An alarm aggregation method, apparatus, electronic device, and storage medium

Abstract

The application discloses an alarm aggregation method and device, electronic equipment and a storage medium, relates to the technical field of network security, and aggregates historical alarm data to divide at least one alarm cluster. When new alarm data is obtained, the behavior characteristics of the new alarm data are extracted, and a behavior portrait is constructed. Similarity analysis is performed on the behavior characteristics and the behavior portrait of the new alarm data and the historical behavior characteristics and the historical behavior portrait of the representative alarms in each alarm cluster, and the similarity scores of the new alarm data and each alarm cluster are determined. In combination with an alarm threshold, a target alarm cluster matched by the new alarm data is determined, and the new alarm data is aggregated to the target alarm cluster. Through statistical analysis on the behavior data of the alarm data, the similarity between different alarm data is determined based on behavior statistics. The alarms with high similarity are automatically aggregated by using the alarm threshold, the number of redundant alarms is reduced, and the alarm processing efficiency and research and judgment accuracy are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an alarm aggregation method, apparatus, electronic device, and storage medium. Background Technology

[0002] In current network security monitoring systems, tools such as Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM) platforms continuously monitor network traffic and generate a large number of raw alerts. These alerts are often highly redundant. For example, the same attack source launching similar attacks on multiple targets, or the same malicious IP repeatedly attempting different attack payloads within a short period of time, will trigger a large number of alerts with similar structures but slightly different details.

[0003] Traditional alert aggregation methods often employ static rules, such as simple merging based on fixed time windows, source / destination IP pairs, or attack types. However, these methods struggle to adapt to the dynamic evolution of attack behavior, easily leading to over-aggregation, incorrectly merging fundamentally different attack events, and masking the true threat. They fail to accurately identify alerts with highly similar behavioral patterns, resulting in alert storms due to insufficient aggregation. Furthermore, they ignore the historical behavioral characteristics of network entities (such as IP addresses), making it impossible to determine whether the current alert is a continuation of a known attack pattern.

[0004] It is evident that effectively reducing the number of alarms and improving alarm processing efficiency and analysis accuracy are problems that need to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide an alarm aggregation method, apparatus, electronic device, and storage medium that can effectively reduce the number of alarms and improve alarm processing efficiency and judgment accuracy.

[0006] This application provides an alarm aggregation method, including: Historical alarm data is aggregated and divided into at least one alarm cluster; each alarm cluster contains historical behavioral characteristics and historical behavioral profiles. When new alarm data is acquired, the behavioral characteristics of the new alarm data are extracted, and a behavioral profile is constructed. A similarity analysis is performed on the behavioral characteristics and behavioral profiles of the new alarm data, as well as the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, to determine the similarity score between the new alarm data and each alarm cluster. Based on the similarity score and the set alarm threshold, the target alarm clusters that match the new alarm data are determined, and the new alarm data is aggregated into the target alarm clusters.

[0007] On the one hand, historical alarm data is aggregated to divide it into at least one alarm cluster, including: Extract the historical behavior characteristics of each alarm data in the historical alarm data within the sliding time window; the historical behavior characteristics include historical IP address, historical access direction, and historical data packet characteristics; Analyze the attack methods of active IP addresses in historical behavior characteristics to construct historical behavior profiles; Based on the historical behavioral characteristics and historical behavioral profiles of each alarm data, at least one alarm cluster is constructed.

[0008] On the one hand, based on the historical behavioral characteristics and historical behavioral profiles of each alarm data, at least one alarm cluster is constructed, including: Compare the historical behavior characteristics of any two alarm data sets to determine the degree of matching of historical behavior characteristics between any two alarm data sets. Perform similarity analysis on the historical behavior profiles of any two alarm data sets to determine the similarity of the historical behavior profiles between any two alarm data sets. Based on the matching degree of historical behavioral features and the similarity of historical behavioral profiles, each alarm data is divided into at least one alarm cluster.

[0009] On the one hand, the historical behavioral characteristics of any two alarm data points are compared to determine the degree of matching of historical behavioral characteristics between any two alarm data points, including: Compare the historical IP addresses of any two alarm data sets to determine the historical IP address matching degree between any two alarm data sets; Perform consistency analysis on the historical access directions of any two alarm data sets to determine the consistency of historical access directions between any two alarm data sets. Perform similarity analysis on the historical data packet characteristics of any two alarm data sets to determine the historical feature similarity between any two alarm data sets.

[0010] On the one hand, based on the matching degree of historical behavioral features and the similarity of historical behavioral profiles, each alarm data is divided into at least one alarm cluster, including: Based on historical IP address matching degree, historical access direction consistency degree, historical feature similarity, and historical behavior profile similarity, the historical similarity score between each alarm data is determined; Based on the historical similarity scores between each alarm data point, the alarm data points are aggregated into at least one alarm cluster.

[0011] On the one hand, a similarity analysis is performed on the behavioral characteristics and behavioral profiles of the new alarm data, as well as the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, to determine the similarity score between the new alarm data and each alarm cluster, including: The IP address of the new alarm data is compared with the IP address of the target representative alarm to determine the IP address matching degree; where the target representative alarm is the representative alarm of any alarm cluster in all alarm clusters; A consistency analysis is performed on the access direction of the new alarm data and the access direction of the target alarm to determine the degree of consistency of the access direction. A similarity analysis is performed between the data packet characteristics of the new alarm data and the data packet characteristics of the target representing the alarm to determine the feature similarity. A similarity analysis is performed between the behavioral profiles of the new alarm data and the historical behavioral profiles of the target representative alarms to determine the similarity of the behavioral profiles. Based on IP address matching degree, access direction consistency degree, feature similarity, and behavioral profile similarity, the similarity score between the new alarm data and the alarm cluster to which the target representative alarm belongs is determined.

[0012] On the one hand, based on IP address matching degree, access direction consistency, feature similarity, and behavioral profile similarity, the similarity score between the new alarm data and the alarm cluster to which the target representative alarm belongs is determined, including: Based on the weights matched in the current network environment, the similarity score is obtained by weighted summation of IP address matching degree, access direction consistency degree, feature similarity, and behavioral profile similarity.

[0013] On the one hand, regarding the setting of weights matched to the current network environment, the methods also include: If a scanning attack of a set scale is detected, the IP weight corresponding to the IP address will be increased. When detecting low-frequency attacks of unknown threat types, increase the feature weights corresponding to the packet characteristics.

[0014] On the one hand, regarding the setting of alarm thresholds, the methods also include: When the system is in a Class I load state, reduce the alarm threshold; When the system is in the second type of load state, increase the alarm threshold; where the system load in the first type of load state is greater than the system load in the second type of load state.

[0015] This application embodiment also provides an alarm aggregation device, including a partitioning unit, a construction unit, an allocation unit, and an aggregation unit; The segmentation unit is used to aggregate historical alarm data and divide it into at least one alarm cluster; each alarm cluster contains historical behavior characteristics and historical behavior profiles. The building unit is used to extract the behavioral characteristics of new alarm data and build a behavioral profile when new alarm data is acquired. The allocation unit is used to perform similarity analysis on the behavioral characteristics and behavioral profiles of new alarm data and the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, and to determine the similarity score between the new alarm data and each alarm cluster. The aggregation unit is used to determine the target alarm cluster that matches the new alarm data based on the similarity score and the set alarm threshold, and to aggregate the new alarm data into the target alarm cluster.

[0016] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of any of the alarm aggregation methods described above when executing the computer program.

[0017] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described alarm aggregation methods.

[0018] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described alarm aggregation methods.

[0019] As can be seen from the above technical solution, historical alarm data is aggregated to form at least one alarm cluster; each alarm cluster contains historical behavioral features and historical behavioral profiles. When new alarm data is acquired, behavioral features of the new alarm data are extracted, and behavioral profiles are constructed. Similarity analysis is performed on the behavioral features and behavioral profiles of the new alarm data, as well as the historical behavioral features and historical behavioral profiles representing alarms in at least one alarm cluster, to determine the similarity score between the new alarm data and each alarm cluster. Based on the similarity score and a set alarm threshold, the target alarm cluster matching the new alarm data is determined, and the new alarm data is aggregated into the target alarm cluster. In this technical solution, behavioral features are extracted and behavioral profiles representing normal behavioral patterns are formed through statistical analysis of the behavioral data of alarm data. Based on behavioral statistics, an adaptive algorithm is used to calculate the similarity between different alarms. Alarms with high similarity are automatically aggregated using alarm thresholds, thereby reducing the number of redundant alarms, improving alarm processing efficiency and judgment accuracy, and enhancing the quality and availability of alarms. Attached Figure Description

[0020] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A flowchart illustrating an alarm aggregation method provided in this application embodiment; Figure 2 A flowchart illustrating a method for performing similarity analysis on alarm data, provided in an embodiment of this application; Figure 3 This is a schematic diagram of an alarm aggregation device provided in an embodiment of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0023] The terms "comprising" and "having," and any variations thereof, in the specification and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may include steps or units not listed.

[0024] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] Next, we will describe in detail an alarm aggregation method provided by the embodiments of this application. Figure 1 A flowchart of an alarm aggregation method provided in this application embodiment, the method including: S101: Aggregate historical alarm data and divide it into at least one alarm cluster.

[0026] Each alarm cluster contains historical behavior characteristics and historical behavior profiles.

[0027] This solution is applicable to network security monitoring scenarios. In practical applications, it can receive historical alarm data from network security detection devices and extract the historical behavioral characteristics of each alarm data in the historical alarm data within a sliding time window. The historical behavioral characteristics can include historical IP addresses, historical access directions, and historical data packet characteristics.

[0028] Historical IP addresses can include historical source IP addresses and historical destination IP addresses.

[0029] Historical data packet characteristics may include protocol, request method, port, payload length, etc.

[0030] After extracting historical behavioral characteristics, attack methods can be analyzed for active IP addresses within those characteristics to construct a historical behavioral profile.

[0031] In practical applications, the frequency of each IP address can be counted, and IP addresses with a frequency greater than a set frequency threshold are considered to be active IP addresses.

[0032] For each active historical IP address, its behavioral profile is maintained in real time. The behavioral profile may include: connection frequency per unit time; set of target IPs accessed and their distribution entropy; historical markers of abnormal behavior; and behavioral mutation index (the degree of deviation of current behavior from the historical baseline).

[0033] Behavioral profiles can be updated incrementally through sliding time windows, and noise can be smoothed using an exponentially weighted moving average (EWMA) mechanism.

[0034] The value of the sliding time window can be flexibly set based on actual needs, and there is no limitation here. For example, the sliding time window can be set to 7 days.

[0035] To reduce the number of redundant alarms, at least one alarm cluster can be constructed based on the historical behavior characteristics and historical behavior profiles of each alarm data.

[0036] In this embodiment, the historical behavior features of any two alarm data can be compared to determine the matching degree of historical behavior features between any two alarm data; similarity analysis is performed on the historical behavior profiles of any two alarm data to determine the similarity of historical behavior profiles between any two alarm data; based on the matching degree of historical behavior features and the similarity of historical behavior profiles, each alarm data is divided into at least one alarm cluster.

[0037] Historical behavioral characteristics can include historical IP addresses, historical access directions, and historical data packet characteristics. Therefore, the matching degree of historical behavioral characteristics can include the matching degree of historical IP addresses, the consistency of historical access directions, and the similarity of historical characteristics.

[0038] In practical applications, the historical IP addresses of any two alarm data sets can be compared to determine the matching degree between them; the historical access directions of any two alarm data sets can be analyzed for consistency to determine the consistency of their historical access directions; and the historical data packet characteristics of any two alarm data sets can be analyzed for similarity to determine the similarity of their historical characteristics.

[0039] Based on historical IP address matching degree, historical access direction consistency degree, historical feature similarity, and historical behavior profile similarity, the historical similarity score between each alarm data is determined; based on the historical similarity score between each alarm data, each alarm data is aggregated into at least one alarm cluster.

[0040] In practical applications, alarm clusters can be divided based on a set dynamic alarm threshold. For example, if the alarm threshold is 85 and the historical similarity score of alarm data A and alarm data B is 90, then alarm data A and alarm data B can be grouped into the same alarm cluster.

[0041] S102: When new alarm data is obtained, extract the behavioral characteristics of the new alarm data and build a behavioral profile.

[0042] When new alarm data is acquired, in order to assess whether the new alarm data can be aggregated with existing alarm clusters, it is necessary to extract the behavioral characteristics of the new alarm data and build a behavioral profile.

[0043] The behavioral characteristics of the new alarm data can include IP address, access direction, and packet characteristics. The IP address can include the source IP address and the destination IP address; packet characteristics can include protocol, request method, port, payload length, etc.

[0044] After extracting behavioral characteristics, attack methods can be analyzed for active IP addresses within these characteristics to construct behavioral profiles. These behavioral profiles can include: connection frequency per unit time; the set of target IPs accessed and their distribution entropy; abnormal behavior markers; and behavioral mutation indices.

[0045] S103: Perform similarity analysis on the behavioral characteristics and behavioral profiles of the new alarm data and the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, and determine the similarity score between the new alarm data and each alarm cluster.

[0046] To achieve quantitative evaluation of behavioral characteristics and behavioral profiles, this application compares the behavioral characteristics of new alarm data with the historical behavioral characteristics of representative alarms in each alarm cluster to determine the degree of matching between the behavioral characteristics of the new alarm data and the representative alarms in each alarm cluster. For the comparison method of behavioral characteristics, please refer to [link to relevant documentation]. Figure 2 The details of its introduction will not be repeated here.

[0047] The behavioral profiles of the new alarm data are compared with the behavioral profiles of the representative alarms in each alarm cluster to determine the similarity between the behavioral profiles of the new alarm data and the representative alarms in each alarm cluster.

[0048] By weighted summing the behavioral characteristics of the new alarm data with the behavioral characteristics matching degree and profile similarity between the alarms representing each alarm cluster, the similarity score between the new alarm data and each alarm cluster can be determined.

[0049] S104: Based on the similarity score and the set alarm threshold, determine the target alarm cluster that matches the new alarm data, and aggregate the new alarm data into the target alarm cluster.

[0050] Each new alarm data has a corresponding similarity score with each alarm cluster.

[0051] In practical applications, the alarm cluster with the highest similarity score that exceeds the alarm threshold can be used as the target alarm cluster.

[0052] The new alarm data has a lot of duplicate information with the target alarm cluster. By aggregating the new alarm data into the target alarm cluster, the number of redundant alarms is reduced.

[0053] Whenever new alarm data is added to an alarm cluster, the representative alarm of the alarm cluster needs to be updated.

[0054] If the highest similarity score is still less than the alarm threshold, the new alarm data can be treated as a new alarm cluster.

[0055] As can be seen from the above technical solution, historical alarm data is aggregated to form at least one alarm cluster; each alarm cluster contains historical behavioral features and historical behavioral profiles. When new alarm data is acquired, behavioral features of the new alarm data are extracted, and behavioral profiles are constructed. Similarity analysis is performed on the behavioral features and behavioral profiles of the new alarm data, as well as the historical behavioral features and historical behavioral profiles representing alarms in at least one alarm cluster, to determine the similarity score between the new alarm data and each alarm cluster. Based on the similarity score and a set alarm threshold, the target alarm cluster matching the new alarm data is determined, and the new alarm data is aggregated into the target alarm cluster. In this technical solution, behavioral features are extracted and behavioral profiles representing normal behavioral patterns are formed through statistical analysis of the behavioral data of alarm data. Based on behavioral statistics, an adaptive algorithm is used to calculate the similarity between different alarms. Alarms with high similarity are automatically aggregated using alarm thresholds, thereby reducing the number of redundant alarms, improving alarm processing efficiency and judgment accuracy, and enhancing the quality and availability of alarms.

[0056] In this embodiment of the application, in order to significantly reduce the number of alarms while ensuring the semantic integrity of alarms, a dynamic alarm aggregation mechanism can be adopted, that is, the alarm threshold can be adaptively adjusted according to the current alarm density.

[0057] In practice, when the system is in the first type of load state, the alarm threshold can be reduced; when the system is in the second type of load state, the alarm threshold can be increased; wherein, the system load in the first type of load state is greater than the system load in the second type of load state.

[0058] In practical applications, the load state with the number of alarms per unit time greater than or equal to the quantity threshold can be regarded as the first type of load state, namely the high alarm load state, and the load state with the number of alarms per unit time less than the quantity threshold can be regarded as the second type of load state, namely the low load state.

[0059] Under high alarm load conditions, lowering the alarm threshold can promote aggregation. Under low load conditions, raising the alarm threshold can prevent excessive aggregation.

[0060] This application can compress raw alarm data by more than 70% through behavior-aware dynamic aggregation, and has strong adaptability in unknown threat scenarios. By dynamically adjusting the alarm threshold according to the network threat situation, it takes into account the detection needs of large-scale attacks and covert attacks. At the same time, the aggregation results include behavioral statistical summaries, which helps to quickly understand attack patterns.

[0061] Figure 2 A flowchart of a method for similarity analysis of alarm data provided in this application embodiment, the method including: S201: Compare the IP address of the new alarm data with the IP address representing the target alarm to determine the IP address matching degree.

[0062] The target alarm is the representative alarm of any alarm cluster among all alarm clusters.

[0063] A representative alarm can be a concentrated representation of the alarm characteristics within an alarm cluster. The selection of representative alarms is a relatively mature technology and will not be elaborated upon here.

[0064] IP addresses include source IP addresses and destination IP addresses. In behavioral profiling similarity analysis, the analysis mainly focuses on the behavior of source IP addresses. Therefore, the IP address comparison here can be a comparison of target IP addresses.

[0065] Depending on the business scenario, an IP address can be a single IP address or an IP network segment. When comparing IP addresses, in addition to comparing individual IP addresses or IP network segments, you can also compare the domain names corresponding to those IP addresses.

[0066] S202: Perform a consistency analysis on the access direction of the new alarm data and the access direction of the target alarm to determine the consistency of the access direction.

[0067] Considering the aggregation of alarm data, the consistency of data access direction must be ensured first. Therefore, when performing access direction consistency analysis, taking the access direction consistency degree as a percentage as an example, if the access direction of the new alarm data is consistent with the access direction of the target alarm, the access direction consistency degree is 100 points; if the access direction of the new alarm data is inconsistent with the access direction of the target alarm, the access direction consistency degree is 0 points.

[0068] S203: Perform similarity analysis on the characteristics of the new alarm data packets and the characteristics of the target alarm data packets to determine the feature similarity.

[0069] In practical applications, Jaccard similarity or cosine similarity can be calculated between data packet features.

[0070] S204: Based on the behavioral profile of the new alarm data, perform similarity analysis with the historical behavioral profile of the target representative alarm to determine the similarity of the behavioral profiles.

[0071] In this embodiment of the application, the similarity analysis of the behavioral profile can be the analysis of the behavior corresponding to the source IP address.

[0072] S205: Based on IP address matching degree, access direction consistency degree, feature similarity, and behavioral profile similarity, determine the similarity score between the new alarm data and the alarm cluster to which the target representative alarm belongs.

[0073] In this embodiment of the application, the similarity score can be obtained by weighting and summing the IP address matching degree, access direction consistency degree, feature similarity and behavioral profile similarity according to the weight matched by the current network environment.

[0074] In the initial state, the weight settings for each parameter can be set to be larger, such as the directional weight corresponding to the directional consistency and the feature weight corresponding to the feature similarity.

[0075] When the network environment changes, the degree of influence of different parameters on alarm aggregation will change. Therefore, the weights can be dynamically adjusted based on changes in the network environment.

[0076] In practical implementation, the IP weight corresponding to the IP address can be increased when a scanning attack of a set scale is detected; and the feature weight corresponding to the packet characteristics can be increased when a low-frequency attack of an unknown threat type is detected.

[0077] In this embodiment of the application, by dynamically adjusting the weights according to changes in the network environment, the similarity scores are made more in line with the aggregation requirements of the current network environment, thus ensuring the aggregation quality of alarm data.

[0078] Figure 3 A schematic diagram of an alarm aggregation device provided in an embodiment of this application includes a partitioning unit 31, a construction unit 32, an allocation unit 33, and an aggregation unit 34; The partitioning unit 31 is used to aggregate historical alarm data and divide it into at least one alarm cluster; wherein each alarm cluster contains historical behavior characteristics and historical behavior profiles; Construction unit 32 is used to extract the behavioral characteristics of new alarm data and construct a behavioral profile when new alarm data is acquired. Allocation unit 33 is used to perform similarity analysis on the behavioral characteristics and behavioral profiles of new alarm data and the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, and to determine the similarity score between the new alarm data and each alarm cluster. The aggregation unit 34 is used to determine the target alarm cluster that matches the new alarm data based on the similarity score and the set alarm threshold, and to aggregate the new alarm data into the target alarm cluster.

[0079] In some embodiments, the partitioning unit includes an extraction subunit, an analysis subunit, and a construction subunit; The extraction sub-unit is used to extract the historical behavior features of each alarm data in the historical alarm data within the sliding time window; the historical behavior features include historical IP address, historical access direction, and historical data packet features; The analysis subunit is used to analyze the attack methods of active IP addresses in historical behavior characteristics and build historical behavior profiles. Construct sub-units to build at least one alarm cluster based on the historical behavior characteristics and historical behavior profiles of each alarm data.

[0080] In some embodiments, a subunit is constructed to compare the historical behavioral features of any two alarm data to determine the matching degree of historical behavioral features between any two alarm data; to perform similarity analysis on the historical behavioral profiles of any two alarm data to determine the similarity of historical behavioral profiles between any two alarm data; and to divide each alarm data into at least one alarm cluster based on the matching degree of historical behavioral features and the similarity of historical behavioral profiles.

[0081] In some embodiments, a subunit is constructed to compare the historical IP addresses of any two alarm data sets to determine the historical IP address matching degree between the two alarm data sets; to perform consistency analysis on the historical access directions of any two alarm data sets to determine the historical access direction consistency degree between the two alarm data sets; and to perform similarity analysis on the historical data packet characteristics of any two alarm data sets to determine the historical feature similarity between the two alarm data sets.

[0082] In some embodiments, a subunit is constructed to determine the historical similarity score between each alarm data based on historical IP address matching degree, historical access direction consistency degree, historical feature similarity, and historical behavior profile similarity; and to aggregate each alarm data into at least one alarm cluster based on the historical similarity score between each alarm data.

[0083] The historical IP addresses of each alarm data are compared to determine the degree of historical IP address matching between each alarm data. Perform a consistency analysis on the historical access directions of each alarm data to determine the consistency of historical access directions among the alarm data. Similarity analysis is performed on the historical data packet characteristics of each alarm data to determine the historical feature similarity between each alarm data; Perform similarity analysis on the historical behavior profiles of each alarm data to determine the similarity of historical behavior profiles between each alarm data; Based on historical IP address matching degree, historical access direction consistency degree, historical feature similarity, and historical behavior profile similarity, the historical similarity score between each alarm data is determined; Based on the historical similarity scores between each alarm data point, the alarm data points are aggregated into at least one alarm cluster.

[0084] In some embodiments, the allocation unit includes a comparison subunit, a first analysis subunit, a second analysis subunit, a third analysis subunit, and a determination subunit; The comparison subunit is used to compare the IP address of the new alarm data with the IP address of the target representative alarm to determine the IP address matching degree; wherein, the target representative alarm is the representative alarm of any alarm cluster in all alarm clusters; The first analysis subunit is used to perform consistency analysis on the access direction of new alarm data and the access direction of the target alarm to determine the degree of consistency of access direction. The second analysis subunit is used to perform similarity analysis on the data packet characteristics of the new alarm data and the data packet characteristics of the target representing the alarm, and to determine the feature similarity. The third analysis subunit is used to perform similarity analysis between the behavioral profile based on the new alarm data and the historical behavioral profile representing the target alarm, and to determine the similarity of the behavioral profiles. The sub-unit is determined based on IP address matching degree, access direction consistency degree, feature similarity, and behavior profile similarity to determine the similarity score between the new alarm data and the alarm cluster to which the target representative alarm belongs.

[0085] In some embodiments, a subunit is determined to perform a weighted summation of IP address matching degree, access direction consistency degree, feature similarity and behavioral profile similarity according to the weights matched by the current network environment, to obtain a similarity score.

[0086] In some embodiments, the apparatus further includes a weight increase unit and a weight decrease unit for setting weights that match the current network environment; The enlargement unit is used to increase the IP weight corresponding to an IP address when a scanning attack of a set scale is detected. The reduction unit is used to increase the feature weight corresponding to the packet features when low-frequency attacks of unknown threat types are detected.

[0087] In some embodiments, the device further includes a threshold reduction unit and a threshold increase unit for setting alarm thresholds; The threshold reduction unit is used to reduce the alarm threshold when the system is in the first type of load state; The threshold increase unit is used to increase the alarm threshold when the system is in the second type of load state; wherein the system load in the first type of load state is greater than the system load in the second type of load state.

[0088] Figure 3 The description of the features in the corresponding embodiments can be found in [reference needed]. Figure 1 The relevant descriptions of the corresponding embodiments will not be repeated here.

[0089] As can be seen from the above technical solution, historical alarm data is aggregated to form at least one alarm cluster; each alarm cluster contains historical behavioral features and historical behavioral profiles. When new alarm data is acquired, behavioral features of the new alarm data are extracted, and behavioral profiles are constructed. Similarity analysis is performed on the behavioral features and behavioral profiles of the new alarm data, as well as the historical behavioral features and historical behavioral profiles representing alarms in at least one alarm cluster, to determine the similarity score between the new alarm data and each alarm cluster. Based on the similarity score and a set alarm threshold, the target alarm cluster matching the new alarm data is determined, and the new alarm data is aggregated into the target alarm cluster. In this technical solution, behavioral features are extracted and behavioral profiles representing normal behavioral patterns are formed through statistical analysis of the behavioral data of alarm data. Based on behavioral statistics, an adaptive algorithm is used to calculate the similarity between different alarms. Alarms with high similarity are automatically aggregated using alarm thresholds, thereby reducing the number of redundant alarms, improving alarm processing efficiency and judgment accuracy, and enhancing the quality and availability of alarms.

[0090] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above-described alarm aggregation method embodiments.

[0091] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described alarm aggregation method embodiments at runtime.

[0092] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0093] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described alarm aggregation method embodiments.

[0094] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described alarm aggregation method embodiments.

[0095] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] The above provides a detailed description of an alarm aggregation method, apparatus, electronic device, computer-readable storage medium, and computer program product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to help understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. An alarm aggregation method, characterized in that, include: Historical alarm data is aggregated and divided into at least one alarm cluster; wherein each alarm cluster contains historical behavior characteristics and historical behavior profiles; Upon acquiring new alarm data, extract the behavioral characteristics of the new alarm data and construct a behavioral profile; A similarity analysis is performed on the behavioral characteristics and behavioral profiles of the new alarm data, as well as the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, to determine the similarity score between the new alarm data and each alarm cluster. Based on the similarity score and the set alarm threshold, the target alarm cluster that matches the new alarm data is determined, and the new alarm data is aggregated into the target alarm cluster.

2. The alarm aggregation method according to claim 1, characterized in that, Historical alarm data is aggregated and divided into at least one alarm cluster, including: Extract the historical behavior features of each alarm data in the historical alarm data within the sliding time window; wherein, the historical behavior features include historical IP address, historical access direction, and historical data packet features; Attack methods are analyzed for active IP addresses in the historical behavior characteristics to construct historical behavior profiles; Based on the historical behavioral characteristics and historical behavioral profiles of each alarm data, at least one alarm cluster is constructed.

3. The alarm aggregation method according to claim 2, characterized in that, Based on the historical behavioral characteristics and profiles of each alarm data point, construct at least one alarm cluster, including: Compare the historical behavior characteristics of any two alarm data sets to determine the degree of matching of historical behavior characteristics between any two alarm data sets. Perform similarity analysis on the historical behavior profiles of any two alarm data sets to determine the similarity of the historical behavior profiles between any two alarm data sets. Based on the historical behavior feature matching degree and the historical behavior profile similarity, each alarm data is divided into at least one alarm cluster.

4. The alarm aggregation method according to claim 1, characterized in that, A similarity analysis is performed on the behavioral characteristics and behavioral profiles of the new alarm data, as well as the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, to determine the similarity score between the new alarm data and each of the alarm clusters, including: The IP address of the new alarm data is compared with the IP address of the target representative alarm to determine the IP address matching degree; wherein, the target representative alarm is the representative alarm of any alarm cluster in all alarm clusters; A consistency analysis is performed on the access direction of the new alarm data and the access direction of the target representative alarm to determine the degree of consistency of the access direction; A similarity analysis is performed between the data packet characteristics of the new alarm data and the data packet characteristics of the target representing the alarm to determine the feature similarity. A similarity analysis is performed between the behavioral profile of the new alarm data and the historical behavioral profile of the target representative alarm to determine the behavioral profile similarity. Based on the IP address matching degree, the access direction consistency degree, the feature similarity, and the behavior profile similarity, the similarity score between the new alarm data and the alarm cluster to which the target representative alarm belongs is determined.

5. The alarm aggregation method according to claim 4, characterized in that, Based on the IP address matching degree, the access direction consistency degree, the feature similarity, and the behavior profile similarity, the similarity score between the new alarm data and the alarm cluster to which the target representative alarm belongs is determined, including: Based on the weights matched in the current network environment, the IP address matching degree, the access direction consistency degree, the feature similarity, and the behavior profile similarity are weighted and summed to obtain a similarity score.

6. The alarm aggregation method according to claim 5, characterized in that, The method further includes setting weights that match the current network environment: If a scanning attack of a set scale is detected, the IP weight corresponding to the IP address will be increased. When detecting low-frequency attacks of unknown threat types, increase the feature weights corresponding to the packet characteristics.

7. The alarm aggregation method according to claim 1, characterized in that, Regarding the setting of the alarm threshold, the method further includes: When the system is in a Class I load state, reduce the alarm threshold; When the system is in the second type of load state, the alarm threshold is increased; wherein the system load in the first type of load state is greater than the system load in the second type of load state.

8. An alarm aggregation device, characterized in that, This includes partitioning units, construction units, allocation units, and aggregation units; The segmentation unit is used to aggregate historical alarm data and divide it into at least one alarm cluster; wherein each alarm cluster contains historical behavior features and historical behavior profiles; The construction unit is used to extract the behavioral features of the new alarm data and construct a behavioral profile when new alarm data is acquired. The allocation unit is used to perform similarity analysis on the behavioral characteristics and behavioral profiles of the new alarm data and the historical behavioral characteristics and historical behavioral profiles representing alarms in at least one alarm cluster, and to determine the similarity score between the new alarm data and each of the alarm clusters. The aggregation unit is used to determine the target alarm cluster that matches the new alarm data based on the similarity score and the set alarm threshold, and to aggregate the new alarm data into the target alarm cluster.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the alarm aggregation method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the alarm aggregation method as described in any one of claims 1 to 7.

Images