Alarm event analysis methods, devices, computer equipment, and storage media

Abstract

This application relates to an alarm event analysis method, apparatus, computer equipment, and storage medium, belonging to the field of network security technology. The method includes: receiving raw alarm data from a security device for an alarm event; extracting multiple initial alarm entities and associated descriptive information between different initial alarm entities from the raw alarm data; constructing an initial directed graph based on the multiple initial alarm entities and the associated descriptive information between different initial alarm entities; and determining the event analysis result of the alarm event based on the initial directed graph. Compared to traditional methods that use fixed automated rules for alarm event analysis, this application, upon receiving the raw alarm data corresponding to the alarm event, constructs an initial directed graph from the raw alarm data and determines the event analysis result based on the initial directed graph. This not only accurately reconstructs the attack logic but also enables traceability and interpretability based on the directed graph, while facilitating manual review and source tracing.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an alarm event analysis method, apparatus, computer device, and storage medium. Background Technology

[0002] With the rapid development of artificial intelligence (AI) technology, its applications are becoming increasingly widespread, and cybersecurity is one of its important applications. For example, AI-based analysis (or judgment) of network alarm events can quickly yield analysis results.

[0003] However, most current methods for analyzing alarm events based on artificial intelligence rely on configuring automated rules for AI models and then judging alarm events based on these automated rules. While this method is more efficient than manual judgment, it is less accurate due to its reliance on rigid automated rules, resulting in lower reliability and reference value of the output results. Summary of the Invention

[0004] Therefore, it is necessary to provide an alarm event analysis method, apparatus, computer equipment, and storage medium that can improve the accuracy of alarm event analysis results in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for alarm event analysis. The method includes:

[0006] Receive raw alarm data from security devices in response to alarm events;

[0007] Extract descriptions of multiple initial alarm entities and the relationships between different initial alarm entities from the original alarm data;

[0008] An initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0009] Based on the initial directed graph, determine the event analysis results of the alarm events.

[0010] In one embodiment, multiple initial alarm entities and associated description information between different initial alarm entities are extracted from the original alarm data, including:

[0011] The original alarm data is normalized to obtain the target alarm data;

[0012] Entity recognition processing is performed on the target alarm data to obtain the initial alarm entity;

[0013] Determine the alarm description information based on the target alarm data;

[0014] Based on the alarm description information, determine the associated description information between different initial alarm entities.

[0015] In one embodiment, an initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities, including:

[0016] Each initial alarm entity is used as an initial node in the initial directed graph; and,

[0017] Based on the association description information between different initial alarm entities, the initial edges in the initial directed graph are constructed.

[0018] In one embodiment, the event analysis results of the alarm events are determined based on the initial directed graph, including:

[0019] Based on the initial directed graph, determine the initial analysis results of the alarm events;

[0020] Based on the initial analysis results, attack predictions were made, and the predicted information was obtained.

[0021] Based on the inferred information, the initial directed graph is updated to obtain the target directed graph;

[0022] Based on the target directed graph, determine the event analysis results of the alarm events.

[0023] In one embodiment, updating the initial directed graph based on the inferred information to obtain the target directed graph includes:

[0024] Construct a query command based on the inferred information;

[0025] Based on the query command, invoke the anomaly investigation tool to obtain newly added valid alarm data for alarm events;

[0026] Based on the newly added valid alarm data, the initial directed graph is updated to obtain the target directed graph.

[0027] In one embodiment, the target directed graph includes target nodes and target edges between target nodes; based on the target directed graph, the event analysis results of the alarm event are determined, including:

[0028] Obtain the event timestamp of the target node in response to the alarm event;

[0029] Based on the event timestamp and the causal information of the event sequence associated with the alarm event, the target directed graph is optimized to obtain an effective directed graph;

[0030] Based on the valid directed graph, determine the event analysis results of the alarm events.

[0031] In one embodiment, the event analysis results of the alarm events are determined based on the valid directed graph, including:

[0032] Based on the effective directed graph, determine the inference results of the alarm impact range and the attack reachability analysis results between effective nodes in the effective directed graph;

[0033] Based on the attack reachability analysis results and the alarm impact range inference results, the event analysis results of the alarm events are determined.

[0034] Secondly, this application also provides an alarm event analysis device. The device includes:

[0035] The receiving module is used to receive raw alarm data from security devices in response to alarm events;

[0036] The extraction module is used to extract multiple initial alarm entities and the association description information between different initial alarm entities from the original alarm data;

[0037] The building module is used to construct an initial directed graph based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0038] The determination module is used to determine the event analysis results of alarm events based on the initial directed graph.

[0039] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0040] Receive raw alarm data from security devices in response to alarm events;

[0041] Extract descriptions of multiple initial alarm entities and the relationships between different initial alarm entities from the original alarm data;

[0042] An initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0043] Based on the initial directed graph, determine the event analysis results of the alarm events.

[0044] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0045] Receive raw alarm data from security devices in response to alarm events;

[0046] Extract descriptions of multiple initial alarm entities and the relationships between different initial alarm entities from the original alarm data;

[0047] An initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0048] Based on the initial directed graph, determine the event analysis results of the alarm events.

[0049] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0050] Receive raw alarm data from security devices in response to alarm events;

[0051] Extract descriptions of multiple initial alarm entities and the relationships between different initial alarm entities from the original alarm data;

[0052] An initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0053] Based on the initial directed graph, determine the event analysis results of the alarm events.

[0054] The aforementioned alarm event analysis method, apparatus, computer equipment, and storage medium receive raw alarm data from security devices in response to alarm events. From the raw alarm data, multiple initial alarm entities and the associated descriptive information between different initial alarm entities are extracted. An initial directed graph is constructed based on the multiple initial alarm entities and the associated descriptive information between different initial alarm entities. The event analysis result of the alarm event is determined based on the initial directed graph. Compared to traditional methods that use fixed automated rules for alarm event analysis, this application, upon receiving the raw alarm data corresponding to the alarm event, constructs an initial directed graph from the raw alarm data and determines the event analysis result based on the initial directed graph. This not only accurately reconstructs the attacked logic but also enables traceability and interpretability based on the directed graph, while facilitating manual review and source tracing. Attached Figure Description

[0055] Figure 1 This is a diagram illustrating the application environment of the alarm event analysis method provided in this embodiment.

[0056] Figure 2 This is a flowchart illustrating the first alarm event analysis method provided in this embodiment;

[0057] Figure 3 This is a flowchart illustrating the process of determining the initial alarm entity and the association description information between different initial alarm entities provided in this embodiment;

[0058] Figure 4 This is a flowchart illustrating the event analysis results for determining alarm events provided in this embodiment;

[0059] Figure 5 This is a flowchart illustrating the second alarm event analysis method provided in this embodiment;

[0060] Figure 6 This is a structural block diagram of an alarm event analysis device provided in this embodiment;

[0061] Figure 7 This is an internal structural diagram of the computer device provided in this embodiment. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0063] To address the aforementioned technical problems, the alarm event analysis method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, specifically within the AI ​​Agent (Artificial Intelligence Agent) of the security system, the AI ​​Agent receives raw alarm data from security devices in response to alarm events. From the raw alarm data, the AI ​​Agent extracts multiple initial alarm entities and the relational descriptions between these entities. Based on these initial alarm entities and the relational descriptions, the AI ​​Agent constructs an initial directed graph. Finally, based on this initial directed graph, the AI ​​Agent determines the event analysis results for the alarm events.

[0064] It should be noted that this alarm event analysis method is mainly applied to scenarios where external attacks (such as malicious SQL injection) have occurred. It mainly focuses on the analysis of attack events after an external attack, including whether the attack was successful, whether there were false positives, and the scope of impact.

[0065] Among them, a security protection system refers to a system that ensures the secure operation of a user's business or network systems. For example, a security protection system can be an enterprise Security Operations Center (SOC), a Security Orchestration, Automation and Response (SOAR) system, and a cloud-native security protection platform. Security devices refer to various network security protection / detection tools that can generate security alert data and provide attack-related evidence. Their core function is to collect raw alerts, support AI Agent tool calls, and verify evidence. Security devices include, but are not limited to, the following categories: Log and security information management devices: for example, SIEM (Security Information and Event Management), responsible for centrally collecting various device logs and alert data. Boundary protection devices: for example, WAF (Web Application Firewall), used to detect web layer attacks and generate alerts. Endpoint security devices: EDR (Endpoint Detection and Response), monitoring and reporting abnormal processes, file operations, and other behaviors of hosts / terminals. Other auxiliary tools include traffic analysis tools, threat intelligence platforms, and host endpoint tools, which can be called by the AI ​​Agent through API (Application Programming Interface) to provide evidence data such as network traffic, IP reputation, and process trees.

[0066] In one embodiment, such as Figure 2 As shown, an alarm event analysis method is provided, which can be applied to... Figure 1 Taking the AI ​​Agent in the example, the following steps are included:

[0067] S201 receives raw alarm data from the security device in response to alarm events.

[0068] Security devices refer to various network security protection / detection tools that can generate security alert data and provide evidence related to attacks. Types of security devices include, but are not limited to, SIEM (Security Information and Event Management), WAF (Web Application Firewall), and EDR (Endpoint Detection and Response).

[0069] As an optional implementation of this application, when a security device detects an attack event, it triggers an alarm event based on the attack event and generates an alarm log. The alarm log is then sent to the AI ​​Agent. The AI ​​Agent obtains the raw alarm data based on the received alarm log.

[0070] As another optional implementation of this application, upon receiving an alarm event, the security device obtains the original alarm data associated with the alarm event and sends the original alarm data associated with the alarm event to the AI ​​Agent. The alarm event can be generated by a user device or a network device. The original alarm data can be obtained from alarm logs.

[0071] Optionally, in this embodiment, the number and type of security devices are not limited, and the format of the original alarm data is not limited either. It can be the original alarm data in JSON format or other formats.

[0072] S202, extract multiple initial alarm entities and the association description information between different initial alarm entities from the original alarm data.

[0073] The initial alarm entity refers to the key entity extracted from the original alarm data. The association pattern information refers to the alarm description information obtained from the original alarm data, which is used to characterize the association relationship between different initial alarm entities and is related to the alarm event.

[0074] Optionally, in this embodiment, the alarm entities basically include three categories: the attacking entity, the victim entity, and the behavior entity.

[0075] As an optional implementation of this application, semantic analysis is performed on the original alarm data, and based on the semantic analysis results, multiple initial alarm entities and the association description information between different initial alarm entities are extracted from the original alarm data.

[0076] Another optional implementation of this application is to extract multiple initial alarm entities and associated description information between different initial alarm entities from the original alarm data based on Named Entity Recognition (NER) technology.

[0077] S203, construct an initial directed graph based on multiple initial alarm entities and the association description information between different initial alarm entities.

[0078] A directed graph is a graph structure composed of nodes (entities) and directed edges (relationships). The direction of the edges clearly indicates the logical relationship between entities (such as causal, sequential, or triggering relationships).

[0079] Optionally, in this embodiment, an initial directed graph is constructed based on the entity information of each initial alert entity and the association description information between different initial alert entities. The entity information of the attacker entity may include, but is not limited to, source IP, malicious domain name, and attacker account. The entity information of the victim entity includes, but is not limited to, destination IP, hostname, affected port, and URL (Uniform Resource Locator). The entity information of the behavioral entity includes, but is not limited to, malicious payload, process name, and file hash. A malicious payload refers to the key part of malicious code that actually executes the core attack function, rather than an auxiliary propagation carrier (such as email attachments or malicious link shells). A file hash is a unique string calculated from the file content using a hash algorithm (such as MD5 or SHA-256), equivalent to the file's "digital fingerprint"—if the file content remains unchanged, the hash remains unchanged; even changing a single character in the content will completely change the hash. Specifically, each initial alert entity is used as an initial node in the initial directed graph; and initial edges are constructed in the initial directed graph based on the association description information between different initial alert entities. Entity information is used as the node attribute information of the initial nodes.

[0080] S204, Based on the initial directed graph, determine the event analysis results of the alarm events.

[0081] Among them, the event analysis results refer to the analysis results of alarm events.

[0082] As an optional implementation of this application, the event analysis results of the alarm event are determined based on the relevant information of the topology of the initial directed graph, the initial nodes, and the initial edges.

[0083] Another optional implementation of this application involves utilizing the generation capabilities of a large language model to transform the initial directed graph data into natural language description information. Based on this natural language description information, event analysis results are generated. These results may further include a visual snapshot of the directed graph, serving as a chain of evidence for easy manual verification.

[0084] Another optional implementation method of this application is to statistically analyze the characteristics of the initial directed graph, such as the number of nodes, number of edges, in-degree and out-degree, proportion of high-risk entities, and ring / branch structure, and output alarm event levels (high / medium / low) and maintenance strategies according to rules or models, and use the alarm event levels and maintenance strategies as the event analysis results.

[0085] The aforementioned alarm event analysis method receives raw alarm data from security devices for alarm events. From the raw alarm data, it extracts multiple initial alarm entities and the associated descriptive information between different initial alarm entities. Based on the multiple initial alarm entities and the associated descriptive information between different initial alarm entities, it constructs an initial directed graph. Based on the initial directed graph, it determines the event analysis result of the alarm event. Compared to the traditional method of using fixed automated rules for alarm event analysis, this application, upon receiving the raw alarm data corresponding to the alarm event, constructs an initial directed graph from the raw alarm data and determines the event analysis result based on the initial directed graph. This not only accurately reconstructs the attack logic, but also clearly defines the causal / temporal relationships such as "trigger" and "connection" between entities through directed edges, avoiding misjudgments of isolated alarms and clearly distinguishing between "attempted attack" and "successful intrusion." Furthermore, it achieves traceability and explainability based on the directed graph. Each analysis result corresponds to a node (evidence) and edge (association) in the graph, eliminating black-box judgment and facilitating manual review and tracing.

[0086] In one embodiment, to extract the initial alarm entity and associated description information more accurately and efficiently, such as Figure 3 As shown, an optional implementation method for extracting multiple initial alarm entities and the association description information between different initial alarm entities from the original alarm data includes:

[0087] S301 normalizes the original alarm data to obtain the target alarm data.

[0088] Among them, target alarm data refers to alarm data after normalization processing.

[0089] As an optional implementation of this application, the alarm field names and meanings in the original alarm data of different devices (WAF / EDR / SIEM) are mapped to unified standard fields (such as src_ip, dst_ip, alert_time, payload) to eliminate field heterogeneity and obtain the target alarm data.

[0090] Another optional implementation method of this application is to convert unstructured text and semi-structured logs into standard structures such as JSON / XML to obtain target alarm data.

[0091] As another optional implementation of this application, the normalization processing includes, but is not limited to, the following: Converting different time strings (timestamps, yyyy-MM-dd, MM / dd / yyyy, etc.) in the original alarm data into a standard time format / timestamp for easy time-series sorting and association; unifying UTF-8 / GBK encoding and decoding payloads such as URL encoding, hexadecimal, and Base64 to ensure normal text parsing; unifying the units (e.g., KB→MB, ms→s) for values ​​with units such as traffic and duration to facilitate numerical comparison and threshold judgment; and deduplicating duplicate alarms by fingerprint / hash / primary key to reduce computational waste caused by multiple devices repeatedly reporting the same event, thereby obtaining the target alarm data.

[0092] S302, perform entity recognition processing on the target alarm data to obtain the initial alarm entity.

[0093] As an optional implementation of this application, the initial alarm entity is extracted directly from the agreed fields (e.g., src_ip / dst_ip / payload / file_hash) in the target alarm data according to the field name.

[0094] Another optional implementation of this application is to pre-write regular expression patterns such as IP, port, URL, Hash, and SQL injection features, match them segment by segment in the target alarm data, and directly extract entities that conform to the format as initial alarm entities.

[0095] Another optional implementation of this application is to use a pre-trained model (e.g., BiLSTM+CRF model, BERT / RoBERTa model, etc.) to perform contextual semantic encoding on the target alarm data, automatically learn complex syntax and implicit features, and output the initial alarm entity.

[0096] Another optional implementation method of this application is to first locate the attack type (such as "SQL injection" or "XSS") by keywords, and then extract the corresponding attacker entity, victim entity, behavior entity and other initial alarm entities from the target alarm data by combining syntax / dependency relations.

[0097] S303, Determine the alarm description information based on the target alarm data.

[0098] As an optional implementation of this application, multiple sets of description templates are predefined (such as "{src_ip} launches {attack_type} attack against {dst_ip}"), and corresponding variables are extracted from the normalized field and filled in to generate alarm description information.

[0099] Another optional implementation of this application is to combine fields such as src_ip, attack_type, payload, and status into a coherent description according to the semantic structure of "attacker entity - behavior entity - victim entity - result", and then obtain alarm description information based on the target attack data.

[0100] Another optional implementation of this application is to use a text summarization model (such as BiLSTM or BERT summarization) to directly extract keywords from the original alarm text, and then combine them with context information to form alarm description information.

[0101] S304. Based on the alarm description information, determine the association description information between different initial alarm entities.

[0102] As an optional implementation of this application, the alarm description information is parsed syntactically to extract the subject-verb-object, modifier-adverb-complement and other dependency relations, and the "attacker entity-behavior entity-victim entity" is mapped to the associated description information (such as "attack", "access" and "execution") between the initial alarm entity.

[0103] Another optional implementation of this application is to preset an association rule template, such as "{Entity 1} performs {action} on {Entity 2}", and directly generate standardized association description information between different initial alarm entities through keyword matching (SQL injection, access, upload and execution).

[0104] As another optional implementation of this application, a model such as BERT / RoBERTA is used to concatenate "Entity 1 + Entity 2 + Alarm Description Information" as input, and output the association relationship labels between different initial alarm entities in a classified manner, thereby obtaining the association description information between different initial alarm entities.

[0105] In this embodiment, multi-source alarm data (SIEM, WAF, EDR, etc.) can be normalized to unify fields, formats, and definitions, resolving the problem of inconsistent output formats from different devices and establishing a standard data foundation for subsequent unified analysis. Entity recognition automatically extracts the initial alarm entity and its entity information (e.g., IP, URL, Hash, Payload, process name, etc.), removing irrelevant text and significantly reducing the amount of data and computational overhead for subsequent analysis. Based on the alarm description information in the target alarm data, associated description information is automatically generated, transforming isolated entities into structured information with semantic relationships. This replaces manual sorting of associated description relationships, improving the automation of attack chain construction and achieving fully automated processing from raw alarm data to structured evidence. Simultaneously, it improves the accuracy and efficiency of initial alarm entities and associated description information.

[0106] In one embodiment, to improve the accuracy and efficiency of event analysis results, such as Figure 4 As shown, an optional implementation method for determining the event analysis results of alarm events based on an initial directed graph includes:

[0107] S401, Based on the initial directed graph, determine the initial analysis results of the alarm events.

[0108] As an optional implementation of this application, the graph data of the initial directed graph is transformed into natural language description information by utilizing the generation capability of a large language model. Based on the natural language description information, initial analysis results are generated. The event analysis results may also include a visual snapshot of the directed graph, which serves as a chain of evidence for easy manual verification.

[0109] Another optional implementation method of this application is to statistically analyze the characteristics of the initial directed graph, such as the number of nodes, number of edges, in-degree and out-degree, proportion of high-risk entities, and ring / branch structure, and output alarm event levels (high / medium / low) and maintenance strategies according to rules or models, and use the alarm event levels and maintenance strategies as the initial analysis results.

[0110] S402, based on the initial analysis results, makes attack predictions and obtains the predicted information.

[0111] Optionally, in this embodiment, attack speculation is performed based on the initial analysis results and the initial directed graph to obtain the speculated attacker entity, victim entity, and attack type. Based on the attacker entity, victim entity, and attack type, the speculation information is determined. For example, "If the source IP initiates SQL injection (node ​​A, i.e., the attacker entity), then there should be abnormal SQL execution logs on the database server (node ​​B, i.e., the victim entity)."

[0112] S403, based on the inferred information, update the initial directed graph to obtain the target directed graph.

[0113] The target directed graph refers to the directed graph after updating the initial directed graph.

[0114] As an optional implementation of this application, based on speculative information (such as "where there is injection, there may be malicious files / processes"), the evidence chain information of the speculative information is determined, and based on the evidence chain information, missing entity nodes (such as file hash, process ID, attack tools, etc.) are automatically added to improve the attack scenario.

[0115] Another optional implementation of this application embodiment involves constructing a query command based on the speculative information. Based on the query command, an anomaly detection tool is invoked to obtain newly added valid alarm data for the alarm event. Based on the newly added valid alarm data, the initial directed graph is updated to obtain the target directed graph. For example, assuming the speculative information is "If the source IP initiated SQL injection (node ​​A, i.e., the attacker entity), then there should be abnormal SQL execution logs on the database server (node ​​B, i.e., the victim entity)," a query command is constructed, and the anomaly detection tool associated with the speculative information is invoked. In this embodiment, the anomaly detection tool includes a traffic analysis tool, a host endpoint tool, and a threat intelligence interface. By constructing a query statement, the traffic analysis tool is invoked to query the actual network traffic of node A (i.e., the attacker entity) and node B (i.e., the victim entity) within the alarm time window. The host endpoint tool is invoked to query the process tree on node B to find if there is an abnormal shell whose parent process is a database service. The threat intelligence interface is invoked to query the reputation score of the source IP. Based on actual network traffic and abnormal shells, new alarm data is obtained. The validity of the new alarm data is determined according to the reputation score of the source IP. For example, if the reputation score is below a preset threshold, the new alarm data is deemed valid and is thus recorded as new valid alarm data. An optional implementation method for updating the initial directed graph based on the new valid alarm data is to instantiate the new valid alarm data into new nodes and node edges, and then update the initial directed graph based on the new nodes and node edges to obtain the target directed graph.

[0116] S404, Based on the target directed graph, determine the event analysis results of the alarm event.

[0117] An optional implementation of this application involves utilizing the generation capabilities of a large language model to transform the graph data of the target directed graph into natural language description information. Based on this natural language description information, event analysis results are generated. These results may further include a visual snapshot of the directed graph, serving as a chain of evidence for easy manual verification.

[0118] Another optional implementation method of this application is to statistically analyze the characteristics of the directed graph, such as the number of nodes, the number of edges, the in-degree and out-degree, the proportion of high-risk entities, and the ring / branch structure, and output alarm event levels (high / medium / low) and maintenance strategies according to rules or models, and use the alarm event levels and maintenance strategies as the event analysis results.

[0119] Another optional implementation of this application embodiment is to obtain the event occurrence timestamp of the target node for the alarm event. Based on the event occurrence timestamp and the event sequence causal information associated with the alarm event, the target directed graph is optimized to obtain an effective directed graph. Based on the effective directed graph, the event analysis result of the alarm event is determined. An optional implementation of obtaining the event occurrence timestamp of the target node for the alarm event in this embodiment is to obtain the event occurrence timestamp of the target node for the alarm event through the alarm log associated with the alarm time of the target node. An optional implementation of optimizing the target directed graph based on the event occurrence timestamp and the event sequence causal information associated with the alarm event in this embodiment is to determine the first target node associated with the attacking entity and the second target node associated with the victim entity based on the event sequence causal information associated with the alarm event. Based on the event occurrence timestamps of the first target node and the second target node for the alarm event, it is determined whether there is a time logic inversion. If so, it is determined that the selection of the target node is abnormal, the alarm event is misjudged, or the node edge relationship is abnormal. If not, the target directed graph is used as the optimized directed graph. In the case of time logic inversion, the target directed graph is optimized (e.g., invalid target nodes or invalid edges are removed) to obtain a valid directed graph. In this embodiment, an optional implementation method for determining the event analysis result of the alarm event based on the valid directed graph is to determine the alarm impact range inference result and the attack reachability analysis result between valid nodes in the valid directed graph based on the valid directed graph. Based on the attack reachability analysis result and the alarm impact range inference result, the event analysis result of the alarm event is determined. In this embodiment, an optional implementation method for determining the alarm impact range inference result based on the valid directed graph is to determine the potentially affected nodes based on the transitivity of the valid directed graph. Based on the potentially affected nodes, the alarm impact range inference result is determined. For example, based on the transitivity of a valid directed graph, potentially affected downstream assets are identified. Based on these assets, affected nodes are determined and added to the valid directed graph. The results of inferring the scope of the alarm impact are then used to determine the potential affected downstream assets and the valid directed graph after adding affected nodes. In this embodiment, an optional implementation method for determining the attack reachability analysis results between valid nodes in the valid directed graph is to use a graph traversal algorithm (e.g., DFS (Depth-First Search) / BFS (Breadth-First Search)) in the graph to determine the attack reachability analysis results between valid nodes. For example, if starting from the "attack source" node, no path with the "successful execution" attribute can be found on the graph leading to the "victim asset," the attack reachability analysis result is determined to be an attack failure or interception.In this embodiment, an optional implementation method for determining the event analysis results of an alarm event based on the attack reachability analysis results and the alarm impact range inference results is to utilize the generation capabilities of a large language model to convert the graph data of the effective directed graph into natural language description information. Then, based on the natural language description information, a topology analysis result is generated. The topology analysis result may also include a visual snapshot of the directed graph, used as a chain of evidence for easy manual verification. The topology analysis result, the attack reachability analysis result, and the alarm impact range inference result are then used as the event analysis result of the alarm event.

[0120] In this embodiment, preliminary results are first obtained based on an initial directed graph. Then, through attack speculation, entities and relationships are supplemented and corrected in reverse, forming a complete analysis chain of reasoning, verification, and updating, avoiding information loss or misjudgment caused by single graph construction. Speculating attack intent, attack stages, and subsequent behaviors based on the initial analysis results can uncover hidden entities, hidden relationships, and complete attack paths not directly shown in the alarm, making the attack chain reconstruction more complete. Iteratively updating the initial directed graph based on the speculated information allows the graph structure to gradually approach the real attack scenario from a local, preliminary state, resulting in more complete entities, more accurate relationships, and more reasonable temporal and causal relationships. Using a structurally complete and semantically accurate target directed graph as the basis for judgment reduces false alarms, false negatives, and association errors compared to a single alarm or the initial directed graph, making the obtained event analysis results more accurate and the judgment of event classification, attack type, and impact scope for alarm events more reliable.

[0121] In one embodiment, such as Figure 5 As shown, one optional implementation of an alarm event analysis method includes:

[0122] S501 receives raw alarm data from security devices in response to alarm events.

[0123] S502, normalizes the original alarm data to obtain the target alarm data.

[0124] S503 performs entity recognition processing on the target alarm data to obtain the initial alarm entity.

[0125] S504, determine the alarm description information based on the target alarm data.

[0126] S505, Based on the alarm description information, determine the association description information between different initial alarm entities.

[0127] S506, each initial alarm entity is used as an initial node in the initial directed graph.

[0128] S507, construct the initial edges in the initial directed graph based on the association description information between different initial alarm entities.

[0129] S508, Based on the initial directed graph, determine the initial analysis results of the alarm events.

[0130] S509, based on the initial analysis results, makes attack predictions and obtains the predicted information.

[0131] S510: Construct a query command based on the inferred information.

[0132] S511, based on the query command, calls the anomaly investigation tool to obtain newly added valid alarm data for alarm events.

[0133] S512 updates the initial directed graph based on newly added valid alarm data to obtain the target directed graph.

[0134] S513, obtain the event timestamp of the target node for the alarm event.

[0135] S514. Based on the event timestamp and the event sequence causal information associated with the alarm event, optimize the target directed graph to obtain an effective directed graph.

[0136] S515, based on the effective directed graph, determine the inference results of the alarm impact range and the attack reachability analysis results between effective nodes in the effective directed graph.

[0137] S516, based on the attack reachability analysis results and the alarm impact range inference results, determine the event analysis results of the alarm event.

[0138] This application receives raw alarm data from security devices for alarm events. From the raw alarm data, it extracts multiple initial alarm entities and the associated descriptive information between different initial alarm entities. Based on the multiple initial alarm entities and the associated descriptive information between different initial alarm entities, it constructs an initial directed graph. Based on the initial directed graph, it determines the event analysis result of the alarm event. Compared to the traditional method of using fixed automated rules for alarm event analysis, this application, upon receiving the raw alarm data corresponding to the alarm event, constructs an initial directed graph from the raw alarm data and determines the event analysis result based on the initial directed graph. This not only accurately reconstructs the attack logic, but also clearly defines the causal / temporal relationships such as "trigger" and "connection" between entities through directed edges, avoiding misjudgments of isolated alarms and clearly distinguishing between "attempted attack" and "successful intrusion," but also achieves traceability and explainability based on the directed graph. Each step of the analysis result corresponds to a node (evidence) and edge (association) in the graph, eliminating black-box judgment and facilitating manual review and tracing.

[0139] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0140] Based on the same inventive concept, this application also provides an alarm event analysis apparatus for implementing the alarm event analysis method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more of the alarm event analysis apparatus embodiments provided below can be found in the limitations of the alarm event analysis method described above, and will not be repeated here.

[0141] In one embodiment, such as Figure 6 As shown, an alarm event analysis device 1 is provided, comprising: a receiving module 10, an extraction module 20, a construction module 30, and a determination module 40, wherein:

[0142] The receiving module 10 is used to receive raw alarm data from the security device in response to alarm events;

[0143] Extraction module 20 is used to extract multiple initial alarm entities and the association description information between different initial alarm entities from the original alarm data;

[0144] Module 30 is used to construct an initial directed graph based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0145] The determination module 40 is used to determine the event analysis results of alarm events based on the initial directed graph.

[0146] In one embodiment, the extraction module is further specifically used for:

[0147] The original alarm data is normalized to obtain the target alarm data;

[0148] Entity recognition processing is performed on the target alarm data to obtain the initial alarm entity;

[0149] Determine the alarm description information based on the target alarm data;

[0150] Based on the alarm description information, determine the associated description information between different initial alarm entities.

[0151] In one embodiment, the construction module is further specifically used for:

[0152] Each initial alarm entity is used as an initial node in the initial directed graph; and,

[0153] Based on the association description information between different initial alarm entities, the initial edges in the initial directed graph are constructed.

[0154] In one embodiment, the determining module is further specifically used for:

[0155] Based on the initial directed graph, determine the initial analysis results of the alarm events;

[0156] Based on the initial analysis results, attack predictions were made, and the predicted information was obtained.

[0157] Based on the inferred information, the initial directed graph is updated to obtain the target directed graph;

[0158] Based on the target directed graph, determine the event analysis results of the alarm events.

[0159] In one embodiment, the determining module is further specifically used for:

[0160] Construct a query command based on the inferred information;

[0161] Based on the query command, invoke the anomaly investigation tool to obtain newly added valid alarm data for alarm events;

[0162] Based on the newly added valid alarm data, the initial directed graph is updated to obtain the target directed graph.

[0163] In one embodiment, the target directed graph includes target nodes and target edges between target nodes; the determination module is further specifically used for:

[0164] Obtain the event timestamp of the target node in response to the alarm event;

[0165] Based on the event timestamp and the causal information of the event sequence associated with the alarm event, the target directed graph is optimized to obtain an effective directed graph;

[0166] Based on the valid directed graph, determine the event analysis results of the alarm events.

[0167] In one embodiment, the determining module is further specifically used for:

[0168] Based on the effective directed graph, determine the inference results of the alarm impact range and the attack reachability analysis results between effective nodes in the effective directed graph;

[0169] Based on the attack reachability analysis results and the alarm impact range inference results, the event analysis results of the alarm events are determined.

[0170] Each module in the aforementioned alarm event analysis device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0171] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores alarm event-related information. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an alarm event analysis method.

[0172] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0173] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0174] Receive raw alarm data from security devices in response to alarm events;

[0175] Extract descriptions of multiple initial alarm entities and the relationships between different initial alarm entities from the original alarm data;

[0176] An initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0177] Based on the initial directed graph, determine the event analysis results of the alarm events.

[0178] In one embodiment, when the processor executes the computer program, it further performs the following steps: extracting multiple initial alarm entities and association description information between different initial alarm entities from the raw alarm data, including:

[0179] The original alarm data is normalized to obtain the target alarm data;

[0180] Entity recognition processing is performed on the target alarm data to obtain the initial alarm entity;

[0181] Determine the alarm description information based on the target alarm data;

[0182] Based on the alarm description information, determine the associated description information between different initial alarm entities.

[0183] In one embodiment, when the processor executes the computer program, it further performs the following steps: constructing an initial directed graph based on multiple initial alarm entities and the association description information between different initial alarm entities, including:

[0184] Each initial alarm entity is used as an initial node in the initial directed graph; and,

[0185] Based on the association description information between different initial alarm entities, the initial edges in the initial directed graph are constructed.

[0186] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining the event analysis results of the alarm event based on the initial directed graph, including:

[0187] Based on the initial directed graph, determine the initial analysis results of the alarm events;

[0188] Based on the initial analysis results, attack predictions were made, and the predicted information was obtained.

[0189] Based on the inferred information, the initial directed graph is updated to obtain the target directed graph;

[0190] Based on the target directed graph, determine the event analysis results of the alarm events.

[0191] In one embodiment, when the processor executes the computer program, it further performs the following steps: updating the initial directed graph based on the inferred information to obtain the target directed graph, including:

[0192] Construct a query command based on the inferred information;

[0193] Based on the query command, invoke the anomaly investigation tool to obtain newly added valid alarm data for alarm events;

[0194] Based on the newly added valid alarm data, the initial directed graph is updated to obtain the target directed graph.

[0195] In one embodiment, when the processor executes the computer program, it further performs the following steps: the target directed graph includes target nodes and target edges between target nodes; based on the target directed graph, the event analysis results of the alarm event are determined, including:

[0196] Obtain the event timestamp of the target node in response to the alarm event;

[0197] Based on the event timestamp and the causal information of the event sequence associated with the alarm event, the target directed graph is optimized to obtain an effective directed graph;

[0198] Based on the valid directed graph, determine the event analysis results of the alarm events.

[0199] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining the event analysis results of the alarm event based on the valid directed graph, including:

[0200] Based on the effective directed graph, determine the inference results of the alarm impact range and the attack reachability analysis results between effective nodes in the effective directed graph;

[0201] Based on the attack reachability analysis results and the alarm impact range inference results, the event analysis results of the alarm events are determined.

[0202] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0203] Receive raw alarm data from security devices in response to alarm events;

[0204] Extract descriptions of multiple initial alarm entities and the relationships between different initial alarm entities from the original alarm data;

[0205] An initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0206] Based on the initial directed graph, determine the event analysis results of the alarm events.

[0207] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: extracting multiple initial alarm entities and association description information between different initial alarm entities from the raw alarm data, including:

[0208] The original alarm data is normalized to obtain the target alarm data;

[0209] Entity recognition processing is performed on the target alarm data to obtain the initial alarm entity;

[0210] Determine the alarm description information based on the target alarm data;

[0211] Based on the alarm description information, determine the associated description information between different initial alarm entities.

[0212] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: constructing an initial directed graph based on multiple initial alarm entities and the association description information between different initial alarm entities, including:

[0213] Each initial alarm entity is used as an initial node in the initial directed graph; and,

[0214] Based on the association description information between different initial alarm entities, the initial edges in the initial directed graph are constructed.

[0215] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the event analysis results of the alarm event based on the initial directed graph, including:

[0216] Based on the initial directed graph, determine the initial analysis results of the alarm events;

[0217] Based on the initial analysis results, attack predictions were made, and the predicted information was obtained.

[0218] Based on the inferred information, the initial directed graph is updated to obtain the target directed graph;

[0219] Based on the target directed graph, determine the event analysis results of the alarm events.

[0220] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: updating the initial directed graph based on speculative information to obtain a target directed graph, including:

[0221] Construct a query command based on the inferred information;

[0222] Based on the query command, invoke the anomaly investigation tool to obtain newly added valid alarm data for alarm events;

[0223] Based on the newly added valid alarm data, the initial directed graph is updated to obtain the target directed graph.

[0224] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: the target directed graph includes target nodes and target edges between target nodes; based on the target directed graph, the event analysis results of the alarm event are determined, including:

[0225] Obtain the event timestamp of the target node in response to the alarm event;

[0226] Based on the event timestamp and the causal information of the event sequence associated with the alarm event, the target directed graph is optimized to obtain an effective directed graph;

[0227] Based on the valid directed graph, determine the event analysis results of the alarm events.

[0228] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the event analysis results of the alarm event based on the valid directed graph, including:

[0229] Based on the effective directed graph, determine the inference results of the alarm impact range and the attack reachability analysis results between effective nodes in the effective directed graph;

[0230] Based on the attack reachability analysis results and the alarm impact range inference results, the event analysis results of the alarm events are determined.

[0231] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0232] Receive raw alarm data from security devices in response to alarm events;

[0233] Extract descriptions of multiple initial alarm entities and the relationships between different initial alarm entities from the original alarm data;

[0234] An initial directed graph is constructed based on multiple initial alarm entities and the association description information between different initial alarm entities;

[0235] Based on the initial directed graph, determine the event analysis results of the alarm events.

[0236] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: extracting multiple initial alarm entities and association description information between different initial alarm entities from the raw alarm data, including:

[0237] The original alarm data is normalized to obtain the target alarm data;

[0238] Entity recognition processing is performed on the target alarm data to obtain the initial alarm entity;

[0239] Determine the alarm description information based on the target alarm data;

[0240] Based on the alarm description information, determine the associated description information between different initial alarm entities.

[0241] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: constructing an initial directed graph based on multiple initial alarm entities and the association description information between different initial alarm entities, including:

[0242] Each initial alarm entity is used as an initial node in the initial directed graph; and,

[0243] Based on the association description information between different initial alarm entities, the initial edges in the initial directed graph are constructed.

[0244] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the event analysis results of the alarm event based on the initial directed graph, including:

[0245] Based on the initial directed graph, determine the initial analysis results of the alarm events;

[0246] Based on the initial analysis results, attack predictions were made, and the predicted information was obtained.

[0247] Based on the inferred information, the initial directed graph is updated to obtain the target directed graph;

[0248] Based on the target directed graph, determine the event analysis results of the alarm events.

[0249] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: updating the initial directed graph based on speculative information to obtain a target directed graph, including:

[0250] Construct a query command based on the inferred information;

[0251] Based on the query command, invoke the anomaly investigation tool to obtain newly added valid alarm data for alarm events;

[0252] Based on the newly added valid alarm data, the initial directed graph is updated to obtain the target directed graph.

[0253] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: the target directed graph includes target nodes and target edges between target nodes; based on the target directed graph, the event analysis results of the alarm event are determined, including:

[0254] Obtain the event timestamp of the target node in response to the alarm event;

[0255] Based on the event timestamp and the causal information of the event sequence associated with the alarm event, the target directed graph is optimized to obtain an effective directed graph;

[0256] Based on the valid directed graph, determine the event analysis results of the alarm events.

[0257] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the event analysis results of the alarm event based on the valid directed graph, including:

[0258] Based on the effective directed graph, determine the inference results of the alarm impact range and the attack reachability analysis results between effective nodes in the effective directed graph;

[0259] Based on the attack reachability analysis results and the alarm impact range inference results, the event analysis results of the alarm events are determined.

[0260] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0261] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0262] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An alarm event analysis method, characterized in that, The method includes: Receive raw alarm data from security devices in response to alarm events; Extract multiple initial alarm entities and the associated description information between different initial alarm entities from the original alarm data; Based on the multiple initial alarm entities and the association description information between different initial alarm entities, an initial directed graph is constructed; Based on the initial directed graph, the event analysis results of the alarm event are determined.

2. The method according to claim 1, characterized in that, The step of extracting multiple initial alarm entities and the association description information between different initial alarm entities from the original alarm data includes: The original alarm data is normalized to obtain the target alarm data; The target alarm data is subjected to entity recognition processing to obtain the initial alarm entity; Based on the target alarm data, determine the alarm description information; Based on the alarm description information, determine the associated description information between different initial alarm entities.

3. The method according to claim 1, characterized in that, The step of constructing an initial directed graph based on the multiple initial alarm entities and the association description information between different initial alarm entities includes: Each initial alarm entity is used as an initial node in the initial directed graph; and, The initial edges in the initial directed graph are constructed based on the association description information between different initial alarm entities.

4. The method according to claim 1, characterized in that, The process of determining the event analysis results of the alarm event based on the initial directed graph includes: Based on the initial directed graph, determine the initial analysis results of the alarm event; Based on the initial analysis results, attack predictions are made to obtain prediction information; Based on the inferred information, the initial directed graph is updated to obtain the target directed graph; Based on the target directed graph, determine the event analysis results of the alarm event.

5. The method according to claim 4, characterized in that, The step of updating the initial directed graph based on the inferred information to obtain the target directed graph includes: Based on the inferred information, construct a query command; Based on the query command, the anomaly investigation tool is invoked to obtain the newly added valid alarm data of the alarm event; Based on the newly added valid alarm data, the initial directed graph is updated to obtain the target directed graph.

6. The method according to claim 4, characterized in that, The target directed graph includes target nodes and target edges between the target nodes; determining the event analysis result of the alarm event based on the target directed graph includes: Obtain the event timestamp of the target node in response to the alarm event; Based on the event occurrence timestamp and the event sequence causal information associated with the alarm event, the target directed graph is optimized to obtain an effective directed graph; Based on the effective directed graph, determine the event analysis results of the alarm event.

7. The method according to claim 6, characterized in that, The process of determining the event analysis results of the alarm event based on the valid directed graph includes: Based on the effective directed graph, determine the alarm impact range inference result and the attack reachability analysis result between effective nodes in the effective directed graph; Based on the attack reachability analysis results and the alarm impact range inference results, the event analysis results of the alarm event are determined.

8. An alarm event analysis device, characterized in that, include: The receiving module is used to receive raw alarm data from security devices in response to alarm events; The extraction module is used to extract multiple initial alarm entities and the association description information between different initial alarm entities from the original alarm data; The construction module is used to construct an initial directed graph based on the multiple initial alarm entities and the association description information between different initial alarm entities; The determination module is used to determine the event analysis result of the alarm event based on the initial directed graph.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the alarm event analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the alarm event analysis method according to any one of claims 1 to 7.

Images