flowchart illustrating the overall process of the method of the present invention.

[0044] The module includes: 101. Data access module; 102. Feature extraction module; 103. Dynamic graph construction module; 104. Alarm aggregation module; 105. Feedback learning module; and 106. Application output module. Detailed Implementation

[0045] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] See attached document Figure 1 This invention provides an intelligent aggregation and noise reduction system for network security alarms and risk assessment. The system's logical architecture includes a data access module 101, a feature extraction module 102, a dynamic graph construction module 103, an alarm aggregation module 104, a feedback learning module 105, and an application output module 106. These modules interact and coordinate commands through predefined data interfaces and communication protocols.

[0047] The data access module 101 is configured to connect to external security devices and a log platform. The data access module 101 obtains raw alarm logs from the security information and event management platform, firewall, endpoint detection and response system, and intrusion detection system through a unified acquisition interface. The data access module 101 cleans heterogeneous data containing source IP address, destination IP address, port information, protocol type, alarm type, timestamp, and alarm description fields, and converts it to the JSON-LD standard format to eliminate format differences between multiple data sources.

[0048] The feature extraction module 102 is connected to the data access module 101 and is used to perform hierarchical extraction and fusion of multi-dimensional features. Specifically, the feature extraction module 102 calculates basic semantic features, spatiotemporal correlation features, and asset risk features. The feature extraction module 102 uses a word embedding algorithm with constraints from a network security attack dictionary to process textual features, uses a sliding window algorithm to calculate the trend entropy and outbreak intensity of the alarm sequence, and combines the configuration management database to calculate asset vulnerability and coreity scores. The feature extraction module 102 internally includes an attention-gated fusion unit that weights and concatenates the aforementioned multi-dimensional feature vectors to generate a unified alarm feature vector.

[0049] The dynamic graph construction module 103 receives standardized data and feature vectors from the feature extraction module 102, and constructs and maintains a dynamic evolution graph of network entity relationships. The dynamic graph construction module 103 defines a heterogeneous node system including IP addresses, devices, users, business systems, and attack types. Based on alarm data, the dynamic graph construction module 103 establishes communication, detection, attribution, and association edge relationships between nodes, and dynamically calculates edge weights based on a time-series decay model. The dynamic graph construction module 103 manages the lifecycle of graph data through a traffic-adaptive sliding window mechanism, updating the graph structure within the window in real time, and archiving expired data to a historical knowledge base.

[0050] The alarm aggregation module 104 is the core processing unit of the system, and it deploys a type-aware adaptive graph attention network model. The alarm aggregation module 104 takes the graph structure and feature vectors output by the dynamic graph construction module 103 as input. The alarm aggregation module 104 calculates the feature representations of different types of nodes through a type-aware node embedding layer, and generates a global graph representation vector for alarms using a subgraph mask attention mechanism. The alarm aggregation module 104 uses a density peak-based clustering algorithm to identify alarm cluster centers, and combines this with a dynamic threshold to aggregate similar alarms into security events. Simultaneously, it ranks the aggregated events according to a multi-dimensional risk assessment model.

[0051] The feedback learning module 105 constructs a dual-loop feedback mechanism for model optimization. It provides an interactive interface to collect confirmation tags, semantic annotations, and handling behavior data from operations and maintenance personnel. The module converts the collected signals into supervisory and reinforcement reward signals. It executes an instant feedback process, adjusting the attention weight parameters of the inference model in the alarm aggregation module 104 in real time. Finally, it performs a periodic optimization process, updating the structural parameters of the graph neural network using incremental data and knowledge distillation strategies.

[0052] The application output module 106 is connected to the alarm aggregation module 104 for visualizing the processing results. The application output module 106 outputs the aggregated security event list, the event risk level ranking results, and the corresponding attack tracing graph.

[0053] See attached document Figure 2 This invention provides an intelligent aggregation, noise reduction, and risk assessment method for network security alarms, comprising the following steps: S101, collect multi-source heterogeneous security alarm log data through a unified data interface, perform standardized cleaning on the security alarm log data, and convert the cleaned data into structured data in a unified format; S102, perform multi-dimensional feature extraction on the structured data, extract basic semantic features, spatiotemporal correlation features and asset risk features, and fuse the above features through an attention gating mechanism to generate an alarm feature vector; S103, Based on the alarm feature vector and real-time data stream, construct a network security heterogeneous dynamic graph containing multiple entity types, and dynamically update the edge structure and weights in the graph according to the time-series decay model. S104, use a type-aware adaptive graph attention network model to learn features of the network security heterogeneous dynamic graph, generate graph representation vectors of alarms, and perform alarm clustering and risk ranking based on the graph representation vectors to output aggregated security events; S105, Collect human feedback signals for the security incident, construct a dual-loop feedback mechanism including real-time parameter adjustment and periodic structural update, and iteratively optimize the type-aware adaptive graph attention network model based on the feedback signals.

[0054] The network security alarm aggregation and noise reduction method provided by this invention is mainly executed collaboratively by a data access module 101 and a feature extraction module 102 in the data access and feature extraction stages. The data access module 101 is configured to establish a communication connection with external heterogeneous security devices and perform raw log collection and standardization processing. The feature extraction module 102 is configured to perform multi-dimensional feature calculation and fusion on the standardized data to generate a high-dimensional alarm feature vector.

[0055] The data access module 101 obtains raw alarm logs from the security information and event management platform, firewall, intrusion detection system, and endpoint detection and response system through a pre-built application programming interface. The raw alarm set is defined as follows: The data access module 101 will process each alarm. The mapping is a standardized tuple structure containing the source Internet Protocol address. , destination Internet Protocol address Source port Destination port The data access module 101 encapsulates the above tuples using the JSON-LD data format, unifying the field naming conventions and data formats of different device manufacturers. This includes the transport layer protocol (Proto), alarm type (Type), timestamp (Time), risk level (Sev), and alarm description text (Desc).

[0056] Feature extraction module 102 is connected to data access module 101, and first executes the basic semantic feature vector. The feature extraction module 102 performs word segmentation on the alarm description text, protocol type, and alarm type fields to generate word sequences. The feature extraction module 102 is pre-loaded with a dedicated attack dictionary for the cybersecurity field. For any word unit in the word sequence The feature extraction module 102 calculates its corresponding feature vector. .

[0057] The specific feature vector calculation follows a weighted word embedding algorithm: its calculation logic is as follows: the standard embedding vector of the word unit in the general semantic space is multiplied by its corresponding domain weight coefficient. Specifically, the feature extraction module 102 determines the domain weight coefficient according to the following rules. Value: ; in, The preset domain enhancement factor is used. The feature extraction module 102 performs a weighted summation operation based on an attention mechanism on the feature vectors of all word units in the sequence to obtain the basic semantic feature vector. This enhances the ability to represent keywords related to attack behavior.

[0058] Feature extraction module 102 further executes spatiotemporal correlation feature vectors The feature extraction module 102 sets a sliding time window in the time dimension. And calculate the trend entropy of the alarm generation sequence. and burst intensity The feature extraction module 102 will use a sliding time window. Divided into Given _equal-length subintervals, count the _th _ ... Number of alarms in each sub-region Calculate the total number of alarms within this time window. Definition of the first Alarm distribution probability of each sub-interval .

[0059] Feature extraction module 102 calculates trend entropy according to the following formula. The calculation process follows the principle of information entropy algorithm, determining the alarm distribution probability of each sub-interval by calculating the negative of the sum of its products, thereby quantifying the degree of disorder in the temporal distribution of alarms. Simultaneously, the feature extraction module 102 calculates the burst intensity. This value is obtained by calculating the difference between the maximum and the mean number of alarms in the current window sub-interval, and dividing it by the sum of the standard deviation of the number of alarms and the smoothing term, thus reflecting the suddenness of alarm traffic.

[0060] In the spatial dimension, the feature extraction module 102 calls the geographic location information database and routing trajectory data to calculate the logical distance between the source Internet Protocol address and the destination Internet Protocol address. and network hop count The feature extraction module 102 will extract the trend entropy. Explosion intensity Logical distance and network hop count Combining to construct spatiotemporal correlated feature vectors .

[0061] Feature extraction module 102 also performs asset risk feature vector extraction. The feature extraction module 102 accesses the configuration management database via an interface to obtain the asset object associated with the target Internet Protocol address. The attribute information. Feature extraction module 102 constructs an asset risk scoring model based on multi-dimensional attributes. The model employs a linear weighted summation method, multiplying the asset vulnerability severity score, business core level value, and normalized values ​​of historical attack frequency with their respective preset weight coefficients. The feature extraction module 102 then uses the calculated risk score... Vectorization is performed to obtain the asset risk feature vector. .

[0062] Finally, the feature extraction module 102 performs a feature fusion operation. The feature extraction module 102 then combines the basic semantic feature vectors... Spatiotemporal correlation feature vector and asset risk characteristic vector The features are concatenated to obtain the original feature vector. The feature extraction module 102 calculates the gate weight vector using the built-in attention gating unit. Specifically, it calculates the weight vector by performing a linear transformation on the original feature vector, adding a bias, and then using the sigmoid activation function. The feature extraction module 102 generates the final alarm feature vector by performing element-wise multiplication between the gate weight vector and the original feature vector. The alarm feature vector It is then transmitted to the dynamic graph construction module 103 for subsequent graph generation and alarm aggregation processing.

[0063] The network security alarm aggregation and noise reduction method provided by this invention is mainly executed by the dynamic graph construction module 103 in the graph construction stage. The dynamic graph construction module 103 is configured to receive alarm feature vectors output by the feature extraction module 102, and combine them with real-time alarm data streams to construct and maintain a heterogeneous information network reflecting the network attack and defense situation.

[0064] The dynamic graph construction module 103 first defines the heterogeneous information network. The basic structure. Node set. It contains five entity types, and their type mapping functions The value range is {Internet Protocol address, security device, user account, business system, attack type}. Edge set It includes four relation types and their relation mapping functions. The value range is {communication relationship, detection relationship, attribution relationship, association relationship}. The dynamic graph construction module 103 parses the entity information in the alarm data, creates or updates the corresponding node instances in the graph, and establishes edge connections between nodes based on the alarm context.

[0065] The dynamic graph construction module 103 uses a time-decay weighted model to calculate edge weights. to characterize nodes With nodes The dynamic evolution of the correlation strength between them. The dynamic graph construction module 103 calculates the current time according to the following formula. Edge weights: ; In the formula, Indicates nodes within the current time window With nodes The number of interactions between them This indicates the timestamp of the most recent event that occurred on this edge. Indicates the time decay coefficient. Represents a node With nodes All alarm sets related to each other, Indicates an alarm The risk level value, This represents the node's recent activity score. This is the preset balance coefficient. The model uses an exponential decay term. Reduce the impact of outdated associations on current analysis.

[0066] The dynamic graph construction module 103 utilizes a flow-adaptive sliding window mechanism to manage the update cycle of graph data. The dynamic graph construction module 103 monitors the current alarm flow density in real time. The size of the sliding window is dynamically adjusted according to the following rules. : ; In the formula, and These are the preset minimum and maximum window durations, respectively. and For high and low flow thresholds, It is a linear interpolation function.

[0067] As the sliding window moves forward, the dynamic graph construction module 103 performs graph compression and pruning operations. The dynamic graph construction module 103 traverses all edge structures in the current graph and compares edge weights. With preset pruning threshold The size of . For satisfying The dynamic graph construction module 103 removes edges from the current computational graph and archives the associated historical interaction data into a persistent knowledge base. This operation preserves the critical path structure with high correlation strength, maintaining the graph's ability to represent recent attack behaviors while reducing computational complexity. The completed dynamic graph is then transmitted to the alarm aggregation module 104 for further processing.

[0068] The network security alarm aggregation and noise reduction method provided by this invention is mainly executed by the alarm aggregation module 104 in the aggregation analysis stage. The alarm aggregation module 104 is configured to receive heterogeneous information network data output by the dynamic graph construction module 103 and alarm feature vectors output by the feature extraction module 102, use a deep graph neural network model to perform high-order correlation feature learning on the alarm data, and complete the clustering and classification of alarms accordingly.

[0069] The alarm aggregation module 104 first executes a type-aware node embedding learning process. Given that the network contains heterogeneous nodes of various types, such as Internet Protocol addresses, security devices, and user accounts, the alarm aggregation module 104 adopts a type-aware adaptive graph attention network structure. For any node in the graph... and its neighboring nodes The alarm aggregation module 104 identifies neighboring nodes. Type And select the specific feature projection matrix corresponding to this type. The alarm aggregation module aggregates 104 neighbor node characteristics. Perform a linear transformation operation: ; This step maps nodes from different feature spaces to a unified semantic space.

[0070] The alarm aggregation module 104 then calculates the type-aware attention coefficients between nodes. Alarm aggregation module 104 utilizes neighbor type-based... attention vector compute nodes With nodes Correlation score between And normalization is performed using the Softmax function: ; ; In the formula, This represents a vector concatenation operation. For nodes The neighbor set. The alarm aggregation module 104 is based on the calculated attention coefficient. Weighted aggregation of neighbor node features is performed, and then activated by an activation function. Update node Embedded vector : ; The alarm aggregation module 104 further executes the alarm graph representation learning process. The alarm aggregation module 104 then processes each alarm... Mapped to a local subgraph structure in the graph The subgraph contains all entity nodes involved in the alarm. To extract global features representative of the alarm from the subgraph, the alarm aggregation module 104 introduces a subgraph masking attention mechanism. The alarm aggregation module 104 calculates the sum of the sums for each node in the subgraph. Contribution weight to alarm indication : ; in, This refers to the original alarm feature vector generated in step one. These are model parameters. The alarm aggregation module 104 uses weights... The features of the subgraph nodes are weighted and summed, and the result is concatenated with the original alarm feature vector to generate the final alarm graph representation vector. : ; Based on the generated alarm map representation vector set The alarm aggregation module 104 performs an adaptive clustering operation. The alarm aggregation module 104 employs a clustering strategy based on density peaks to calculate the clustering results for each alarm point. Local density and relative distance : ; ; in, To truncate the kernel function, dist is the Euclidean distance. This is the cutoff distance parameter. Alarm aggregation module 104 selects... Points with values ​​significantly greater than the preset benchmark are used as initial cluster centers, and the remaining alarm points are assigned to the clusters to which the nearest cluster center belongs.

[0071] The alarm aggregation module 104 then performs a cluster merging operation to optimize the clustering results. For the two generated clusters... and The alarm aggregation module 104 calculates the inter-cluster similarity. : ; When the calculated inter-cluster similarity is higher than the dynamic merging threshold At that time, the alarm aggregation module 104 merges the two clusters into a single security event, thereby solving the problem of fragmented segmentation of similar events.

[0072] Finally, the alarm aggregation module 104 performs multi-dimensional risk assessment and sorting. The alarm aggregation module 104 calculates the comprehensive risk value of each aggregated event based on three dimensions: event urgency, asset importance, and attack threat level. Event urgency depends on the average risk level of alarms within the cluster and the latest occurrence time; asset importance depends on the core level of the business systems involved; and attack threat level is based on the attack success rate of similar historical events. The alarm aggregation module 104 sorts the security events in descending order according to the comprehensive risk value and transmits the sorted event list to the application output module 106.

[0073] The network security alarm aggregation and noise reduction method provided by this invention is mainly executed by the feedback learning module 105 during the feedback learning phase. The feedback learning module 105 is configured to build a real-time feedback cycle optimization dual-loop mechanism, which continuously optimizes the model parameters in the alarm aggregation module 104 by quantitatively analyzing the interaction behavior of operation and maintenance personnel.

[0074] The feedback learning module 105 first executes the feedback signal acquisition and quantification process. The feedback learning module 105 provides an interactive interface for collecting three types of human feedback data: discrete label feedback (e.g., confirmed attack, false alarm), semantic feedback (e.g., notes entered by analysts), and operational behavior feedback (e.g., event handling time, priority adjustment records). The feedback learning module 105 defines a comprehensive reward function. Integrating operational behavior feedback and rewards With semantic feedback rewards : ; In the formula, This is the weighting adjustment coefficient.

[0075] Rewards for operational behavior feedback The feedback learning module 105 is based on the type of action and the time taken to complete the action. Perform the calculation: ; in, This is a time-sensitivity constant. For semantic feedback rewards... The feedback learning module 105 calls the pre-trained language model to map the annotation text into an attack scene vector, and calculates the cosine similarity between the vector and the model's predicted scene vector.

[0076] The feedback learning module 105 performs an instant feedback loop operation, designed to fine-tune the model's inference parameters in real time. The feedback learning module 105 is deployed with reinforcement learning agent units. When the system receives new feedback rewards... At that time, the reinforcement learning agent unit takes the current alarm feature as its state and the attention head weight vector as its state. fine-tuning amount For actions, the policy network is updated using the policy gradient algorithm. The feedback learning module 105 then calculates the fine-tuning amount. The real-time application is applied to the attention layer of the alarm aggregation module 104 to adjust the feature focus in the current inference process, thereby quickly responding to the analyst's correction instructions without interrupting the service.

[0077] The feedback learning module 105 performs a cycle optimization loop operation, which aims to update the structural parameters of the graph neural network. The feedback learning module 105 sets the update cycle. (e.g., 7 days). At the end of each cycle, the feedback learning module 105 selects high-confidence samples from the historical feedback database to construct a fine-tuning dataset. The feedback learning module 105 employs a knowledge distillation strategy for incremental model updates to avoid catastrophic forgetting. The feedback learning module 105 defines the total loss function. : ; in, For the model parameters to be updated, These are the model parameters from the previous version. For fine-tuning datasets Supervised classification loss functions (such as cross-entropy loss). Let KL divergence be the knowledge distillation loss function, and let KL divergence be calculated between the output probability distributions of the current model and the old model. This represents the distillation temperature coefficient. The feedback learning module 105 minimizes the total loss function. Update the model parameters and deploy the updated model to the alarm aggregation module 104 to complete the system's self-evolution iteration.

Claims

1. A method for intelligent aggregation, noise reduction, and risk assessment of network security alarms, characterized in that, Includes the following steps: S101. Collect multi-source heterogeneous security alarm log data through a unified data interface, perform standardized cleaning on the security alarm log data, and convert the cleaned data into structured data in a unified format. S102. Perform multi-dimensional feature extraction on the structured data, extract basic semantic features, spatiotemporal correlation features and asset risk features, and fuse the basic semantic features, spatiotemporal correlation features and asset risk features through an attention gating mechanism to generate an alarm feature vector; S103. Based on the alarm feature vector and the structured data, construct a network security heterogeneous dynamic graph containing multiple entity types, and dynamically update the edge structure and weights in the graph according to the time-series decay model. S104. Use a type-aware adaptive graph attention network model to learn features of the network security heterogeneous dynamic graph, generate graph representation vectors of alarms, and perform alarm clustering and risk ranking based on the graph representation vectors to output aggregated security events. S105. Collect human feedback signals for the security incident, construct a dual-loop feedback mechanism that includes real-time parameter adjustment and periodic structural update, and iteratively optimize the type-aware adaptive graph attention network model based on the feedback signals.

2. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The extraction of basic semantic features specifically includes: The alarm description text, protocol type, and alarm type fields in the structured data are obtained. The above fields are segmented to generate a word sequence, and the feature vector of the word unit in the word sequence is calculated using a weighted word embedding algorithm. The calculation of the feature vector of the word unit in the word sequence includes: determining whether the word unit belongs to a preset network security domain-specific attack dictionary; if it does, assigning a domain weight coefficient containing a domain enhancement factor; if it does not, assigning a default weight coefficient; and multiplying the standard embedding vector of the word unit in the general semantic space with the domain weight coefficient. Finally, a weighted summation based on an attention mechanism is performed on the feature vectors of all word units in the word sequence to obtain the basic semantic feature vector.

3. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The extraction of spatiotemporal correlation features specifically includes: In the time dimension, a sliding time window is set and the sliding time window is divided into multiple sub-intervals of equal length. The alarm distribution probability of each sub-interval is calculated, and the negative of the sum of the products of the alarm distribution probability and its logarithm is calculated to obtain the trend entropy. The maximum, mean, and standard deviation of the number of alarms in sub-intervals within the sliding time window are statistically analyzed. The ratio of the difference between the maximum and the mean to the sum of the standard deviation and the smoothing term is calculated to obtain the outbreak intensity. In the spatial dimension, the system calls upon the geographic location information database and routing trajectory data to calculate the logical distance and network hop count between the source Internet Protocol address and the destination Internet Protocol address. The trend entropy, the burst intensity, the logical distance, and the network hop count are combined to construct the spatiotemporal correlation feature vector.

4. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The extraction of asset risk features and the fusion of the basic semantic features, the spatiotemporal correlation features, and the asset risk features through an attention gating mechanism specifically include: By accessing the configuration management database through the interface, the attribute information of the asset object corresponding to the Internet Protocol address in the structured data is queried. The asset risk feature vector is obtained by multiplying and summing the vulnerability severity score, business core level value and normalized value of historical attack frequency of the asset object with the corresponding preset weight coefficient using a linear weighted summation method. The basic semantic feature vector, the spatiotemporal correlation feature vector, and the asset risk feature vector are concatenated to obtain a concatenated feature vector. Using an attention gating unit, the concatenated feature vector is linearly transformed and a bias is added, and then the gating weight vector is calculated using the Sigmoid activation function. The alarm feature vector is generated by performing element-wise multiplication between the gating weight vector and the concatenated feature vector.

5. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The dynamic updating of the edge structure and weights in the graph based on the time-series decay model specifically includes: Define a set of nodes that includes Internet Protocol addresses, security devices, user accounts, business systems, and attack types, as well as a set of edges that includes communication relationships, detection relationships, attribution relationships, and association relationships; The edge weights at the current moment are calculated using a time-decay weighted model. The calculation of the edge weights at the current moment includes: calculating the product of the number of interactions between nodes and a time factor containing an exponential decay term as the first component, wherein the exponential decay term is calculated based on the time difference between the current moment and the moment the most recent event occurred; calculating the sum of the risk level values ​​of all alarms associated between nodes as the second component; calculating the recent activity score of the nodes as the third component; and finally, weighted summing of the first, second, and third components to obtain the edge weights. When the calculated edge weight is lower than the preset pruning threshold, the edge structure is removed from the current computation graph and archived.

6. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The construction of a heterogeneous dynamic network security graph containing multiple entity types also includes managing the update cycle of the graph data using a traffic-adaptive sliding window mechanism. Real-time monitoring of current alarm flow density; When the alarm flow density is higher than the preset high flow threshold, the size of the sliding window is set to the preset minimum window duration; When the alarm flow density is lower than the preset low flow threshold, the size of the sliding window is set to the preset maximum window duration; When the alarm flow density is between the high flow threshold and the low flow threshold, the size of the sliding window is calculated using a linear interpolation function.

7. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The specific steps of using a type-aware adaptive graph attention network model to perform feature learning on the heterogeneous dynamic graph of network security include: Identify the types of neighboring nodes of the target node in the graph, and select a dedicated feature projection matrix corresponding to the type to perform a linear transformation on the features of the neighboring nodes; Using the attention vector corresponding to the type described above, the correlation score between the target node and the concatenated feature vector of the neighboring node is calculated, and the attention coefficient is obtained by normalizing the correlation score through a non-linear activation function and a softmax function. The neighbor node features are weighted and aggregated based on the attention coefficient, and the embedding vector of the target node is updated through an activation function. A global graph representation vector for alarms is generated using a subgraph mask attention mechanism. The generation of the global graph representation vector for alarms includes: calculating the nonlinear transformation value of each node feature in the subgraph after interaction with the alarm feature vector and normalizing it to obtain the contribution weight; and performing a weighted summation of the subgraph node features based on the contribution weight.

8. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The execution of alarm clustering and risk ranking specifically includes: A clustering strategy based on density peaks is adopted to calculate the local density and relative distance of each alarm point. The local density is the sum of the truncated kernel function values ​​of other alarm points within a preset distance range, and the relative distance is the minimum distance to a higher density point. Points whose product of local density and relative distance is greater than a preset benchmark are selected as initial cluster centers for clustering. The mean cosine similarity of all alarm point vector pairs between the two generated clusters is used as the inter-cluster similarity. When the inter-cluster similarity is higher than the dynamic merging threshold, the two clusters are merged. The comprehensive risk value of each aggregated event is calculated based on three dimensions: event urgency, asset importance, and attack threat level, and then sorted in descending order of the comprehensive risk value.

9. The intelligent aggregation, noise reduction, and risk assessment method for network security alarms according to claim 1, characterized in that, The construction of the dual-loop feedback mechanism, which includes both real-time parameter adjustment and periodic structural updates, specifically includes: Collect discrete label feedback, semantic feedback and operational behavior feedback, and add the operational behavior feedback reward with the weighted semantic feedback reward to obtain a comprehensive reward function. The operational behavior feedback reward is calculated based on the exponential decay function of the action type and the action time, and the semantic feedback reward is calculated based on the cosine similarity between the annotation text mapping vector and the prediction vector. Perform the instant feedback loop operation: using the reinforcement learning agent unit, with the alarm feature vector as the state and the fine-tuning amount of the attention head weight vector as the action, update the policy network based on the comprehensive reward function, and apply the fine-tuning amount to the model attention layer in real time; The execution cycle optimization loop operation is performed by updating the structural parameters of the graph neural network using incremental data and a knowledge distillation strategy. The update is performed by minimizing the total loss function, which is obtained by weighted summation of the supervised classification loss function based on the fine-tuned dataset and the knowledge distillation loss function. The knowledge distillation loss function is calculated based on the divergence between the output probability distribution of the current model and the output probability distribution of the historical model.

10. A smart aggregation noise reduction and risk assessment system for network security alarms, characterized in that, The intelligent aggregation noise reduction and risk assessment method for running a network security alarm as described in any one of claims 1-9 includes: The data access module is configured to collect multi-source heterogeneous security alarm log data through a unified data interface, perform standardized cleaning on the security alarm log data, and convert the cleaned data into structured data in a unified format. The feature extraction module is configured to perform multi-dimensional feature extraction on the structured data, extract basic semantic features, spatiotemporal correlation features and asset risk features, and fuse the basic semantic features, the spatiotemporal correlation features and the asset risk features through an attention gating mechanism to generate an alarm feature vector; The dynamic graph construction module is configured to construct a network security heterogeneous dynamic graph containing multiple entity types based on the alarm feature vector and the structured data, and dynamically update the edge structure and weights in the graph according to the time-series decay model. The alarm aggregation module is configured to use a type-aware adaptive graph attention network model to perform feature learning on the heterogeneous dynamic graph of network security, generate graph representation vectors of alarms, and perform alarm clustering and risk ranking based on the graph representation vectors, and output the aggregated security events. The feedback learning module is configured to collect human feedback signals for the security event, construct a dual-loop feedback mechanism that includes real-time parameter adjustment and periodic structural updates, and iteratively optimize the type-aware adaptive graph attention network model based on the feedback signals. The application output module is configured to output an aggregated list of security events, a ranking of event risk levels, and a corresponding attack attribution graph.

Images