A network security operation and maintenance alarm method and device

Abstract

The application belongs to the technical field of operation and maintenance monitoring, and particularly relates to a network security operation and maintenance alarm method and device, specific steps of the alarm method being as follows: multi-source alarm data acquisition and standardized preprocessing, alarm intelligent research and judgment, alarm grading push according to research and judgment results, whole-process disposal tracking, disposal result review and closed-loop feedback, and alarm rule iterative optimization; the method completely builds an alarm generation, intelligent research and judgment, grading push, disposal tracking, result feedback and rule optimization whole-process closed-loop operation and maintenance system through a seven-step coherent closed-loop process, completely solves the problem of disconnection between alarm and disposal, and realizes the standardization and intelligent upgrading of network security operation and maintenance, and completely adapts to the innovation and practicality requirements of the patent technical solution.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance monitoring technology, specifically to a method and device for network security operation and maintenance alarms. Background Technology

[0002] With the comprehensive and in-depth advancement of the digital economy, cloud computing, big data, the Internet of Things, the industrial Internet, and hybrid IT architectures are becoming increasingly widespread. Various network terminals, business systems, and data interaction scenarios are growing exponentially. Network boundaries are gradually becoming blurred and generalized, and network attack methods are increasingly showing characteristics of concealment, complexity, collaboration, and persistence. New threats such as APT attacks, zero-day vulnerability exploitation, ransomware, and lateral movement within internal networks are emerging one after another, placing extremely high demands on the real-time monitoring, accurate early warning, and rapid response capabilities of network security operations and maintenance.

[0003] As a core component of the operations and maintenance system, cybersecurity alerts bear the crucial functions of threat perception, anomaly alerting, risk notification, and response guidance, directly determining the efficiency of security operations and maintenance and the overall protection effectiveness. However, existing operations and maintenance alerting methods still have the following technical problems in use:

[0004] Existing alarm methods only have basic anomaly alarm and information push functions, and have not built a closed-loop operation and maintenance system covering alarm generation, intelligent analysis, hierarchical push, handling tracking, result feedback and rule optimization. Alarm information is completely disconnected from subsequent handling processes.

[0005] On the one hand, there is a lack of standardized handling suggestions and automated linkage handling interfaces, which rely heavily on the personal experience of operation and maintenance personnel, resulting in inconsistent handling efficiency and standardization. On the other hand, there is no alarm handling result feedback and rule iteration mechanism, which makes it impossible to optimize alarm logic according to actual operation and maintenance conditions. After long-term operation, the problems of false alarms and missed alarms are difficult to improve, and it is impossible to achieve the standardization and intelligent upgrade of security operation and maintenance.

[0006] Therefore, this technology is proposed to solve the problems mentioned above. Summary of the Invention

[0007] The purpose of this invention is to provide a network security operation and maintenance alarm method and device to solve the problems mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a network security operation and maintenance alarm method, the specific steps of which are as follows:

[0009] Step 1: Multi-source alarm data collection and standardized preprocessing: Through a unified data collection interface, connect to various network security hardware and software systems to collect data from all dimensions across the entire domain; perform format standardization, deduplication, and noise reduction preprocessing on the collected multi-source heterogeneous data, eliminate duplicate reports and invalid data with incorrect formats, generate standardized initial alarm entries, and complete the alarm generation stage of the closed-loop system.

[0010] Step 2, Intelligent Alarm Analysis: Build an intelligent analysis model, combine multi-dimensional indicators, and perform fully automatic in-depth analysis on the pre-processed initial alarms. After the analysis is completed, automatically match the built-in standardized handling solution library to generate standardized handling suggestions that can be directly implemented. At the same time, automatically generate automated linkage handling instructions for high-risk alarms and adapt to the linkage handling interface call requirements.

[0011] Step 3: Push alarms according to the analysis results: Based on the intelligent analysis results, alarms are classified into levels and pushed in a differentiated manner according to the priority of the level; the push content is accompanied by standardized handling suggestions, automated linkage instructions and related alarm context information.

[0012] Step 4: Full-process handling tracking: Build a dedicated handling tracking module to track each pushed alarm in real time. When maintenance personnel receive alarms and carry out handling work, they can upload the handling actions, handling progress, and current handling status in real time through the terminal. The module automatically records the handling personnel, handling time, and key operation nodes to form a complete handling tracking ledger.

[0013] Step 5: Review and feedback of handling results: After the handling is completed, the reviewer or the system automatically reviews the handling effect to determine whether the handling is thorough and whether the threat has been completely eliminated, and classifies the handling results; the full-dimensional result data is fed back to the background closed-loop control center in real time, and the corresponding initial alarm items and analysis records are linked to form a closed-loop link of handling-review-feedback.

[0014] Step Six: Alarm Rule Iteration and Optimization: The closed-loop control center conducts big data analysis on the data within the period, performs in-depth source tracing on key data, and identifies the defects of the original alarm triggering rules, judgment models, and handling plans; based on the analysis results, it automatically optimizes the alarm triggering threshold, feature matching rules, judgment indicator weights, and standardized handling plans, completes rule optimization and model iteration, and synchronously distributes the optimized rules to the front-end collection and judgment modules;

[0015] Step 7: Closed-loop archiving and ledger retention: All data from a single alarm, from generation, analysis, push, handling, feedback to rule optimization, are uniformly encrypted and archived; at the same time, closed-loop operation and maintenance reports are generated regularly to intuitively display alarm handling efficiency, improvement of false and missed alarms, and the effect of rule optimization.

[0016] Preferably, in step one, the various network security hardware and software systems specifically include firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), endpoint detection and response (EDR), security auditing devices, and traffic monitoring devices; the full-dimensional data includes raw alarm information, network traffic data, device operation logs, and abnormal access records.

[0017] Preferably, in step two, the multi-dimensional indicators include asset importance level, threat type, degree of harm, scope of impact, and business relevance.

[0018] Preferably, in step three, alarms are divided into four levels: emergency, high-risk, medium-risk, and low-risk. The differentiated graded push is as follows: emergency and high-risk alarms are directly pushed to the terminal of the core operation and maintenance person in charge, and simultaneously trigger multiple reminders via sound, light, and SMS; medium-risk and low-risk alarms are pushed to the terminal of the corresponding operation and maintenance team.

[0019] Preferably, in step five, the handling results are divided into four categories: handling success, handling failure, need for secondary handling, and false alarm; the full-dimensional result data includes the review results, handling effect, threat elimination status, and handling-related issues.

[0020] Preferably, in step six, the content of the big data analysis of the data within the cycle by the closed-loop control center includes: alarm data, judgment results, handling records, and feedback results; the data for in-depth tracing includes erroneous alarms, missed alarms, handling failures, and judgment deviations.

[0021] A network security operation and maintenance alarm device includes a multi-source alarm collection and preprocessing module, an intelligent analysis and handling plan generation module, a hierarchical alarm precise push module, a full-process handling tracking module, a handling result review and feedback module, a rule iteration optimization and control module, and auxiliary supporting modules.

[0022] The multi-source alarm acquisition and preprocessing module serves as the basic data input terminal of the device and undertakes the core function of alarm generation. It has a built-in unified data interface, data standardization unit, and redundant data noise reduction unit. The unified data interface is used to be compatible with various heterogeneous security devices and operation and maintenance systems, and collects original alarm information, network anomaly logs, traffic anomaly data, and terminal behavior records across the entire domain.

[0023] The intelligent assessment and response plan generation module is the core decision-making unit of the device, and it has built-in intelligent assessment model, asset threat association unit, standardized response library and linkage instruction generation unit.

[0024] The hierarchical alarm precision push module is responsible for the hierarchical push link in the closed-loop system, and has built-in alarm level classification unit, differentiated push unit, and multi-channel reminder unit.

[0025] The full-process handling tracking module undertakes the core function of handling tracking in the closed-loop system, and has built-in a real-time handling status monitoring unit, a handling progress recording unit, and an operation and maintenance traceability unit.

[0026] The disposal result verification and feedback module, as the core link of the closed-loop system for result feedback, includes a disposal effect verification unit, a result classification and marking unit, and a feedback data uploading unit.

[0027] The rule iteration optimization and control module is the self-improvement unit of the device, which undertakes the function of rule optimization of the closed-loop system, and has built-in big data analysis unit, rule defect tracing unit, dynamic optimization iteration unit, and global control unit;

[0028] To ensure the complete operation of the closed-loop system, the auxiliary supporting modules include a data storage and archiving module for encrypted storage of all process data.

[0029] Compared with the prior art, the beneficial effects of the present invention are:

[0030] This method establishes a complete closed-loop operation and maintenance system through a seven-step sequential process, encompassing alarm generation, intelligent analysis, tiered push notifications, handling tracking, result feedback, and rule optimization. This system thoroughly resolves the disconnect between alarms and handling. It incorporates standardized handling solutions and automated linkage interfaces, eliminating reliance on the experience of operations and maintenance personnel and ensuring standardized handling. Continuous rule iteration based on result feedback fundamentally improves false alarms and missed alarms, ultimately achieving a standardized and intelligent upgrade of network security operations and maintenance. This fully meets the innovative and practical requirements of patented technology solutions. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating the steps involved in a network security operations and maintenance alert method.

[0032] Figure 2 This is a diagram showing the module composition of a network security operation and maintenance alarm device.

[0033] Figure 3 This is a diagram showing the composition of the multi-source alarm acquisition and preprocessing module;

[0034] Figure 4 A diagram showing the components of the intelligent analysis and response solution generation module;

[0035] Figure 5 A diagram showing the components of the tiered alarm precision push module;

[0036] Figure 6 A diagram showing the components of the end-to-end processing and tracking module;

[0037] Figure 7 This is a diagram showing the components of the processing result review and feedback module;

[0038] Figure 8 This is a diagram showing the composition of the rule iteration optimization and control module;

[0039] Figure 9 This is a diagram showing the composition of the supporting modules. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Example:

[0042] Please see Figure 1-9 The present invention provides a technical solution:

[0043] A network security operation and maintenance alert method is proposed, and the specific steps of the alert method are as follows:

[0044] Step 1: Multi-source alarm data collection and standardized preprocessing: Through a unified data collection interface, various network security hardware and software systems are connected to collect data from all dimensions across the entire domain; the collected multi-source heterogeneous data is preprocessed by standardizing the format, deduplicating, and reducing noise, eliminating invalid data with duplicate reports and incorrect formats, generating standardized initial alarm entries, completing the alarm generation stage of the closed-loop system, providing a standardized data source for subsequent full-process handling, and avoiding invalid data from interfering with the subsequent analysis process from the source;

[0045] Step 2, Intelligent Alarm Analysis: Build an intelligent analysis model and combine multi-dimensional indicators to perform fully automated in-depth analysis of the pre-processed initial alarms. After the analysis is completed, automatically match the built-in standardized handling solution library to generate standardized handling suggestions that can be directly implemented. At the same time, automatically generate automated linkage handling instructions for high-risk alarms and adapt to the linkage handling interface call requirements to achieve standardization and intelligence of alarm analysis. This solves the pain point of existing technologies lacking standardized handling suggestions and relying heavily on human experience, and ensures the standardization and consistency of handling actions of different operation and maintenance personnel.

[0046] Step 3: Push alarms in a tiered manner based on the assessment results: Based on the intelligent assessment results, alarms are divided into levels and pushed in a differentiated manner according to the priority of the level; the push content is accompanied by standardized handling suggestions, automated linkage instructions and related alarm context information to achieve accurate implementation of tiered push and avoid the low operation and maintenance efficiency caused by indiscriminate push of all alarms. At the same time, the handling priority of each level is clearly defined so that operation and maintenance resources are accurately adapted to the threat level.

[0047] Step 4: Full-Process Handling Tracking: A dedicated handling tracking module is established to track each pushed alarm in real time. When maintenance personnel receive an alarm and begin handling, they can upload the handling action, progress, and current status (pending handling, in progress, handled, pending review, or failed) in real time via their terminals. The module automatically records the handling personnel, handling time, and key operation nodes, forming a complete handling tracking ledger. This ensures full-process traceability of handling tracking, completely resolving the problem of disconnect between existing technical alarm information and subsequent handling processes, making every alarm controllable and traceable from receipt to handling.

[0048] Step 5: Review and Closed-Loop Feedback of Handling Results: After the handling is completed, the handling effect is reviewed by the review personnel or automatically by the system to determine whether the handling is thorough and whether the threat has been completely eliminated, and the handling results are classified; the full-dimensional result data is fed back to the back-end closed-loop control center in real time, and the corresponding initial alarm entries and analysis records are synchronously linked to form a closed-loop link of handling-review-feedback, which makes up for the shortcomings of the existing technology that lacks a handling result feedback mechanism, and provides real and effective data support for subsequent rule optimization;

[0049] Step Six: Alarm Rule Iteration and Optimization: The closed-loop control center conducts big data analysis on data within the period, performs in-depth source tracing on key data, and identifies the deficiencies in the original alarm triggering rules, judgment models, and handling plans. Based on the analysis results, it automatically optimizes alarm triggering thresholds, feature matching rules, judgment indicator weights, and standardized handling plans, completing rule optimization and model iteration. The optimized rules are then synchronously distributed to the front-end data collection and judgment modules, achieving self-updating and self-improvement of the entire closed-loop system. After continuous iteration and optimization, the false alarm and missed alarm rates are effectively reduced during long-term operation, promoting the standardization and intelligent upgrading of network security operation and maintenance.

[0050] Step Seven: Closed-Loop Archiving and Record Keeping: All data from a single alarm, from generation, analysis, push notification, handling, feedback to rule optimization, is uniformly encrypted and archived to form a complete closed-loop operation and maintenance file. This facilitates subsequent review, auditing, and experience accumulation. Simultaneously, closed-loop operation and maintenance reports are generated regularly to visually display alarm handling efficiency, improvement in false positives and false negatives, and the effectiveness of rule optimization. This provides data support for upgrading the overall network security operation and maintenance system, thoroughly achieving seamless and uninterrupted closed-loop security alarm operation and maintenance.

[0051] In step one, the various network security hardware and software systems specifically include firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), endpoint detection and response (EDR), security auditing devices, and traffic monitoring devices; the full-dimensional data includes raw alarm information, network traffic data, device operation logs, and abnormal access records.

[0052] In step two, the multi-dimensional indicators include asset importance level, threat type, degree of harm, scope of impact, and business relevance.

[0053] In step three, alarms are divided into four levels: emergency, high-risk, medium-risk, and low-risk. The differentiated graded push is as follows: emergency and high-risk alarms are directly pushed to the terminal of the core operation and maintenance person in charge, and simultaneously trigger multiple reminders such as sound, light, and SMS; medium-risk and low-risk alarms are pushed to the terminal of the corresponding operation and maintenance team.

[0054] In step five, the handling results are divided into four categories: handling success, handling failure, need for secondary handling, and false alarm; the full-dimensional result data includes the review results, handling effect, threat elimination status, and handling-related issues.

[0055] In step six, the closed-loop control center performs big data analysis on the data within the cycle, including: alarm data, analysis results, handling records, and feedback results; the data that is the focus of in-depth tracing includes erroneous alarms, missed alarms, handling failures, and analysis deviations.

[0056] A network security operation and maintenance alarm device includes a multi-source alarm collection and preprocessing module, an intelligent analysis and handling plan generation module, a hierarchical alarm precise push module, a full-process handling tracking module, a handling result review and feedback module, a rule iteration optimization and control module, and auxiliary supporting modules.

[0057] The multi-source alarm acquisition and preprocessing module serves as the basic data input terminal of the device, undertaking the core function of alarm generation. It incorporates a unified data interface, a data standardization unit, and a redundant data noise reduction unit. The unified data interface is used to be compatible with various heterogeneous security devices and operation and maintenance systems, collecting raw alarm information, network anomaly logs, traffic anomaly data, and terminal behavior records across the entire domain. The data standardization unit performs format unification and field regularization processing on the collected heterogeneous data, eliminating differences in the format of multi-source data. The redundant data noise reduction unit automatically removes redundant data such as duplicate reports, invalid interference, and disordered formats, generating a standardized and clean initial alarm dataset. This provides a high-quality data source for subsequent closed-loop processing, reducing invalid alarm interference from the source and completing the alarm generation stage of the closed-loop system.

[0058] The intelligent assessment and response plan generation module is the core decision-making unit of the device, and it incorporates an intelligent assessment model, an asset threat association unit, a standardized response library, and a linkage command generation unit. The intelligent assessment model, based on preset multi-dimensional indicators such as threat characteristics, asset importance, hazard level, and impact scope, performs fully automated in-depth assessment of pre-processed initial alarms, automatically distinguishing between real threats and false alarms, thus eliminating the drawbacks of traditional manual experience-based assessment. The asset threat association unit binds alarm information to corresponding network assets and business systems, accurately determining the degree of threat impact. The standardized response library contains a massive number of standardized response plans adapted to different threat types, eliminating the need for maintenance personnel to develop strategies independently. Based on the assessment results, the linkage command generation unit automatically generates automated linkage response commands adapted to external security devices, addressing the shortcomings of existing technologies that lack standardized response suggestions and automated linkage response interfaces, ensuring the standardization and efficiency of alarm response, and solving the problems of inconsistent response efficiency and reliance on manual experience.

[0059] The hierarchical alarm precision push module is responsible for the hierarchical push link in the closed-loop system. It has built-in alarm level classification unit, differentiated push unit, and multi-channel reminder unit. The alarm level classification unit divides alarms into four priority levels: emergency, high-risk, medium-risk, and low-risk, based on intelligent analysis results. The differentiated push unit matches the corresponding operation and maintenance handling permissions according to the level, pushing emergency and high-risk alarms directly to the core operation and maintenance personnel's terminal, and medium-risk and low-risk alarms to the corresponding operation and maintenance team's terminal, avoiding the waste of operation and maintenance resources caused by indiscriminate full push. The multi-channel reminder unit supports multiple reminder methods such as terminal pop-ups, SMS, sound and light, and enterprise operation and maintenance groups. The push content also includes alarm details, standardized handling suggestions, automated linkage instructions, and contextual information, ensuring rapid response to high-priority alarms and achieving precise allocation of operation and maintenance resources.

[0060] The full-process handling tracking module undertakes the core function of handling tracking in the closed-loop system, and has built-in real-time monitoring unit for handling status, handling progress recording unit, and operation and maintenance traceability unit. The real-time handling status monitoring unit tracks the handling status of each pushed alarm in real time, covering five categories: pending handling, handling in progress, handled, handling failed, and pending review. The handling progress recording unit automatically records the handling personnel, handling duration, key handling nodes, and phased handling results, forming a complete handling ledger. The operation and maintenance traceability unit records the handling operations of maintenance personnel throughout the entire process, ensuring that every handling action is traceable and verifiable. This module completely breaks down the barriers between alarm information and subsequent handling processes, solving the problem of existing technology alarms being completely disconnected from the handling process, and achieving full control and no omissions in the handling process.

[0061] The handling result verification and feedback module, as the core link of the closed-loop system, incorporates a handling effect verification unit, a result classification and marking unit, and a feedback data upload unit. The handling effect verification unit supports both manual and automatic system verification modes, verifying the effectiveness of completed alarm handling and determining whether the threat has been completely eliminated. The result classification and marking unit categorizes handling results into four types: successful handling, failed handling, secondary handling, and false alarms, accurately marking the final handling effect of each alarm. The feedback data upload unit synchronously uploads all-dimensional feedback data, including verification results, handling effects, and remaining issues, to the device's core management platform in real time, forming a closed-loop link of "handling-verification-feedback." This addresses the shortcomings of existing technologies that lack alarm handling result feedback mechanisms, providing real and accurate measured data support for subsequent rule optimization.

[0062] The rule iteration optimization and control module is the device's self-improvement unit, responsible for optimizing rules within the closed-loop system. It includes a big data analysis unit, a rule defect tracing unit, a dynamic optimization iteration unit, and a global control unit. The big data analysis unit performs in-depth analysis of alarm data, judgment records, handling results, and feedback information within a period, accurately locating defects in existing alarm triggering rules, judgment models, and handling schemes. The rule defect tracing unit traces the root causes of false alarms, missed alarms, and handling failures, clarifying the direction for rule optimization. The dynamic optimization iteration unit automatically adjusts alarm trigger thresholds, feature matching rules, and judgment indicator weights based on analysis results, synchronously updating the standardized handling library to achieve dynamic iterative optimization of alarm logic. The global control unit coordinates the operation of each module, synchronously distributing optimized rules to front-end modules to ensure continuous upgrading of the entire device's operating logic. This module solves the problems of existing technologies lacking rule iteration mechanisms and difficulty in improving false alarms and missed alarms. Long-term operation can sustainably reduce false alarm and missed alarm rates, promoting standardized and intelligent upgrades in network security operations and maintenance.

[0063] To ensure the complete operation of the closed-loop system, the auxiliary supporting modules include a data storage and archiving module for encrypted storage of all process data, including original alarm data, analysis records, push logs, handling ledgers, feedback results, and optimized rules, forming a complete closed-loop operation and maintenance archive. This supports subsequent auditing, review, and experience accumulation, further enhancing the device's closed-loop control capabilities and traceability.

[0064] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or basic characteristics. Therefore, the embodiments should be considered exemplary and non-limiting in all respects. The scope of the invention is defined by the appended claims rather than the foregoing description. Therefore, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention, and no reference numerals in the claims should be construed as limiting the scope of the claims.

[0065] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network security operation and maintenance alarm method, characterized in that, The specific steps of this alarm method are as follows: Step 1: Multi-source alarm data collection and standardized preprocessing: Through a unified data collection interface, connect to various network security hardware and software systems to collect data from all dimensions across the entire domain; perform format standardization, deduplication, and noise reduction preprocessing on the collected multi-source heterogeneous data, eliminate duplicate reports and invalid data with incorrect formats, generate standardized initial alarm entries, and complete the alarm generation stage of the closed-loop system. Step 2, Intelligent Alarm Analysis: Build an intelligent analysis model, combine multi-dimensional indicators, and perform fully automatic in-depth analysis on the pre-processed initial alarms. After the analysis is completed, automatically match the built-in standardized handling solution library to generate standardized handling suggestions that can be directly implemented. At the same time, automatically generate automated linkage handling instructions for high-risk alarms and adapt to the linkage handling interface call requirements. Step 3: Push alarms in a tiered manner according to the analysis results: Based on the intelligent analysis results, alarms are divided into levels and pushed in a differentiated manner according to the priority of the level. The push notifications also include standardized handling suggestions, automated linkage instructions, and related alarm context information. Step 4: Full-process handling tracking: Build a dedicated handling tracking module to track each pushed alarm in real time. When maintenance personnel receive alarms and carry out handling work, they can upload the handling actions, handling progress, and current handling status in real time through the terminal. The module automatically records the handling personnel, handling time, and key operation nodes to form a complete handling tracking ledger. Step 5: Review and feedback of handling results: After the handling is completed, the reviewer or the system automatically reviews the handling effect to determine whether the handling is thorough and whether the threat has been completely eliminated, and classifies the handling results; the full-dimensional result data is fed back to the background closed-loop control center in real time, and the corresponding initial alarm items and analysis records are linked to form a closed-loop link of handling-review-feedback. Step Six: Alarm Rule Iteration and Optimization: The closed-loop control center conducts big data analysis on the data within the period, performs in-depth source tracing on key data, and identifies the defects of the original alarm triggering rules, judgment models, and handling plans; based on the analysis results, it automatically optimizes the alarm triggering threshold, feature matching rules, judgment indicator weights, and standardized handling plans, completes rule optimization and model iteration, and synchronously distributes the optimized rules to the front-end collection and judgment modules; Step 7: Closed-loop archiving and ledger retention: All data from a single alarm, from generation, analysis, push, handling, feedback to rule optimization, are uniformly encrypted and archived; at the same time, closed-loop operation and maintenance reports are generated regularly to intuitively display alarm handling efficiency, improvement of false and missed alarms, and the effect of rule optimization.

2. The network security operation and maintenance alarm method according to claim 1, characterized in that: In step one, the various network security hardware and software systems specifically include firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), endpoint detection and response (EDR), security auditing devices, and traffic monitoring devices; the full-dimensional data includes raw alarm information, network traffic data, device operation logs, and abnormal access records.

3. The network security operation and maintenance alarm method according to claim 1, characterized in that: In step two, the multi-dimensional indicators include asset importance level, threat type, degree of harm, scope of impact, and business relevance.

4. The network security operation and maintenance alarm method according to claim 1, characterized in that: In step three, alarms are divided into four levels: emergency, high risk, medium risk, and low risk. The differentiated and tiered push notifications are as follows: emergency and high-risk alarms are directly pushed to the terminal of the core operations and maintenance manager, simultaneously triggering multiple alerts via sound, light, and SMS; medium-risk and low-risk alarms are pushed to the corresponding operations and maintenance team's terminal.

5. A network security operation and maintenance alarm method according to claim 1, characterized in that: In step five, the handling results are divided into four categories: handling success, handling failure, need for secondary handling, and false alarm; the full-dimensional result data includes the review results, handling effect, threat elimination status, and handling-related issues.

6. The network security operation and maintenance alarm method according to claim 1, characterized in that: In step six, the closed-loop control center performs big data analysis on the data within the cycle, including: alarm data, analysis results, handling records, and feedback results; the data that is the focus of in-depth tracing includes erroneous alarms, missed alarms, handling failures, and analysis deviations.

7. A network security operation and maintenance alarm device, characterized in that: The operation and maintenance alarm device includes a multi-source alarm collection and preprocessing module, an intelligent analysis and handling plan generation module, a hierarchical alarm precise push module, a full-process handling tracking module, a handling result review and feedback module, a rule iteration optimization and control module, and auxiliary supporting modules; The multi-source alarm acquisition and preprocessing module serves as the basic data input terminal of the device and undertakes the core function of alarm generation. It has a built-in unified data interface, data standardization unit, and redundant data noise reduction unit. The unified data interface is used to be compatible with various heterogeneous security devices and operation and maintenance systems, and collects original alarm information, network anomaly logs, traffic anomaly data, and terminal behavior records across the entire domain. The intelligent assessment and response plan generation module is the core decision-making unit of the device, and it has built-in intelligent assessment model, asset threat association unit, standardized response library and linkage instruction generation unit. The hierarchical alarm precision push module is responsible for the hierarchical push link in the closed-loop system, and has built-in alarm level classification unit, differentiated push unit, and multi-channel reminder unit. The full-process handling tracking module undertakes the core function of handling tracking in the closed-loop system, and has built-in a real-time handling status monitoring unit, a handling progress recording unit, and an operation and maintenance traceability unit. The disposal result verification and feedback module, as the core link of the closed-loop system for result feedback, includes a disposal effect verification unit, a result classification and marking unit, and a feedback data uploading unit. The rule iteration optimization and control module is the self-improvement unit of the device, which undertakes the function of rule optimization of the closed-loop system, and has built-in big data analysis unit, rule defect tracing unit, dynamic optimization iteration unit, and global control unit; To ensure the complete operation of the closed-loop system, the auxiliary supporting modules include a data storage and archiving module for encrypted storage of all process data.

Images