Method and device for judging network alarm event, storage medium and electronic equipment

Abstract

This disclosure relates to a method, apparatus, storage medium, and electronic device for identifying network alarm events, belonging to the field of network security technology. The method includes: acquiring network attack alarm logs generated by network security devices in a multi-source heterogeneous scenario during network security monitoring; extracting features from the network attack alarm logs to obtain alarm event features of network alarm events associated with the logs; performing aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence; the alarm event sequence includes contextual information of multiple network alarm events from different time periods and data sources; and, based on a preset event mining model, mining the inherent correlations between the network alarm events from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report. This disclosure improves the accuracy of the identification results.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and more specifically, to a method for identifying network alarm events, a device for identifying network alarm events, a computer-readable storage medium, and an electronic device. Background Technology

[0002] In existing methods for handling network alarm events, there are difficulties in coordination and information fragmentation among different types of security devices, which results in low accuracy of the alarm event judgment results.

[0003] It should be noted that the information in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] The purpose of this disclosure is to provide a method, apparatus, computer-readable storage medium, and electronic device for identifying network alarm events, thereby overcoming, to at least some extent, the problem of low accuracy in alarm event identification results caused by limitations and defects in related technologies.

[0005] According to one aspect of this disclosure, a method for identifying network alarm events is provided, comprising: acquiring network attack alarm logs generated by network security devices in a multi-source heterogeneous scenario during network security monitoring; extracting features from the network attack alarm logs to obtain alarm event features of network alarm events associated with the network attack alarm logs; performing aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence; the alarm event sequence includes contextual information of multiple network alarm events from different time periods and different data sources; and, based on a preset event mining model, mining the inherent correlation between the network alarm events from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report.

[0006] In one exemplary embodiment of this disclosure, feature extraction is performed on the network attack alarm log to obtain alarm event features of network alarm events associated with the network attack alarm log. This includes: standardizing the network attack alarm log based on a preset alarm data standardization model to obtain standardized alarm logs; determining multi-dimensional alarm features of network alarm events associated with the network attack alarm logs based on the standardized alarm logs; and transforming the multi-dimensional alarm features to obtain alarm event features.

[0007] In one exemplary embodiment of this disclosure, the alarm event sequence is obtained by performing aggregation and correlation analysis on the alarm event features, including: determining feature association keys based on user information and / or attack methods in the alarm event features, and establishing association relationships between the alarm event features based on the feature association keys to obtain feature association results; and sorting the alarm event features in the feature association results based on the timestamps in the alarm event features to obtain an alarm event sequence.

[0008] In one exemplary embodiment of this disclosure, based on a preset event mining model, the inherent correlation between the network alarm events is mined from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report. This includes: encoding the alarm event sequence from multiple different dimensions based on an encoder to obtain a context-aware vector associated with the network alarm event; and identifying and judging multi-stage attacks based on the context-aware vector from multiple different dimensions based on a decoder to obtain an interpretable attack path report associated with the network alarm event.

[0009] In one exemplary embodiment of this disclosure, encoding the alarm event sequence from multiple different dimensions based on an encoder to obtain a context-aware vector associated with the network alarm event includes: embedding the alarm event sequence based on a first embedding layer to obtain a first embedding vector, and encoding the alarm event sequence based on a first position encoding module to obtain a first position vector; superimposing the first embedding vector and the first position vector to obtain a first input vector, and encoding the first input vector from multiple different dimensions based on a first feature encoding module to obtain a context-aware vector associated with the network alarm event.

[0010] In one exemplary embodiment of this disclosure, the first input vector is encoded from multiple different dimensions based on a first feature encoding module to obtain a context-aware vector associated with the network alarm event. This includes: calculating a first attention mechanism of the first input vector in multiple different dimensions based on a first multi-head self-attention module, and performing residual connection and normalization processing on the first attention mechanism and the first input vector based on a first residual connection and normalization module to obtain a first normalization processing result; performing linearization processing on the first normalization processing result based on a first feedforward neural network to obtain a first linearization processing result, and performing residual connection and normalization processing on the first linearization processing result and the first normalization processing result based on a second residual connection and normalization module to obtain a context-aware vector associated with the network alarm event.

[0011] In one exemplary embodiment of this disclosure, the first multi-head self-attention module includes a plurality of first self-attention modules, the number of which is consistent with the number of dimensions, and each first self-attention module is used to determine a first attention mechanism in one dimension; wherein, calculating the first attention mechanism of the first input vector in multiple different dimensions based on the first multi-head self-attention module includes: calculating the first attention mechanism of the first input vector in a single dimension corresponding to the first self-attention module based on the first self-attention module, and obtaining the first attention mechanism of the first input vector in multiple different dimensions based on the first attention mechanism in the single dimension.

[0012] In one exemplary embodiment of this disclosure, calculating a first attention mechanism for a first input vector in a single dimension corresponding to the first self-attention module based on a first self-attention module includes: linearly fusing the first input vector to obtain a first query vector, a first key vector, and a first value vector; calculating a first outer product vector of the first query vector and the first key vector to obtain a first similarity between the first query vector and the first key vector; normalizing the first similarity to obtain a first weight matrix; and calculating a second outer product vector of the first weight matrix and the first value vector to obtain the first attention mechanism for the first input vector in a single dimension corresponding to the first self-attention module.

[0013] In one exemplary embodiment of this disclosure, a multi-stage attack identification and determination is performed on the context-aware vector from multiple different dimensions based on a decoder to obtain an interpretable attack path report associated with the network alarm event. This includes: identifying multi-stage attacks on the context-aware vector from multiple different dimensions based on a first feature decoding module to obtain a multi-stage attack identification result; and determining the attack category based on the multi-stage attack identification result using a first classification layer to obtain an interpretable attack path report associated with the network alarm event.

[0014] In one exemplary embodiment of this disclosure, the multiple different dimensions include a variety of dimensions such as physical device space dimension, time pattern dimension, attack feature dimension, alarm type dimension, severity dimension, and threat level evolution dimension.

[0015] In one exemplary embodiment of this disclosure, the method further includes: determining an attack category based on the interpretable attack path report, determining a security defense strategy based on the attack category, and / or generating interpretable attack warning information.

[0016] In one exemplary embodiment of this disclosure, the network security devices in the multi-source heterogeneous scenario include multiple devices such as Web application firewall devices, full-traffic threat detection devices, endpoint detection and response devices, database auditing devices, and data leakage prevention devices; the network attack alarm logs include multiple devices such as a first network attack alarm log associated with the Web application firewall device, a second network attack alarm log associated with the full-traffic threat detection device, a third network attack alarm log associated with the endpoint detection and response device, a fourth network attack alarm log associated with the database auditing device, and a fifth network attack alarm log associated with the data leakage prevention device.

[0017] According to one aspect of this disclosure, a network alarm event discrimination device is provided, comprising: a network attack alarm log acquisition module, used to acquire network attack alarm logs generated by network security devices in a multi-source heterogeneous scenario during network security monitoring; an alarm event feature extraction module, used to extract features from the network attack alarm logs to obtain alarm event features of network alarm events associated with the network attack alarm logs; an alarm event sequence determination module, used to perform aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence; the alarm event sequence includes context information of multiple network alarm events from different time periods and different data sources; and an attack path report generation module, used to mine the inherent correlation between the network alarm events from multiple different dimensions based on a preset event mining model and the alarm event sequence to obtain an interpretable attack path report.

[0018] According to one aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method for determining network alarm events as described in any of the preceding claims.

[0019] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the network alarm event discrimination method described in any one of the preceding claims by executing the executable instructions.

[0020] This disclosure provides a method for identifying network alarm events. Firstly, it acquires network attack alarm logs generated by network security devices in a multi-source heterogeneous scenario during network security monitoring. Then, it extracts features from the network attack alarm logs to obtain alarm event features associated with them. Next, it performs aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence. Finally, based on a preset event mining model, it mines the inherent relationships between network alarm events from multiple dimensions according to the alarm event sequence, obtaining an interpretable attack path report. This interpretable attack path report is then used to identify network alarm events, thereby improving the accuracy of the identified network alarm events. Secondly, because the alarm event features can be aggregated and correlated to obtain an alarm event sequence, and the inherent relationships between network alarm events can be mined from multiple dimensions based on the alarm event sequence, the problems of coordination difficulties and information fragmentation between various network security devices can be avoided. Thirdly, because the obtained result is an interpretable attack path report, the interpretability of the identification result is achieved.

[0021] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0023] Figure 1 The flowchart illustrates an example of a method for determining network alarm events according to an exemplary embodiment of the present disclosure.

[0024] Figure 2 The diagram schematically illustrates a structural example of an event mining model according to an exemplary embodiment of the present disclosure.

[0025] Figure 3 The diagram schematically illustrates an example structure of an encoder in an event mining model according to an exemplary embodiment of the present disclosure.

[0026] Figure 4 The diagram schematically illustrates an example structure of a first feature encoding module in an encoder according to an exemplary embodiment of the present disclosure.

[0027] Figure 5The illustration shows a scenario example diagram of a first multi-head self-attention module in a first feature encoding module according to an example embodiment of the present disclosure.

[0028] Figure 6 The diagram schematically illustrates an example structure of a decoder in an event mining model according to an exemplary embodiment of the present disclosure.

[0029] Figure 7 This diagram schematically illustrates an example of a first network attack alert log corresponding to a web application firewall device according to an example embodiment of the present disclosure.

[0030] Figure 8 This illustration shows an example diagram of a second network attack alert log corresponding to a full-traffic threat detection device according to an example embodiment of this disclosure.

[0031] Figure 9 This illustration shows an example diagram of a third network attack alarm log corresponding to a terminal detection and response device according to an example embodiment of the present disclosure.

[0032] Figure 10 This illustration shows an example diagram of a fourth network attack alarm log corresponding to a database auditing device according to an example embodiment of this disclosure.

[0033] Figure 11 This diagram schematically illustrates an example of a fifth network attack alert log corresponding to a data loss prevention device according to an example embodiment of this disclosure.

[0034] Figure 12 This diagram schematically illustrates a structural example of a network alarm event discrimination device according to an exemplary embodiment of the present disclosure.

[0035] Figure 13 The diagram illustrates an example of an electronic device for implementing a method for determining network alarm events according to an example embodiment of the present disclosure. Detailed Implementation

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0037] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0038] As digital transformation deepens, the network structures of large enterprises are becoming increasingly complex, and the value of their core business data and digital assets is constantly rising. In practical applications, to address this trend, the current mainstream security practice is to deploy a wide variety of network security devices (such as firewalls, intrusion detection systems, and advanced threat detection devices) to build a deep defense system in a vertical dimension, thereby protecting enterprise networks and critical assets from a constant stream of cyber threats. However, this stacked deployment strategy has the following problems: difficulties in coordination and information silos exist between different types of security devices, easily forming defense silos. This approach not only reduces overall security operation efficiency but may also miss advanced persistent threats due to alert storms and a lack of correlation analysis, making it difficult to translate security investments into effective security capabilities.

[0039] Therefore, in order to address the challenges caused by the diversification of equipment and the fragmentation of information, there is an urgent need for a new solution that can overcome the limitations of existing detection technologies, integrate heterogeneous security data, and achieve correlation analysis and intelligent in-depth mining of potential threat events across devices and multiple stages.

[0040] Based on this, this exemplary embodiment first provides a method for identifying network alarm events. This method can run on servers, server clusters, or cloud servers, etc. Of course, those skilled in the art can also run the method disclosed herein on other platforms as needed, and this exemplary embodiment does not impose any special limitations on this. Specifically, refer to... Figure 1 As shown, the method for identifying this network alarm event may include the following steps:

[0041] Step S110. Obtain network attack alarm logs generated by network security devices in multi-source heterogeneous scenarios during network security monitoring;

[0042] Step S120. Extract features from the network attack alarm log to obtain alarm event features of the network alarm events associated with the network attack alarm log;

[0043] Step S130. Perform aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence; the alarm event sequence includes context information of multiple network alarm events from different time periods and different data sources;

[0044] Step S140. Based on a preset event mining model, the inherent correlation between the network alarm events is mined from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report.

[0045] In the aforementioned method for identifying network alarm events, on the one hand, network attack alarm logs generated by network security devices in multi-source heterogeneous scenarios during network security monitoring are acquired; then, feature extraction is performed on the network attack alarm logs to obtain alarm event features associated with the network attack alarm logs; furthermore, the alarm event features are aggregated and correlated to obtain alarm event sequences; finally, based on a preset event mining model, the inherent correlation between network alarm events is mined from multiple different dimensions according to the alarm event sequences to obtain interpretable attack path reports, thereby improving the accuracy of the obtained network alarm event identification results. On the other hand, since alarm event sequences can be obtained by aggregating and correlated with alarm event features and the inherent correlation between network alarm events can be mined from multiple different dimensions according to the alarm event sequences, the problems of coordination difficulties and information fragmentation between various network security devices can be avoided. Furthermore, since the obtained result is an interpretable attack path report, the interpretability of the identification results is achieved.

[0046] The following will provide a detailed explanation and description of the method for determining network alarm events as described in the exemplary embodiments of this disclosure, in conjunction with the accompanying drawings.

[0047] First, the terms used in the exemplary embodiments of this disclosure will be explained and described.

[0048] The Transformer model is the core architecture of a deep learning model that uses a self-attention mechanism to achieve parallel processing of global information of the input sequence, effectively capturing long-range dependencies between sequence elements. This architecture typically consists of an encoder and a decoder, both of which can contain multi-layer structures, with each layer's core being a self-attention mechanism and a feedforward neural network.

[0049] Self-attention mechanism: This is the core computational unit of the Transformer architecture model. It dynamically generates a context-dependent representation for each element by calculating the correlation (attention weight) between any two elements in the sequence. Specifically, it maps each element of the input sequence to a query vector Q, a key vector K, and a value vector V. It calculates weights based on the similarity between the query vector and all key vectors and performs a weighted summation of all value vectors, thereby generating a new contextual representation for each element. This representation incorporates information from all other elements related to that element.

[0050] Multi-head attention mechanism: This is an extension and enhancement of the self-attention mechanism. It divides the model into multiple independent subspaces, enabling the model to learn information in parallel across different representation subspaces (such as semantics, syntax, and referential relations). Each head independently performs self-attention computation, and the outputs of each subspace are concatenated and linearly transformed to form the final output representation. This design allows the model to simultaneously focus on diverse information from different locations and with different emphases, thus significantly improving the model's representational power and generalization performance.

[0051] Multi-stage threat incidents refer to a series of attack actions involving at least two distinct stages undertaken by cyber attackers to achieve their ultimate goals (such as data theft and / or system damage). These actions penetrate networks and systems to achieve the objectives of data theft and / or system damage.

[0052] Secondly, the technical implementation principles of the exemplary embodiments of this disclosure are explained and described. Specifically, in practical applications, traditional Security Operations Centers (SOCs) face alarms from massive amounts of data generated by enterprises; at the same time, because the massive amounts of data generated by enterprises contain a large amount of invalid, redundant, and false alarm information, it is impossible to directly detect related attack behaviors, thus increasing the difficulty for operations analysts to fully understand multi-stage attacks. To overcome these limitations, the exemplary embodiments of this disclosure, based on alarm results from multi-source heterogeneous network security devices, automatically weight, aggregate, and filter alarms from different security devices such as firewalls, IDS (Intrusion Detection System) / IPS (Intrusion Prevention System), EDR (Endpoint Detection and Response), database auditing tools, and cloud security platforms through the proposed attack-oriented multi-head attention mechanism, thereby promoting the interpretation of multi-stage attack behaviors and providing a reference for response strategies.

[0053] In practical applications, threat intelligence event mining models can learn and highlight key and high-value alerts related to potential attack chains, while suppressing or removing irrelevant and repetitive interference information. This significantly reduces alert fatigue and provides high-quality data input for subsequent analysis. Furthermore, threat intelligence event mining models can simulate the analytical thinking of security experts through their attention mechanisms, automatically identifying each stage of an attack (such as initial intrusion, persistence, lateral movement, and data leakage), and clearly demonstrating the causal and logical relationships between network alert events at each stage. This achieves a transformation from alerts to events and then to attack chains.

[0054] Furthermore, the network alarm event discrimination method described in the exemplary embodiments of this disclosure creatively proposes an attack serialization representation method based on the user dimension to address the problem of insufficient detection capabilities of existing technologies for cross-device, multi-stage persistent attacks. It employs a Transformer architecture model with a multi-head attention mechanism for multi-dimensional threat feature analysis. In practical applications, firstly, isolated alarms scattered across various security devices such as WAF, full-traffic threat detection, EDR, database auditing, and data leakage prevention need to be correlated and aggregated according to the user dimension to construct a unified attack sequence (i.e., alarm event sequence) ordered by time. Secondly, a Transformer-based event mining model is used to model the alarm event sequence. The key improvement lies in designing multiple functionally specialized attention heads, each focusing on different feature subspaces such as attack feature dimension, time pattern dimension, alarm type dimension, severity dimension, threat level evolution dimension, and physical device space dimension, independently calculating their internal high-order correlations. Ultimately, by fusing the correlation calculation results of these subspaces, the model can construct an extremely rich contextual representation, thereby accurately reconstructing the complete attack chain from the initial intrusion to the achievement of the target, enabling in-depth mining and early warning of hidden multi-stage threats.

[0055] In one example embodiment, during the generation of alarm event sequences, isolated attack alarm logs generated by network security devices from multi-source heterogeneous scenarios during network security monitoring can be cleaned, correlated, and serialized according to the user dimension. This provides standardized, context-rich temporal attack sequences for subsequent model processing. Simultaneously, during the correlation mining process of the event mining model based on a multi-head attention mechanism, multiple parallel attention heads can focus on different dimensional features in the attack sequence (such as attack feature dimension, time pattern dimension, alarm type dimension, severity dimension, threat level evolution dimension, and physical device space dimension), thereby independently mining deep correlations between events in different feature subspaces. The model ultimately integrates the analysis results of all attention heads to achieve a global understanding of the attack context, accurately reconstructing the complete attack chain from initial intrusion to lateral movement, and outputting detection conclusions and key evidence chains for multi-stage threats, effectively improving the ability to discover and analyze complex threats. Based on this, it can solve the technical problem that existing technologies struggle to effectively correlate and analyze isolated security alarms across platforms and time periods, thus failing to accurately identify complex multi-stage network attacks. Furthermore, by performing attacker-centric serialization aggregation on scattered security alert logs, the original multi-source, heterogeneous log sequences with spatiotemporal attributes can be deeply mined using a spatiotemporal fusion multi-head attention mechanism to uncover hidden tactical and temporal correlations between events. This ultimately enables the automatic and accurate reconstruction of complete attack chains from massive amounts of noisy data, achieving early detection, accurate assessment, and interpretable warnings for advanced threats such as Advanced Persistent Threats (APTs). Moreover, the method described in the example embodiments of this disclosure reduces the heavy reliance on manually written rules by security experts and prior knowledge. Through an end-to-end threat intelligence event mining model, the system can adaptively learn new and complex attack patterns. Furthermore, the multi-head attention mechanism design in the model structure captures the semantic correlations of log sequences in both time and space, achieving automated mining and warning of unknown threats and multi-stage persistent threats, greatly improving the efficiency and response speed of security operations.

[0056] The event mining model involved in the exemplary embodiments of this disclosure will be explained and described below. Specifically, the event mining model described herein may be a multi-head self-attention model based on Transformer; see reference... Figure 2 As shown, the event mining model may include an encoder 210 and a decoder 220; wherein, the encoder is used to encode the alarm event sequence to obtain a context-aware vector, and the decoder is used to decode the context-aware vector to obtain an interpretable attack path report.

[0057] In one example embodiment, reference is made to... Figure 3 As shown, the encoder described herein may include a first embedding layer, a first position encoding module, and a first feature encoding module; further, refer to Figure 4 As shown, the first feature encoding module may include a first multi-head self-attention module, a first residual connection and normalization module, a first feedforward neural network, and a second residual connection and normalization module; meanwhile, the first multi-head self-attention module described herein can be referenced from... Figure 5 As shown. Furthermore, the roles of each module in the encoder in the context-aware vector generation process will be detailed later, and will not be elaborated further here.

[0058] In one example embodiment, reference is made to... Figure 6 As shown, the decoder described here may include a first feature decoding module and a first classification layer; at the same time, the specific structure of the first feature decoding module is similar to that of the first feature encoding module, and will not be described in detail here.

[0059] The following will combine Figures 2-6 right Figure 1 The method for identifying network alarm events shown will be further explained and illustrated. Specifically:

[0060] In step S110, network attack alarm logs generated by network security devices in multi-source heterogeneous scenarios during network security monitoring are obtained.

[0061] In this embodiment of the disclosure, the network security devices in a multi-source heterogeneous scenario may include, but are not limited to, web application firewall devices, full-traffic threat detection devices, endpoint detection and response devices, database auditing devices, and data leakage prevention devices, etc.; the corresponding network attack alarm logs may include, but are not limited to, a first network attack alarm log associated with the web application firewall device, a second network attack alarm log associated with the full-traffic threat detection device, a third network attack alarm log associated with the endpoint detection and response device, a fourth network attack alarm log associated with the database auditing device, and a fifth network attack alarm log associated with the data leakage prevention device, etc.; at the same time, the specific collection process can be directly obtained from the corresponding network security devices.

[0062] In one example embodiment, reference is made to... Figure 7As shown, the fields included in the first network attack alarm log may include, but are not limited to: timestamp, data source device type, data source device address, event type, severity, security policy rule identifier (policy_id, which can be used to locate which policy in the WAF device executed the allow, block, or alarm action), rule identifier, rule name, source address, source port, destination address, destination port, protocol method, path, user agent information, user name, action, session identifier, risk level, and alarm description, etc.

[0063] In one example embodiment, reference is made to... Figure 8 As shown, the fields included in the second network attack alert log may include, but are not limited to: timestamp, data source device type, sensor address, event type, severity, threat address, threat name, source address, source media access control address, destination address, destination port, protocol, DNS query, connection status, duration, traffic size, threat type, threat address, confidence, action, and alert description, etc.

[0064] In one example embodiment, reference is made to... Figure 9As shown, the fields included in the third network attack alert log recorded above may include, but are not limited to: timestamp, data source device type, agent ID, hostname, operating system (OS), user, event type, severity, alert name, process name, process path, process MD5 checksum, process hash sha256, action token, file operations, registry key modified, network connections, and alert description, etc.

[0065] In one example embodiment, reference is made to... Figure 10 As shown, the fields included in the fourth network attack alert log may include, but are not limited to: timestamp, data source device type, database service, database type, database name, database user, client address, client port, operating system user, event type, severity, command to be executed, result of the command, number of rows returned, execution time, policy violation, sensitive table, sensitive column, risk score, action, and alert description, etc.

[0066] In one example embodiment, reference is made to... Figure 11As shown, the fields included in the fifth network attack alarm log may include, but are not limited to: timestamp, data source device type, data source device address, event type, severity, security policy rule ID (which can be used to locate which policy in the WAF device executed the allow, block, or alarm action), rule ID, rule name, user name, source host, source address, application name, channel, action token, file name, file type, file size, detection method, matched keywords, data profile, recipient, and alarm description, etc.

[0067] In step S120, feature extraction is performed on the network attack alarm log to obtain alarm event features of the network alarm events associated with the network attack alarm log.

[0068] Specifically, the extraction process of alarm event features can be implemented as follows: the network attack alarm log is standardized based on a preset alarm data standardization model to obtain standardized alarm logs; based on the standardized alarm logs, multi-dimensional alarm features of network alarm events associated with the network attack alarm logs are determined, and the multi-dimensional alarm features are transformed to obtain alarm event features.

[0069] In one example embodiment, to address the issue of data heterogeneity in practical applications, it is necessary to unify network attack alert logs from different sources into a standardized intermediate representation. Based on this, a general and scalable alert data standardization model can be designed. Then, based on this model, all original logs (i.e., network attack alert logs) are converted into standardized alert logs with a target format. The standardized alert logs may include, but are not limited to, the following core fields: basic information (including but not limited to timestamp, logID, data source device, etc.), subject information (including but not limited to source IP, source port number, target IP, target port number, hostname, process name, etc.), context information (including but not limited to protocol, path, SQL injection, lateral movement, etc.), alert information (standardized severity levels: low, medium, high, urgent), confidence level, and action (observation, blocking, alert).

[0070] In one example embodiment, the correlation between network alert events is crucial in multi-step (or multi-stage) attack event detection. Therefore, it is necessary to extract multi-dimensional features from standardized alert logs for correlation analysis, facilitating the transformation of single-point alerts into feature vectors rich in contextual information. These features represent information about the participants in the alert. The multi-dimensional features described herein may include, but are not limited to, attack characteristic dimensions, time pattern dimensions, alert type dimensions, severity dimensions, threat level evolution dimensions, and physical device spatial dimensions.

[0071] In one example embodiment, the process of determining multi-dimensional alarm features of network alarm events associated with the network attack alarm logs based on standardized alarm logs, and transforming these multi-dimensional alarm features into alarm event features, can be implemented based on a corresponding large language model. For example, the corresponding model prompt information and the standardized alarm logs can be input into the large language model to remind it to extract corresponding features from multiple different dimensions such as attack feature dimension, time pattern dimension, alarm type dimension, severity dimension, and threat level evolution dimension, and then integrate them into alarm event features. The network alarm events described here can include a first network alarm event corresponding to a first network attack alarm log, a first network alarm event corresponding to a second network attack alarm log, a third network alarm event corresponding to a third network attack alarm log, a fourth network alarm event corresponding to a fourth network attack alarm log, and a fifth network alarm event corresponding to a fifth network attack alarm log; each corresponding network alarm event has alarm event features in multiple different dimensions.

[0072] In step S130, the alarm event features are aggregated and correlated to obtain an alarm event sequence; the alarm event sequence includes context information of multiple network alarm events from different time periods and different data sources.

[0073] Specifically, the specific implementation process of correlation analysis can be achieved as follows: Determine feature association keys based on user information and / or attack methods in the alarm event features, and establish association relationships between the alarm event features based on the feature association keys to obtain feature association results; sort the alarm event features in the feature association results based on the timestamps in the alarm event features to obtain an alarm event sequence. Specifically, the purpose of aggregation correlation analysis is to transform raw alarm logs from network security devices in multi-source heterogeneous scenarios into high-quality, structured event sequences (i.e., alarm event sequences) that can be processed by subsequent multi-head attention models through correlation analysis. Furthermore, in determining the alarm event sequence, it is first necessary to determine the feature association keys; where the feature association keys described here may include, but are not limited to, source IP addresses, target IP addresses, and attack methods, etc.

[0074] For example, all alarm event features within a certain time window (such as 30 minutes) can be associated based on feature association keys to form an alarm event sequence, so as to reconstruct the full picture of a single attack based on the alarm event sequence. Furthermore, in practical applications, alerts can be dynamically grouped into meaningful sequences based on the analysis target by selecting association keys. These alert event sequences can include attack chain session sequences, victim session sequences, and activity group session sequences, etc. Specifically, for attack chain session sequences, the source IP address can be used as the primary feature association key, and all alerts within a certain time window (e.g., 30 minutes) based on the source IP address can form an alert event sequence to reconstruct the full picture of a single attack. For victim session sequences, the target IP address can be used as the primary feature association key, and all alerts within a certain time window (e.g., 30 minutes) based on the target IP address can form an alert event sequence to analyze all attacks suffered by a specific asset. For activity group session sequences, the attack method (e.g., CVE ID, malware family) can be used as the primary feature association key, and all alerts within a certain time window (e.g., 30 minutes) based on the attack method can form an alert event sequence to discover widespread attack activities.

[0075] It should also be noted that by performing preprocessing procedures, including feature extraction and aggregation correlation analysis, on the obtained network attack alert logs, the complexity of directly applying deep learning models to the raw logs (i.e., network attack alert logs) can be greatly reduced. This allows the subsequent "multi-stage threat event mining model based on multi-head attention" to focus more on learning high-level attack pattern abstractions and complex dependencies, thereby more accurately and intelligently mining real and complete threat events.

[0076] In step S140, based on a preset event mining model, the inherent correlation between the network alarm events is mined from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report.

[0077] In this embodiment of the disclosure, the specific generation process of the interpretable attack path report can be implemented as follows: based on the encoder, the alarm event sequence is encoded from multiple different dimensions to obtain a context-aware vector associated with the network alarm event; based on the decoder, the context-aware vector is used to identify and determine multi-stage attacks from multiple different dimensions to obtain an interpretable attack path report associated with the network alarm event.

[0078] In one example embodiment, the context-aware vector associated with the network alarm event is obtained by encoding the alarm event sequence from multiple different dimensions based on an encoder. This can be achieved as follows: the alarm event sequence is embedded based on a first embedding layer to obtain a first embedding vector, and the alarm event sequence is encoded based on a first position encoding module to obtain a first position vector; the first embedding vector and the first position vector are superimposed to obtain a first input vector, and the first input vector is encoded from multiple different dimensions based on a first feature encoding module to obtain the context-aware vector associated with the network alarm event.

[0079] In one example embodiment, encoding a first input vector from multiple different dimensions based on a first feature encoding module to obtain a context-aware vector associated with the network alarm event can be achieved as follows: A first attention mechanism is calculated on the first input vector in multiple different dimensions based on a first multi-head self-attention module; the first attention mechanism and the first input vector are then subjected to residual connection and normalization processing based on a first residual connection and normalization module to obtain a first normalization result; the first normalization result is then linearized based on a first feedforward neural network to obtain a first linearization result; and the first linearization result and the first normalization result are then subjected to residual connection and normalization processing based on a second residual connection and normalization module to obtain a context-aware vector associated with the network alarm event.

[0080] In one exemplary embodiment, the first multi-head self-attention module includes a plurality of first self-attention modules, the number of which is consistent with the number of dimensions, and each first self-attention module is used to determine a first attention mechanism in one dimension; wherein, the calculation of the first attention mechanism of the first input vector in multiple different dimensions based on the first multi-head self-attention module can be implemented as follows: the first attention mechanism of the first input vector in a single dimension corresponding to the first self-attention module is calculated based on the first self-attention module, and the first attention mechanism of the first input vector in multiple different dimensions is obtained based on the first attention mechanism in the single dimension.

[0081] In an exemplary embodiment, the first attention mechanism for calculating the first input vector in a single dimension corresponding to the first self-attention module based on the first self-attention module can be implemented as follows: linearly fuse the first input vector to obtain a first query vector, a first key vector, and a first value vector; calculate the first outer product vector of the first query vector and the first key vector to obtain a first similarity between the first query vector and the first key vector; normalize the first similarity to obtain a first weight matrix; and calculate the second outer product vector of the first weight matrix and the first value vector to obtain the first attention mechanism for the first input vector in a single dimension corresponding to the first self-attention module.

[0082] In one exemplary embodiment, the various dimensions described above may include, but are not limited to, physical device space dimension, time pattern dimension, attack characteristic dimension, alarm type dimension, severity dimension, and threat level evolution dimension, etc.

[0083] The following section will further explain and illustrate the specific process of determining the context-aware vector. Specifically, in practical applications, after standardizing and correlating network attack alert logs, to achieve in-depth mining of advanced threats, the core detection technology of this solution can employ a multi-head attention mechanism event mining model. Through its powerful self-learning and contextual reasoning capabilities, it can autonomously discover complex threat patterns from massive logs that are difficult for the human brain to intuitively summarize. It is particularly adept at discerning multi-stage collaborative attacks that are highly dispersed in time and covertly jump in space, achieving a leap from "passive defense" to "active intelligent hunting," and ultimately completing end-to-end intelligent identification of multi-stage attack events.

[0084] Furthermore, the multi-head attention mechanism allows event mining models to simultaneously focus on different features of alarm information (i.e., alarm event sequences); based on this, various techniques can be employed. The embedding (i.e., the first input vector described above) obtained from a log sequence of associated events (i.e., an alarm event sequence) is represented by the following: It is the length of the first input vector. This is the embedding dimension of the first input vector. Furthermore, the event mining model consists of a multi-head attention mechanism, where each attention head can use three dimensions... Trainable matrices , as well as ( The linear projection matrix of (i.e., the number of heads) is calculated to obtain... Three different representations: , , ; where is the first query vector, is the first key vector, and is the first value vector; then, the local computation result of each head (i.e., the first attention mechanism in a single dimension) can be expressed as shown in the following formula (1):

[0085] ; Formula (1)

[0086] Building on this, the next step is to concatenate each head together and combine it with another trainable matrix. Multiply, The matrix linearly transforms the matrix of 8 heads of a simple link into an embedding matrix; the specific calculation process can be shown in the following formula (2):

[0087] ;

[0088] in, For the first attention mechanism on the first input vector across multiple different dimensions, this part can be used as... Furthermore, in order to obtain the final embedding, standardization and a fully connected layer (i.e., the first residual connection and normalization module LN) and a feedforward neural network (FNN) are used in collaboration. Finally, the first linearization processing result and the first normalization processing result are subjected to residual connection and normalization processing based on the second residual connection and normalization module to obtain the context-aware vector associated with the network alarm event. The specific calculation process can be shown in the following formulas (3) and (4).

[0089] ; Formula (3)

[0090] ; Formula (4)

[0091] in, This is the result of the first normalization process; This is the result of the first linearization process; It is the final embedding (i.e., the context-aware vector) of the multi-head attention layer, which can be used as... .

[0092] In one exemplary embodiment, the process of identifying and determining multi-stage attacks on the context-aware vector from multiple different dimensions based on a decoder to obtain an interpretable attack path report associated with the network alarm event includes: identifying multi-stage attacks on the context-aware vector from multiple different dimensions based on a first feature decoding module to obtain a multi-stage attack identification result; and determining the attack category based on the multi-stage attack identification result using a first classification layer to obtain an interpretable attack path report associated with the network alarm event.

[0093] In one example embodiment, the multi-stage attack identification result is obtained by identifying the context-aware vector from multiple different dimensions based on the first feature decoding module. This can be achieved as follows: The second attention mechanism of the context-aware vector in multiple different dimensions is calculated based on the second multi-head self-attention module, and the second attention mechanism and the context-aware vector are subjected to residual connection and normalization processing based on the third residual connection and normalization module to obtain a second normalization result; the second normalization result is linearized based on the second feedforward neural network to obtain a second linearization result; and the second linearization result and the second normalization result are subjected to residual connection and normalization processing based on the fourth residual connection and normalization module to obtain the multi-stage attack identification result.

[0094] In one exemplary embodiment, the second multi-head self-attention module includes a plurality of second self-attention modules, the number of which is consistent with the number of dimensions. Each second self-attention module is used to determine a second attention mechanism in one dimension. The calculation of the second attention mechanism of the context-aware vector in multiple different dimensions based on the second multi-head self-attention module can be achieved as follows: the second attention mechanism of the context-aware vector in a single dimension corresponding to the second self-attention module is calculated based on the second self-attention module, and the second attention mechanism of the context-aware vector in multiple different dimensions is obtained based on the second attention mechanism in the single dimension.

[0095] In one exemplary embodiment, the second attention mechanism for calculating the context-aware vector on a single dimension corresponding to the second self-attention module based on the second self-attention module can be implemented as follows: linearly fuse the context-aware vector to obtain a second query vector, a second key vector, and a second value vector; calculate the third outer product vector of the second query vector and the second key vector to obtain a second similarity between the second query vector and the second key vector; normalize the second similarity to obtain a second weight matrix; and calculate the fourth outer product vector of the second weight matrix and the second value vector to obtain the second attention mechanism for the context-aware vector on a single dimension corresponding to the second self-attention module.

[0096] It should be noted that the specific calculation process of the first decoding module in determining the multi-stage attack identification result based on the context-aware vector is similar to that of the first encoding module in determining the context-aware vector based on the first input vector. Therefore, it will not be elaborated further here.

[0097] It should be further explained here that, during the training of the event mining model, historical security event sequence data samples labeled with threat event tags can be used for training, and the context-aware vector output by the encoder can be used for the final multi-stage threat event detection and classification.

[0098] Finally, after obtaining an interpretable attack path report, the method may further include: determining the attack category based on the interpretable attack path report, determining a security defense strategy based on the attack category, and / or generating interpretable attack warning information. That is, security defense strategies or interpretable attack warning information can be generated based on the attack categories included in the interpretable attack path report, thereby achieving early detection, accurate assessment, and interpretable warnings of advanced persistent threats (APTs), ultimately improving the security of enterprise network systems.

[0099] Thus, the network alarm event discrimination method described in the exemplary embodiments of this disclosure has been fully implemented. Based on the foregoing description, it can be understood that the method described in the exemplary embodiments of this disclosure addresses the difficulty of existing security detection methods in capturing complex cross-device attack chains when processing multi-device logs, and the problem that traditional transformer models only focus on single features of the sequence and cannot comprehensively understand the log sequence of attack events. It constructs a spatiotemporal fusion multi-head attention mechanism module, which not only establishes dependencies in temporal relationships, but more importantly, performs parallel correlation calculations across multiple feature subspaces. Simultaneously, this method leverages the inherent advantages of event mining models in long sequence modeling, and through the spatiotemporal-feature dual fusion mechanism, it captures richer meanings of sequence relationships through multi-head splitting, overcoming the bottlenecks faced in network security scenarios such as weak feature correlation and early signal obliteration. Ultimately, it achieves early warning, accurate detection, and panoramic source tracing for complex cross-device, multi-stage network attacks.

[0100] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the apparatus embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0101] This disclosure also provides an example embodiment of a device for identifying network alarm events. Specifically, refer to... Figure 12 As shown, the network alarm event discrimination device may include, but is not limited to, a network attack alarm log collection module 1210, an alarm event feature extraction module 1220, an alarm event sequence determination module 1230, and an attack path report generation module 1240.

[0102] The network attack alarm log collection module is used to acquire network attack alarm logs generated by network security devices in multi-source heterogeneous scenarios during network security monitoring; the alarm event feature extraction module is used to extract features from the network attack alarm logs to obtain alarm event features of network alarm events associated with the network attack alarm logs; the alarm event sequence determination module is used to perform aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence; the alarm event sequence includes contextual information of network alarm events from multiple different time periods and different data sources; the attack path report generation module is used to mine the inherent correlation between the network alarm events from multiple different dimensions based on a preset event mining model and the alarm event sequence to obtain an interpretable attack path report.

[0103] In one exemplary embodiment of this disclosure, feature extraction is performed on the network attack alarm log to obtain alarm event features of network alarm events associated with the network attack alarm log. This includes: standardizing the network attack alarm log based on a preset alarm data standardization model to obtain standardized alarm logs; determining multi-dimensional alarm features of network alarm events associated with the network attack alarm logs based on the standardized alarm logs; and transforming the multi-dimensional alarm features to obtain alarm event features.

[0104] In one exemplary embodiment of this disclosure, the alarm event sequence is obtained by performing aggregation and correlation analysis on the alarm event features, including: determining feature association keys based on user information and / or attack methods in the alarm event features, and establishing association relationships between the alarm event features based on the feature association keys to obtain feature association results; and sorting the alarm event features in the feature association results based on the timestamps in the alarm event features to obtain an alarm event sequence.

[0105] In one exemplary embodiment of this disclosure, based on a preset event mining model, the inherent correlation between the network alarm events is mined from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report. This includes: encoding the alarm event sequence from multiple different dimensions based on an encoder to obtain a context-aware vector associated with the network alarm event; and identifying and judging multi-stage attacks based on the context-aware vector from multiple different dimensions based on a decoder to obtain an interpretable attack path report associated with the network alarm event.

[0106] In one exemplary embodiment of this disclosure, encoding the alarm event sequence from multiple different dimensions based on an encoder to obtain a context-aware vector associated with the network alarm event includes: embedding the alarm event sequence based on a first embedding layer to obtain a first embedding vector, and encoding the alarm event sequence based on a first position encoding module to obtain a first position vector; superimposing the first embedding vector and the first position vector to obtain a first input vector, and encoding the first input vector from multiple different dimensions based on a first feature encoding module to obtain a context-aware vector associated with the network alarm event.

[0107] In one exemplary embodiment of this disclosure, the first input vector is encoded from multiple different dimensions based on a first feature encoding module to obtain a context-aware vector associated with the network alarm event. This includes: calculating a first attention mechanism of the first input vector in multiple different dimensions based on a first multi-head self-attention module, and performing residual connection and normalization processing on the first attention mechanism and the first input vector based on a first residual connection and normalization module to obtain a first normalization processing result; performing linearization processing on the first normalization processing result based on a first feedforward neural network to obtain a first linearization processing result, and performing residual connection and normalization processing on the first linearization processing result and the first normalization processing result based on a second residual connection and normalization module to obtain a context-aware vector associated with the network alarm event.

[0108] In one exemplary embodiment of this disclosure, the first multi-head self-attention module includes a plurality of first self-attention modules, the number of which is consistent with the number of dimensions, and each first self-attention module is used to determine a first attention mechanism in one dimension; wherein, calculating the first attention mechanism of the first input vector in multiple different dimensions based on the first multi-head self-attention module includes: calculating the first attention mechanism of the first input vector in a single dimension corresponding to the first self-attention module based on the first self-attention module, and obtaining the first attention mechanism of the first input vector in multiple different dimensions based on the first attention mechanism in the single dimension.

[0109] In one exemplary embodiment of this disclosure, calculating a first attention mechanism for a first input vector in a single dimension corresponding to the first self-attention module based on a first self-attention module includes: linearly fusing the first input vector to obtain a first query vector, a first key vector, and a first value vector; calculating a first outer product vector of the first query vector and the first key vector to obtain a first similarity between the first query vector and the first key vector; normalizing the first similarity to obtain a first weight matrix; and calculating a second outer product vector of the first weight matrix and the first value vector to obtain the first attention mechanism for the first input vector in a single dimension corresponding to the first self-attention module.

[0110] In one exemplary embodiment of this disclosure, a multi-stage attack identification and determination is performed on the context-aware vector from multiple different dimensions based on a decoder to obtain an interpretable attack path report associated with the network alarm event. This includes: identifying multi-stage attacks on the context-aware vector from multiple different dimensions based on a first feature decoding module to obtain a multi-stage attack identification result; and determining the attack category based on the multi-stage attack identification result using a first classification layer to obtain an interpretable attack path report associated with the network alarm event.

[0111] In one exemplary embodiment of this disclosure, the multiple different dimensions include a variety of dimensions such as physical device space dimension, time pattern dimension, attack feature dimension, alarm type dimension, severity dimension, and threat level evolution dimension.

[0112] In one exemplary embodiment of this disclosure, the apparatus further includes: a security defense strategy determination module, which can be used to determine an attack category based on the interpretable attack path report, determine a security defense strategy based on the attack category, and / or generate interpretable attack warning information.

[0113] In one exemplary embodiment of this disclosure, the network security devices in the multi-source heterogeneous scenario include multiple devices such as Web application firewall devices, full-traffic threat detection devices, endpoint detection and response devices, database auditing devices, and data leakage prevention devices; the network attack alarm logs include multiple devices such as a first network attack alarm log associated with the Web application firewall device, a second network attack alarm log associated with the full-traffic threat detection device, a third network attack alarm log associated with the endpoint detection and response device, a fourth network attack alarm log associated with the database auditing device, and a fifth network attack alarm log associated with the data leakage prevention device.

[0114] The specific details of each module in the aforementioned network alarm event discrimination device have been described in detail in the corresponding network alarm event discrimination method, so they will not be repeated here.

[0115] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0116] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0117] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0118] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0119] The following reference Figure 13 To describe an electronic device 1300 according to such an embodiment of the present disclosure. Figure 13 The electronic device 1300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0120] like Figure 13 As shown, the electronic device 1300 is manifested in the form of a general-purpose computing device. The components of the electronic device 1300 may include, but are not limited to: at least one processing unit 1310, at least one storage unit 1320, a bus 1330 connecting different system components (including storage unit 1320 and processing unit 1310), and a display unit 1340.

[0121] The storage unit stores program code that can be executed by the processing unit 1310, causing the processing unit 1310 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 1310 can perform actions such as... Figure 1The steps shown are as follows: Step S110: Obtain network attack alarm logs generated by network security devices in a multi-source heterogeneous scenario during network security monitoring; Step S120: Extract features from the network attack alarm logs to obtain alarm event features of network alarm events associated with the network attack alarm logs; Step S130: Perform aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence; The alarm event sequence includes context information of network alarm events from multiple different time periods and different data sources; Step S140: Based on a preset event mining model, mine the inherent correlation between the network alarm events from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report.

[0122] Storage unit 1320 may include readable media in the form of volatile storage units, such as random access memory (RAM) 13201 and / or cache memory 13202, and may further include read-only memory (ROM) 13203.

[0123] Storage unit 1320 may also include a program / utility 13204 having a set (at least one) of program modules 13205, such program modules 13205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0124] Bus 1330 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0125] Electronic device 1300 can also communicate with one or more external devices 1400 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1300, and / or any device that enables electronic device 1300 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1350. Furthermore, electronic device 1300 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1360. As shown, network adapter 1360 communicates with other modules of electronic device 1300 via bus 1330. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0126] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0127] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this disclosure described in the "Exemplary Methods" section above.

[0128] The program product for implementing the above-described method according to embodiments of the present disclosure may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0129] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0130] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0131] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0132] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0133] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0134] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention described herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not invented by this disclosure. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A method for identifying network alarm events, characterized in that, include: Acquire network attack alarm logs generated by network security devices in multi-source heterogeneous scenarios during network security monitoring; Feature extraction is performed on the network attack alarm logs to obtain alarm event features of network alarm events associated with the network attack alarm logs; The alarm event sequence is obtained by performing aggregation and correlation analysis on the alarm event features; the alarm event sequence includes context information of network alarm events from different time periods and different data sources; Based on a preset event mining model, the inherent correlation between the network alarm events is mined from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report.

2. The method for determining network alarm events according to claim 1, characterized in that, Feature extraction is performed on the network attack alarm logs to obtain alarm event features of the network alarm events associated with the network attack alarm logs, including: The network attack alarm logs are standardized based on a preset alarm data standardization model to obtain standardized alarm logs. Based on the standardized alarm logs, multi-dimensional alarm features of network alarm events associated with the network attack alarm logs are determined, and the multi-dimensional alarm features are transformed to obtain alarm event features.

3. The method for determining network alarm events according to claim 1, characterized in that, The alarm event sequence is obtained by performing aggregation and correlation analysis on the alarm event features, including: The feature association key is determined based on the user information and / or attack methods in the alarm event features, and the association relationship between the alarm event features is established based on the feature association key to obtain the feature association result; The alarm event features in the feature association results are sorted based on the timestamps in the alarm event features to obtain an alarm event sequence.

4. The method for determining network alarm events according to claim 1, characterized in that, Based on a pre-defined event mining model, the inherent correlations between network alarm events are mined from multiple different dimensions according to the alarm event sequence to obtain an interpretable attack path report, including: The alarm event sequence is encoded from multiple different dimensions by an encoder to obtain a context-aware vector associated with the network alarm event; Based on the decoder, multi-stage attacks are identified and judged from multiple different dimensions of the context-aware vector, resulting in an interpretable attack path report associated with the network alarm event.

5. The method for determining network alarm events according to claim 4, characterized in that, The alarm event sequence is encoded from multiple different dimensions by an encoder to obtain a context-aware vector associated with the network alarm event, including: The alarm event sequence is embedded based on the first embedding layer to obtain the first embedding vector, and the alarm event sequence is encoded based on the first position encoding module to obtain the first position vector. The first embedding vector and the first position vector are superimposed to obtain the first input vector, and the first input vector is encoded from multiple different dimensions based on the first feature encoding module to obtain the context-aware vector associated with the network alarm event.

6. The method for determining network alarm events according to claim 5, characterized in that, The first input vector is encoded from multiple different dimensions by the first feature encoding module to obtain a context-aware vector associated with the network alarm event, including: The first attention mechanism of the first input vector in multiple different dimensions is calculated based on the first multi-head self-attention module, and the first attention mechanism and the first input vector are subjected to residual connection and normalization processing based on the first residual connection and normalization module to obtain the first normalization processing result. The first normalization result is linearized based on the first feedforward neural network to obtain the first linearized result. The first linearized result and the first normalized result are then subjected to residual connection and normalization based on the second residual connection and normalization module to obtain the context-aware vector associated with the network alarm event.

7. The method for determining network alarm events according to claim 6, characterized in that, The first multi-head self-attention module includes multiple first self-attention modules. The number of first self-attention modules is consistent with the number of dimensions. Each first self-attention module is used to determine the first attention mechanism in one dimension. The first attention mechanism for calculating the first input vector in multiple different dimensions based on the first multi-head self-attention module includes: calculating the first attention mechanism for the first input vector in a single dimension corresponding to the first self-attention module based on the first self-attention module, and obtaining the first attention mechanism for the first input vector in multiple different dimensions based on the first attention mechanism in the single dimension.

8. The method for determining network alarm events according to claim 7, characterized in that, The first attention mechanism, which calculates the first input vector on the single dimension corresponding to the first self-attention module based on the first self-attention module, includes: The first input vector is linearly fused to obtain a first query vector, a first key vector, and a first value vector. The first outer product vector of the first query vector and the first key vector is calculated to obtain the first similarity between the first query vector and the first key vector. The first similarity is normalized to obtain the first weight matrix, and the second outer product vector of the first weight matrix and the first value vector is calculated to obtain the first attention mechanism of the first input vector in the single dimension corresponding to the first self-attention module.

9. The method for determining network alarm events according to claim 4, characterized in that, Based on the decoder, multi-stage attacks are identified and judged from multiple different dimensions of the context-aware vector, resulting in an interpretable attack path report associated with the network alarm event, including: The first feature decoding module identifies multi-stage attacks from multiple different dimensions to obtain multi-stage attack identification results. Based on the first classification layer, the attack category is determined according to the multi-stage attack identification results, and an interpretable attack path report associated with the network alarm event is obtained.

10. The method for determining network alarm events according to any one of claims 4-9, characterized in that, The various dimensions include multiple dimensions such as physical device space dimension, time pattern dimension, attack characteristic dimension, alarm type dimension, severity dimension, and threat level evolution dimension.

11. The method for determining network alarm events according to claim 1, characterized in that, The method further includes: The attack category is determined based on the explained attack path report, and a security defense strategy is determined based on the attack category, and / or, an explained attack warning message is generated.

12. The method for determining network alarm events according to claim 1, characterized in that, The network security devices in the multi-source heterogeneous scenario include multiple types of Web application firewall devices, full-traffic threat detection devices, endpoint detection and response devices, database auditing devices, and data leakage prevention devices; The network attack alarm logs include multiple types of the following: a first network attack alarm log associated with a Web application firewall device, a second network attack alarm log associated with a full-traffic threat detection device, a third network attack alarm log associated with an endpoint detection and response device, a fourth network attack alarm log associated with a database audit device, and a fifth network attack alarm log associated with a data leakage prevention device.

13. A device for determining network alarm events, characterized in that, include: The network attack alarm log collection module is used to acquire network attack alarm logs generated by network security devices in multi-source heterogeneous scenarios during network security monitoring. The alarm event feature extraction module is used to extract features from the network attack alarm log to obtain alarm event features of network alarm events associated with the network attack alarm log. The alarm event sequence determination module is used to perform aggregation and correlation analysis on the alarm event features to obtain an alarm event sequence; the alarm event sequence includes context information of multiple network alarm events from different time periods and different data sources; The attack path report generation module is used to mine the inherent correlation between the network alarm events from multiple different dimensions based on the alarm event sequence according to a preset event mining model, so as to obtain an interpretable attack path report.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the method for determining network alarm events as described in any one of claims 1-12.

15. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the network alarm event discrimination method according to any one of claims 1-12 by executing the executable instructions.

Images