A data center security event operation and maintenance system based on threat intelligence correlation

Abstract

The application discloses a kind of based on threat intelligence association's data center security event operation and maintenance system, belong to data center security event operation and maintenance technical field, comprising: cross-platform data fusion module, asset detection and association fill-in module, multi-source alarm fusion and aggregation module and closed-loop response and knowledge sedimentation module, the cross-platform data fusion module is used to uniform arrangement service directory and data bus, periodically pull IP, host name and business attribution write in local library, bind SLA and generate business dependency topology, map role permission to realize fine isolation, centrally manage internal intelligence library, output asset risk value, execute CMDB asset and intelligence index special alignment, based on 30 days history hit rate empowerment and IP or domain name is consistent when judging equivalence and establishing association, to asset IP and intelligence index homomorphism encryption.The application is based on realizing data center security event operation and maintenance, further improve the significant management efficiency, and can further produce intelligent operation and maintenance efficiency.

Description

Technical Field

[0001] This invention relates to the field of data center security incident operation and maintenance technology, and more specifically, to a data center security incident operation and maintenance system based on threat intelligence correlation. Background Technology

[0002] Operation and maintenance monitoring refers to the process of real-time monitoring and management of the operational status of various components and systems in a distributed data center; by collecting, analyzing and reporting data on various aspects of the data center, it helps administrators to promptly identify and resolve potential problems.

[0003] Existing multi-platform data interoperability typically relies on hard or soft connections. Hard connections are costly to develop, have long maintenance cycles, and are limited by the openness of third-party interfaces. For example, enterprises typically have more than 15 heterogeneous systems, resulting in widespread data silos. Traditional manual import or script migration methods cannot meet real-time collaboration needs. Furthermore, cross-platform data lakes suffer from data authorization process bottlenecks due to format incompatibility and inconsistent permission systems, sometimes even becoming a collection of data silos. Secondly, heterogeneous data source integration often uses ETL batch processing, resulting in poor real-time performance and difficulty in achieving second-level synchronization. The lack of unified metadata management makes field semantic mapping prone to errors. B2B big data integration lacks unified standards, and multi-tenant isolation and high-concurrency access face bottlenecks. Moreover, existing security operation and maintenance patents, such as simple threat intelligence matching, lack global correlation analysis. Alarm correlation relies on rule-based state machines, which have high time-series requirements and are prone to missed alarms. Additionally, the lack of integration between CMDB / ITSM for fine-grained isolation from a management perspective further complicates matters. Summary of the Invention

[0004] In view of the problems existing in the prior art, the purpose of this invention is to provide a data center security incident operation and maintenance system based on threat intelligence association. On the basis of realizing data center security incident operation and maintenance, this invention also improves management efficiency significantly and can further generate intelligent operation and maintenance benefits.

[0005] To solve the above problems, the present invention adopts the following technical solution:

[0006] A data center security incident operation and maintenance system based on threat intelligence correlation includes: a cross-platform data fusion module, an asset detection and correlation completion module, a multi-source alarm fusion and aggregation module, and a closed-loop response and knowledge accumulation module;

[0007] The cross-platform data fusion module is used to uniformly orchestrate service catalogs and data buses, periodically pull IPs, hostnames and service affiliations and write them to the local database, bind SLAs to generate service dependency topologies, map role permissions to achieve fine-grained isolation, centrally manage the internal intelligence database, output asset risk values, perform dedicated alignment of CMDB assets and intelligence indicators, assign weights based on 30-day historical hit rates and determine equivalence and establish associations when IPs or domains are consistent, homomorphically encrypt asset IPs and intelligence indicators, and complete network segment affiliation judgment and attack analysis under ciphertext to achieve usability without visibility;

[0008] The asset detection and association completion module is used to remotely scan and identify the IP liveness, port, service and system of newly added assets using automated detection tools and to parse and provide feedback. It dynamically increases the port scanning priority based on the detection hit and reconnects incrementally when the information is incomplete. It extracts identification events through mirrored traffic, extracts network assets, aggregates active and passive results to calculate consistency and completeness indicators for cross-validation, and provides feedback on passive key information to achieve in-depth mining. It aligns and maps newly added assets based on multi-value identifiers, evaluates the reliability of completion based on attribute importance weight and equivalence judgment, and uses regular expression matching to selectively complete missing ports, services, systems and status.

[0009] The multi-source alarm fusion and aggregation module is used to provide a unified standard structure for receiving isolated heterogeneous alarms and deduplication using fingerprint hashing. It calculates dissimilarity by semantic dimension for seamless fusion and reduction, queries CMDB to supplement business departments and suppresses secondary alarms based on topology. The built-in business impact score recalculates priority routing based on the number of affected users, SLA level and estimated financial loss weights. It generates super alarms by combining ITSM role mapping permission level, asset number and time decay, performs category division to load extraction and combines state machine reward value to determine real attacks and filter out false alarms.

[0010] The closed-loop response and knowledge accumulation module is used to generate mitigation solutions based on super alarms using a large language model and break them down into sub-tasks. After expert review, these sub-tasks are executed, and the handling records are stored in a vector database to support similar scenario matching.

[0011] Compared with the prior art, the advantages of this invention are:

[0012] (1) This invention solves the problems of high API development costs and interface change failures in traditional multi-platform interoperability by unifying the orchestration of CMDB, ITSM, and data bus and consuming multi-source threat intelligence, and by incorporating matching confidence and comprehensive threat scoring algorithms. At the same time, the privacy protection computing subunit introduces homomorphic encryption to complete network segment analysis under ciphertext, making up for the shortcomings of inconsistent cross-platform permissions and sensitive data leakage. Asset detection adopts three methods: active scanning, passive mirroring, and switch configuration collection. Combined with dynamic optimization of port weight and cross-validation indicators, the integrity of asset discovery is greatly improved. The information association and completion unit fills in missing attributes in a targeted manner with confidence algorithm and regular expression matching, overcoming the dilemma of heterogeneous field alignment failure and difficulty in manual script maintenance. As a result, operation and maintenance personnel obtain a real-time, accurate, and encrypted centralized view of asset intelligence, and management decisions move from fragmentation to integration, greatly reducing compliance risks and manpower inspection costs.

[0013] (2) This invention eliminates the bottleneck of manual association of fragmented alarms by replacing general models such as recurrent neural networks with a lightweight dedicated algorithm through fine-grained semantic fusion and fingerprint hash deduplication. The context enrichment and false alarm judgment sub-unit filters out business disguised alarms based on a five-level classifier. User permission aggregation generates role-adaptive super alarms, so that managers can only see threats within their responsibilities. In particular, the closed-loop response and knowledge accumulation module uses a large language model to decompose and alleviate sub-tasks and executes them after expert review. The vector library records support similar scenario matching, breaking the defects of existing patents that lack automated processing closed loop and knowledge silos. The overall system forms a continuously evolving closed loop from asset discovery, intelligence association, alarm aggregation to intelligent response. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of a data center security incident operation and maintenance system based on threat intelligence association according to the present invention;

[0015] Figure 2 This is a schematic diagram of a cross-platform data fusion module in a data center security event operation and maintenance system based on threat intelligence association, according to the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0017] Example:

[0018] Please see Figure 1-2A data center security incident operation and maintenance system based on threat intelligence correlation includes: a cross-platform data fusion module, an asset detection and correlation completion module, a multi-source alarm fusion and aggregation module, and a closed-loop response and knowledge accumulation module;

[0019] The cross-platform data fusion module is used to uniformly compile CMDB asset ledgers, ITSM service catalogs and data buses, periodically pull IPs, hostnames and business affiliations and write them to the local database, bind SLAs to generate business dependency topologies, map role permissions to achieve fine isolation, centrally manage internal black IPs / domains and external DNS, Whois, URL, sample MD5 intelligence databases, assign credibility coefficients based on compliance audits and combine time decay and severity to eliminate multi-source conflicts and output asset risk values, perform dedicated alignment of CMDB assets and intelligence indicators, assign weights based on 30-day historical hit rate and determine equivalence and establish association when IPs or domains are consistent, homomorphically encrypt asset IPs and intelligence indicators, and complete network segment affiliation judgment and attack analysis under ciphertext to achieve usability without visibility;

[0020] The asset detection and association completion module is used to remotely scan and identify the IP liveness, ports, services and systems of newly added assets using automated detection tools and to parse and provide feedback. It dynamically increases the port scanning priority based on the detection hit and reconnects incrementally when the information is incomplete. It extracts identification events through mirrored traffic, extracts on-network assets, aggregates active and passive results to calculate consistency and completeness indicators for cross-validation, and provides feedback on passive key information to achieve in-depth mining. It aligns and maps newly added assets based on multi-value identifiers, evaluates the reliability of completion based on attribute importance weight and equivalence judgment, and uses regular expression matching to selectively complete missing ports, services, systems and statuses.

[0021] The multi-source alarm fusion and aggregation module is used to unify the standard structure of received isolated heterogeneous alarms and deduplicate them using fingerprint hashing. It calculates dissimilarity based on semantic dimensions such as attack type, source IP segment, destination asset, and alarm level, and seamlessly merges and reduces alarms. It queries the CMDB to supplement business departments and suppresses secondary alarms based on topology. The built-in business impact score recalculates priority routing based on the number of affected users, SLA level, and estimated financial loss weight. It generates super alarms by combining ITSM role mapping permission level, asset number, and time decay. It performs category division to load extraction based on a five-level classifier and combines state machine reward value to determine real attacks and filter out false alarms.

[0022] The closed-loop response and knowledge accumulation module is used to generate mitigation solutions based on super alarms using a large language model and break them down into sub-tasks. After expert review, these sub-tasks are executed, and the handling records are stored in a vector database to support matching of similar scenarios.

[0023] In a specific embodiment of the present invention, the fine-grained alarm fusion strategy implementation steps are as follows: Normalize and extract multi-source heterogeneous fragmented alarms generated by isolated security devices to obtain basic fields including alarm type, source IP, destination IP, destination port, alarm level, and timestamp; map alarms to the MITREATT&CK ontology to obtain tactical phase and technical number (TTP) tags; construct a temporary attack graph based on the attack chain phase or ATT&CK technical ID; calculate the attribute dissimilarity D(A,B) between pairs of alarms, where the semantic dimension covers attack type, source IP segment, destination asset, alarm level, and ATT&CK technical ID; when D(A,B) is lower than a dynamic threshold and shares the same attack chain supernode, merge according to the pre-compiled TTP feature vector to generate a reduced candidate alarm set.

[0024] Security semantics refers to the set of features in alarm data that characterize the essence and correlation logic of network security events. Its connotation is not limited to a single dimension, but simultaneously covers the kill chain stage, MITREATT&CK tactical and technical numbers, vulnerability numbers, alarm types, source IP ranges, target assets, and target port basic attributes. Each dimension is aligned with a unified asset model and threat intelligence indicators to determine whether different source alarms describe the same security intent or attack behavior, rather than just string matching.

[0025] The seamless implementation logic is as follows: After the dissimilarity calculation meets the fusion conditions, all original fields of atomic alarms are retained without discarding any context. The payload, asset identifier, and user permission context of multiple atomic alarms are merged and written into the same super alarm candidate structure. The business department and responsible person are automatically supplemented by querying the CMDB through the context enrichment unit. Downstream secondary alarms are suppressed based on the service dependency topology. The fusion process records the index of each atomic alarm with a pointer linked list to ensure that subsequent tracing can be expanded one by one, achieving alarm reduction with zero information breakage.

[0026] Super alerts include the following field: Super alert identifier Aggregation priority score Associated user permission levels Number of assets associated with user identity Business system attribution, attack chain dimension tags, atomic alarm reference list and the source edge, among which Storage via fingerprint hash The deduplicated atomic alarm primary key, the source tracing edge is shared. or Derivation and construction of an attack graph G=(V,E) with ATT&CK technology ID as the super node, so that super alarms and atomic alarms form a many-to-one traceable association model;

[0027] The cross-platform data fusion module unifies the orchestration of CMDB asset ledgers, ITSM service catalogs, big data analysis platforms, and data buses, and consumes third-party threat intelligence for centralized management. The asset detection module uses automated tools to continuously discover new assets and correlate missing information. The multi-source alarm module receives multi-source heterogeneous fragmented alarms and generates super alarms by semantic fusion. The closed-loop module generates mitigation solutions through a large language model, breaks them down into sub-tasks, reviews them with experts, executes them, and stores them in a vector library. This solution breaks down the data fragmentation caused by system silos in traditional security operations and maintenance, improves threat response efficiency through a unified management perspective, significantly reduces manual workload by combining automated detection and intelligent aggregation, and enables the system to continuously evolve by accumulating closed-loop knowledge. Compared with existing solutions that only focus on single-point detection, it has made significant progress in management process optimization and proactive defense.

[0028] Specifically, the cross-platform data fusion module includes an asset ledger and service catalog arrangement unit, a multi-source threat intelligence consumption unit, an asset intelligence specific correlation unit, and a privacy-preserving computing subunit;

[0029] The asset ledger and service catalog orchestration unit is used to obtain the security asset ledger from the CMDB system, synchronize open service data from the ITSM system to meet the requirements of related software items in the service catalog, and obtain users and permissions through the data bus platform to achieve bilateral synchronization of permissions within the software management system and the integrated system.

[0030] The multi-source threat intelligence consumption unit is used to centrally manage internal black IPs / domains and external Internet intelligence databases, including DNS, Whois, URLs, and sample MD5s, through a threat intelligence platform.

[0031] The Asset Intelligence Specific Association Unit is used to execute a dedicated alignment algorithm between CMDB asset attributes and threat intelligence indicators, establishing a centralized management association between security assets and intelligence.

[0032] The privacy-preserving computing subunit is used to perform homomorphic encryption on CMDB asset IPs and threat intelligence indicators, and to complete network segment attribution and attack analysis under ciphertext, achieving centralized management that is "usable but not visible".

[0033] In a specific embodiment of the present invention, the privacy-preserving computing subunit performs homomorphic encryption and completes network segment attribution determination under ciphertext by using either the BFV fully homomorphic encryption scheme or the TFHE fully homomorphic encryption scheme to encrypt the CMDB asset IP and the black IP indicators provided by the threat intelligence platform. The network address is converted into a 32-bit integer value, and a subnet mask is applied to extract the network portion. When using the BFV scheme, the difference between the encrypted target IP and the encrypted blacklist network address is calculated using homomorphic subtraction or XOR operations. If the result is 0, it is determined that they belong to the same network segment. When using the TFHE scheme, a homomorphic comparison circuit HomCompS is constructed to receive two ciphertexts and compare them bit by bit, outputting ciphertext indicating a greater than or less than relationship. This is combined with a bounding box AND operation to determine whether the asset IP falls within the network segment range indicated by the threat intelligence. (In AWS...) On the t3.medium instance, the average latency of BFV encryption operation is 270 milliseconds. The location retrieval calculation time under the TFHE framework is 5.12 seconds for 80-bit security and 5.67 seconds for 128-bit security. The above latency meets the timeliness requirements of centralized management in the batch comparison scenario of data center asset operation and maintenance.

[0034] The feasibility and specific solutions for performing attack analysis on ciphertext in the privacy-preserving computing subunit are as follows: input threat intelligence indicators and asset context into the privacy-preserving machine learning pipeline, use Paillier additive homomorphic encryption to assist in secure gradient descent to train a logistic regression model to achieve attack classification, or compile attack pattern matching rules into Boolean circuits and let the TFHE / CKKS scheme perform ciphertext inference. The BFV scheme has a single-step homomorphic operation latency of about 270 milliseconds, and the industry can achieve an acceleration of about 3,000 times by reconstructing the algorithm with GPU software.

[0035] The orchestration unit obtains ledgers from the CMDB and synchronizes service catalogs from the ITSM, while also acquiring user permissions via the data bus to achieve bilateral synchronization. The consumption unit centrally manages internal black IPs and external DNS intelligence databases. The specific association unit executes a dedicated alignment algorithm between CMDB attributes and intelligence indicators to establish associations. The privacy protection subunit performs homomorphic encryption on IPs and indicators, completing network segment judgment and analysis in encrypted form. This structure solves the problems of high development costs and interface openness restrictions in multi-platform data interoperability for enterprises. It also overcomes the risks of inconsistent permission systems and sensitive data leakage during cross-platform interaction through homomorphic encryption. While maintaining centralized management of assets and intelligence, it achieves usability without visibility, significantly enhancing data security compliance and cross-system collaboration efficiency in operation and maintenance management.

[0036] Specifically, the asset intelligence specific association unit incorporates a matching confidence algorithm specifically designed for secure asset-intelligence mapping, and its formula is limited to: Where C is the confidence level of the association between assets and intelligence indicators, which is dimensionless and ranges from [0,1]. The learning weights for the k-th intelligence source are assigned based on the historical hit rates over the past 30 days. These weights are dimensionless and are used as a simple, unbiased solution in the cold start of a multi-AI aggregation system, meaning all models have the same initial weights. The cold start weight constant is set to 0.5, and a normalized mapping function is used. The mathematical transformation from hit rate to weight is clarified, enabling the asset-intelligence matching confidence algorithm to possess implementable determinism throughout the system's entire lifecycle. This is a dimensionless function that determines the equivalence between asset attributes and intelligence indicators. It takes the value 1 when the IP / domain name in the CMDB is completely consistent with the active and passive intelligence, and 0 otherwise. This refers to the feature value of the k-th dimension attribute of the CMDB asset, where the k-th dimension attribute is the IP address and domain name, expressed as either a network address or a string. The k-th type of indicator feature value provided to the threat intelligence platform. The k-th type of indicator feature value is black IP, DNS and URL, and the unit is network address or string. n is the total number of attribute dimensions involved in the comparison, and the unit is number. This algorithm only retains the address and string specific alignment features and does not involve recurrent neural networks or general reinforcement learning models.

[0037] The multi-source threat intelligence consumption unit incorporates a comprehensive threat scoring algorithm to eliminate conflicts between multi-source intelligence and output asset risk values. Its formula is defined as follows: Where S represents the multi-source integrated threat score faced by the asset, which is dimensionless. Let be the credibility coefficient of the j-th intelligence source, assigned based on the compliance audit of information security level protection, dimensionless, and ranging from [0,1]. Based on the mapping rules of the information security compliance assessment levels, Information Security Compliance 2.0 divides information systems into five levels. Public practice shows that Tencent Financial Cloud Platform has completed the Level 4 assessment and Tencent Public Cloud has completed the Level 3 assessment, which can establish the relationship between the filing level of the system to which the intelligence source belongs and the information security compliance level. The corresponding table, passed Level 4 Information Security Protection. = 1.0, passed Level 3 Information Security Protection Assessment = 0.8, only passing Level 2 or meeting the assessment criteria. = 0.5, this rule transforms the compliance audit conclusion into a continuous coefficient within the interval [0,1], which matches the requirements of the original algorithm. As an intelligence timeliness decay factor, by Confirmed, among which The decay constant is expressed in hours. -1 , This is the difference between the intelligence generation time and the current system time, in hours. denoted as the original severity of the j-th source intelligence, dimensionless, and taking the integer value from 1 to 5; m is the number of intelligence sources involved in the calculation, in units of individuals.

[0038] In a specific embodiment of the present invention, the asset intelligence specific association unit is further defined to have a built-in matching confidence algorithm C and a comprehensive threat scoring algorithm S. C is weighted based on the historical hit rate of the past 30 days and sets 1 for consistent IP / domain names and 0 otherwise to achieve specific alignment of address strings. S eliminates multi-source conflicts and outputs risk values ​​by fusing confidence coefficient, timeliness decay factor and severity. This algorithm abandons the general model and only retains field-level alignment features. It is specifically designed for data center asset-intelligence mapping scenarios and solves the association errors caused by semantic inconsistency and quality inconsistency in heterogeneous data source integration. Compared with the poor real-time performance of traditional ETL batch conversion, this limitation ensures the accuracy of association with quantitative weights and dynamically reflects the timeliness of intelligence, making the security asset risk score more in line with the actual threat situation and providing accurate input for management decisions.

[0039] Specifically, the asset ledger and service catalog orchestration unit includes a CMDB interface synchronization subunit, an ITSM service catalog alignment subunit, and a bus permission proxy subunit:

[0040] The CMDB interface synchronization subunit is used to periodically retrieve the IP, hostname, and business system ownership fields from the asset ledger and write them to the local security information database.

[0041] The ITSM Service Catalog Alignment Subunit is used to bind asset ledger software items to ITSM Service Catalog SLA levels, generating a business dependency topology.

[0042] The bus permission agent subunit is used to obtain user roles through the data bus and map them to security asset viewing permissions, thereby achieving fine-grained isolation from a management perspective.

[0043] In a specific embodiment of the present invention, the CMDB subunit periodically retrieves service attributes such as IP hostnames and writes them to the local database. The ITSM subunit binds software items with SLAs to generate a service dependency topology. The bus agent subunit obtains role mapping viewing permissions through the data bus to achieve fine-grained isolation. This hierarchical subunit structure echoes the trend of cross-platform data integration requiring unified permission management and security policies. The service dependency topology intuitively supports isolation from a management perspective, overcoming the data access authorization process bottlenecks caused by the fragmentation of permissions in traditional multi-system systems. This allows for seamless orchestration of asset ledgers and service catalogs in operation and maintenance management, improving the bilateral synchronization efficiency of the integrated ITSM and CMDB system.

[0044] Specifically, the asset detection and association completion module includes: an active detection unit, a passive acquisition unit, a switch configuration acquisition unit, a log parsing and aggregation unit, and an information association completion unit;

[0045] The active detection unit is used to execute remote IP scanning scripts using automated detection tools to identify the IP activity, open ports, open services and operating system types of newly added assets within the jurisdiction, and to determine the target device IP and port open information based on the device IP database, establish a communication connection with it, and parse the feedback data packets.

[0046] The passive acquisition unit is used to mirror the network traffic to be detected and analyze traffic and event log data to extract asset identification events and asset port information, and push them to the asset security information database.

[0047] The switch configuration acquisition unit is used to log in to the switches in the jurisdiction to collect ARP tables, MAC tables and interface information tables, and extract initial network assets to help discover new assets;

[0048] The log parsing and aggregation unit is used to aggregate and merge the results of active and passive detection, improve asset information, and extract key information from passive discovery results to feed back to the active detection unit for in-depth mining of key assets. The specific interaction mechanism for the log parsing and aggregation unit to receive asset logs obtained by the passive collection unit through mirrored traffic parsing is limited to the following: the asset logs are encapsulated in JSON or TLV format, and the passive additional information extracted from them serves as key information, including the main services and corresponding ports opened by each asset, and DNS queries and responses. The information extracted includes the domain name and IP address correspondence, API information based on the HTTP protocol, and the IP address of newly launched assets. The new active detection and scanning strategy formed by the passively attached information is sent to the active detection unit through the control module or Redis task queue module. The active detection unit modifies the priority of the scanning target and supplements the initial information of the active scan, namely the open ports, running services, website domain name and URL, according to the strategy. The triggering condition is a combination of batch and event: when the current active scan task ends or the control module terminates the task in advance, a new round of scanning strategy is applied in batches, and when the passive detection identifies a newly launched asset IP, the IP is added to the active scan list in real time.

[0049] The information association and completion unit is used to align and map the newly added asset security information with other existing asset security information based on the unified asset model multi-value identifier, and to complete the missing information on open ports, services, operating system types and security status.

[0050] In specific embodiments of the present invention, proactive detection involves remote IP scanning to identify newly added asset port services, while passive detection involves collecting mirrored traffic to identify events. Switches collect ARP data for auxiliary discovery. Logs are aggregated and merged with both proactive and passive results and fed back for in-depth analysis. Information is correlated and supplemented based on a unified model with multi-valued identifiers for alignment and mapping to fill in missing information. This multi-strategy detection architecture solves the problem of unclear asset baselines using a single method. The combination of proactive and passive cross-validation significantly improves the completeness of detection. Compared to the traditional reliance on manual scripts or the high cost of connecting to long-tail systems, this module utilizes automated tools to continuously discover and correlate information, providing a solid foundation for operation and maintenance management.

[0051] Specifically, the active detection unit includes a port dictionary dynamic optimization subunit with a built-in weight update algorithm designed for asset port detection, the formula of which is: ,in The dynamic scan priority weight of the j-th port in the target port dictionary is dimensionless. The initial preset weight for the j-th port is dimensionless. Let be the dimensionless, dimensionless, weight increment constant after each successful detection and verification hit. The method for determining is to... The default value is a fixed value of 0.1, or it can be adjusted based on the port activation ratio during historical detection cycles within the jurisdiction. According to the formula Dynamic calculation, This is the ratio of the number of hits on open ports of assets within the same business system in the existing asset security information database to the total number of detections. The port exposure determination function returns 1 when the port is detected to be open, and 0 otherwise. It is dimensionless. The active detection unit also parses the device asset information data packets returned by the target device IP, classifies the target device's asset information, and determines its completeness. If incomplete, it re-establishes the communication connection with the target device IP to make the target device return the device asset information data packets again. Based on the newly obtained asset information, it performs classification and completeness checks, thus achieving incremental detection. The reconnection mechanism for incremental detection is limited to a maximum number of reconnections. =5, and the waiting interval before the nth reconnection attempt uses exponential backoff. ,in =1 second, =60 seconds, n is the number of reconnections performed and is counted from 0. When the number of reconnections reaches... If the asset information is still incomplete, the reconnection will be terminated and the target device will be marked as pending in-depth mining and written into the asset security information database, thereby avoiding an infinite loop;

[0052] The log parsing and aggregation unit incorporates an active-passive probe cross-validation algorithm. This algorithm uses consistency and integrity metrics to evaluate the comprehensiveness of the probe results. (The consistency metric formula is missing from the original text.) Where y represents the consistency index, in percentage. This indicates the number of network data assets detected by both active and passive detection, expressed in units of [number]. This indicates the number of network data assets detected, expressed in units. This indicates the number of items actively detected but not passively detected, expressed in units of [number]. This represents the number of items passively detected but not actively detected, expressed in units of [number]. The integrity index formula is: Where w represents the completeness index, in percentage. This indicates the total number of network data assets recorded in the network data asset database, expressed in units of individuals.

[0053] In a specific embodiment of the present invention, the active detection unit includes a port dictionary dynamic optimization subunit weight update algorithm. The system analyzes feedback packets to determine integrity and reconnection, enabling incremental probing. The log analysis aggregation unit incorporates a cross-validation algorithm with consistency and integrity metrics (y and w). Port weights dynamically increase with each hit, prioritizing higher-order ports to improve efficiency. Incremental probing ensures complete asset information, and cross-validation quantifies the overlap and full coverage of active and passive probing. This design addresses the pain points of complex ports and passive missed detections in asset probing by replacing aimless full scanning with a dedicated algorithm. It overcomes the waste of resources and easy omissions in traditional probing, ensuring continuous and accurate understanding of open ports, services, operating system types, and security status of assets within the jurisdiction.

[0054] Specifically, the information association completion unit incorporates an asset attribute completion confidence algorithm and a regularized matching classification subunit. The completion confidence formula is as follows: ,in To fill in the confidence level for missing asset attributes, dimensionless, with a value range of [0,1]. Let be the importance weight of the i-th asset attribute, which is dimensionless. The assignment scheme is limited to the initial stage of system deployment when there is no historical asset data, and is determined using the Analytic Hierarchy Process (AHP). Operations experts construct a hierarchical structure for four asset attributes: open ports, services, operating system type, and security status. They then perform pairwise judgments on the relative importance of these attributes using a 1-9 scale to generate a judgment matrix. The eigenvectors are then calculated and normalized to obtain the initial weights of each attribute, satisfying the condition ∑ =1, when the system has run for a full preset period and the asset security information database has accumulated sufficient records, switch to CRITIC objective weighting method update. Specifically, this involves calculating the standard deviation of various attribute feature values ​​in the historical database. As a measure of contrast strength, the Pearson correlation coefficient between calculated attributes And obtain conflict With information content Normalization yields weights The As a dimensionless numerical value, it serves as a multiplier for the importance of various attributes in the confidence completion algorithm. This is a function to determine attribute equivalence; it returns 1 if the attributes match, otherwise 0. It is dimensionless. For the i-th dimension feature value of the newly added asset, is the i-th feature value of the existing asset security information database, m is the total number of attribute dimensions participating in the completion comparison (unit: number), and the regular expression matching classification subunit is used to perform asset object field matching on the parsed asset information using regular expressions, so as to determine the category and perform targeted completion of missing information.

[0055] In a specific embodiment of the present invention, the information association completion unit incorporates an asset attribute completion confidence algorithm. and regular matching classification subunit, The reliability of missing data completion is evaluated based on the importance weights of various attributes and the equivalence judgment function. The regular expression sub-unit uses expressions to match parsed asset fields for targeted completion. This algorithm is specifically designed for aligning new assets with the existing database, solving the alignment failure caused by differences in naming of heterogeneous data fields. The completion quality is quantified by confidence to avoid blind trust. Combined with regular expression matching, category determination and automatic filling of missing information are achieved, so that the asset security information database maintains high integrity and consistency, supporting the management accuracy of subsequent alarm fusion and threat assessment.

[0056] Specifically, the multi-source alarm fusion and aggregation module includes an alarm receiving and normalization unit, a fine-grained semantic fusion unit, a context enrichment and suppression unit, a user permission association aggregation unit, and a false alarm analysis subunit;

[0057] The alarm receiving and normalization unit is used to receive multi-source heterogeneous fragmented alarms generated by isolated distributed security devices, unify the log format and extract the source, type, level, timestamp and asset identification fields, and unify the heterogeneous alarms into a standard structure containing source, type, severity, timestamp and host.

[0058] The fine-grained semantic fusion unit is used to introduce a fine-grained alarm fusion strategy, calculate the dissimilarity of attributes between alarms according to security semantics and seamlessly fuse alarms with dissimilarity below a preset threshold to achieve alarm reduction;

[0059] The context enrichment and suppression unit is used to query the CMDB based on the alarm hostname to automatically supplement the business department and person in charge, and to suppress downstream secondary alarms based on the service dependency topology;

[0060] The user permission association aggregation unit is used to combine user permissions and identity information to aggregate the reduced alarms by business system or attack chain dimension and generate super alarms for management to view the entire network threat and trace the source.

[0061] The false alarm analysis subunit is used to classify alarms into major categories, subdivide attack methods, capture communication directions, extract request / response load features based on a five-level classifier framework, and determine real attacks by combining state machine reward values, filtering out alarms disguised as normal business operations.

[0062] In a specific embodiment of the present invention, the specific name of the five-level classifier framework built into the false alarm judgment subunit, the judgment logic of each level, and the dependent data limitations include:

[0063] The primary classifier is a classifier that divides classes according to national standard categories. The judgment logic is to classify security events into major categories based on the national standard GB / T20986-2023. The dependent data are the security event type labels carried in the alarm and the national standard classification directory.

[0064] The secondary classifier is an attack method sub-classifier. The judgment logic is to subdivide the SQL injection and command injection attack methods into the major categories of vulnerability exploitation and malicious programs. The data it relies on is the attack feature rule base and the initial judgment results of alarm load.

[0065] The third-level classifier is a communication direction capture classifier. The judgment logic is based on security event metadata, including IP address pairs and communication direction, to dynamically construct a classifier to capture network communication direction features. The dependent data is the source and destination IP pairs and the communication direction field in the alarm metadata.

[0066] The fourth-level classifier is a request load feature classifier. The decision logic is to extract feature information from the request load, retain invariants, and remove variables to avoid the classifier from expanding indefinitely. The dependent data are the original request message load and the invariant extraction template.

[0067] The five-level classifier is a response load feature classifier. The judgment logic is to extract response load feature information, including response header layout, response body entropy value, HTML tag distribution, success or failure prompt words. The dependent data is the output of the response message load and entropy value calculation module.

[0068] The false alarm analysis subunit, in conjunction with the state machine reward value, determines the state definition, state transition conditions, and reward value calculation formula for a real attack, which are limited to:

[0069] Constructing a reinforcement learning-like state machine model Where S is the initial state. Let S be the target state, C be the set of multi-level classifiers, R be the set of reward values, A be the set of aging functions, and the state correspond to the node where the alarm is judged step by step in the five-level classifier. The initial state S is when the alarm is received but not classified, and the target state is... To complete the five-level classification and generate the overall reward value, when alarm data passes through the first to fifth level classifiers in sequence and completes the corresponding level judgment logic, the state is transferred from the previous level node to the next level node until the target state is entered.

[0070] The reward value is calculated using the formula: reward value of the i-th level classifier. Where x represents the security event to be assessed. Here, i represents the classifier level, j represents the classifier function number at the current level, and j represents the aging function. t represents the time difference between the current time and the time the security event occurred. The overall reward value is calculated by multiplying the reward values ​​of all states by the aging function. When the overall reward value is less than a preset threshold, it is determined to be a real attack, i.e., not a false alarm. The threshold is set based on the set of classifiers at level i. Determined by the threshold adjustment coefficient α;

[0071] The receiving unit unifies heterogeneous alarms into a standard structure, semantic fusion seamlessly merges and reduces alarms based on attribute dissimilarity, context enrichment queries the CMDB to supplement departments and suppress secondary alarms, permission aggregation combines user identity to generate super alarms, and false alarm analysis uses a five-level classifier to filter out normal disguises. This module breaks the fragmented status quo of isolated alarms in security devices, introduces user permissions and business context from a management perspective, significantly reduces the burden of manual switching for analysts, and improves alarm credibility through false alarm purification, enabling operations and maintenance to shift from passive response to fine-grained control based on network-wide threat tracing.

[0072] Specifically, the fine-grained semantic fusion unit incorporates an attribute dissimilarity algorithm designed specifically for secure semantic comparison, the formula being: Where D(A,B) is the degree of semantic dissimilarity between alarms A and B, which is dimensionless and ranges from [0,1]. The k-th security semantic dimension includes preset weights for attack type, source IP range, destination asset, and alarm level. The base weights are: threat credibility 0.3, asset criticality 0.25, attack stage 0.2, historical pattern 0.15, and environment 0.1. These weights can be dynamically adjusted during business hours or attack campaigns. The weights are dimensionless. , The normalized feature values ​​of the semantic attributes of A and B in the k-th dimension are given for alarm purposes. These are dimensionless, and t is the total number of semantic dimensions involved in the comparison, expressed in units of 1.

[0073] The alarm receiving and normalization unit is equipped with a fingerprint hash algorithm designed for deduplication of multi-source alarms, the formula of which is: Where F is the alarm fingerprint identifier, in the form of a string hash value, H is a one-way hash function, source is the alarm source detector code, name is the attack or anomaly name, service is the business component to which it belongs, and environment is the deployment environment identifier, all in the form of strings. Based on this fingerprint, duplicate alarms are identified and merged within a preset time window.

[0074] In a specific embodiment of the present invention, a fine-grained semantic fusion unit attribute dissimilarity algorithm is defined. and the normalized unit fingerprint hash algorithm The dissimilarity is only taken for semantic alignment at the field level such as attack type and does not involve a general model. Fingerprint hashing removes duplicates within the time window. This specialized algorithm solves the pain point of difficulty in merging multi-source alarms due to different formats. It uses a lightweight formula to reduce alarms and avoids ignoring key alarms in a large number of alarms. Fingerprint deduplication eliminates duplicate alarms. Compared with traditional rule state machines that are sensitive to time sequence and miss reports, this solution optimizes the alarm aggregation efficiency in the management process and makes it easier to view threats from a global perspective.

[0075] Specifically, the user permission association aggregation unit incorporates a super alarm generation weighting algorithm to evaluate the priority of alarm aggregation from the user's perspective. The formula is as follows: ,in The super alert is assigned a user-centric priority score, which is dimensionless. This is a user permission level coefficient, derived from ITSM role mapping. It is dimensionless and ranges from 1 to 5. It can be specified that administrators / platform administrators have a value of 5, change approvers have a value of 4, event managers have a value of 3, help desk / technicians have a value of 2, and ordinary users have a value of 1, to align with the value range of 1 to 5 and reflect the increasing importance of ITSM roles. The number of assets associated with a user's identity, in units of [number]. This represents the time difference between alarms originating from the same source, in seconds. Here, Δt is the time decay constant, and since Δt is the time difference between alarms from the same source, it aims to achieve smooth decay within the range of seconds to minutes. For example, the time interval can be set to 30 seconds, 60 seconds, or 300 seconds, in seconds. This algorithm combines user permissions and identity information to generate a super alarm.

[0076] The context enrichment and suppression unit incorporates a business impact scoring algorithm to recalculate aggregated alarm priorities. The formula is as follows: ,in The alarm service impact score is dimensionless and ranges from 0 to 100. The weights for category b business metrics include the number of affected users, SLA level, and estimated financial losses; these weights are dimensionless. Extract the default compensation standard corresponding to the SLA level from the business dependency topology generated by aligning subunits in the ITSM service catalog. The calculation method can be to divide the estimated monetary loss value under the impact of a single alarm by the maximum acceptable loss baseline preset by the system, normalize it to the dimensionless interval [0,1], and then multiply it by the weight. Participate in aggregation, The normalized value of the corresponding indicator is dimensionless, and q is the total number of indicator dimensions in units of 1. Alarms are routed to different response channels based on the scoring results.

[0077] In a specific embodiment of the present invention, a weighted algorithm for generating super alarms within a user permission-related aggregation unit is defined. By combining ITSM role mapping permissions with the number of associated assets and time decay assessment aggregation priority, this algorithm is specifically designed to generate super alerts based on user identity. This allows different managers to see a threat view that matches their rights and responsibilities, overcomes the information overload caused by insufficient permission isolation in cross-platform data fusion, routes alerts to the corresponding responsible persons through quantitative priority, improves the dispatch efficiency and closed-loop response speed of security event operation and maintenance, and meets the requirements of data processing systems specifically designed for management purposes.

[0078] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and its improved concept, should be covered within the scope of protection of the present invention.

Claims

1. A data center security incident operation and maintenance system based on threat intelligence correlation, characterized in that, include: Cross-platform data fusion module, asset detection and association completion module, multi-source alarm fusion and aggregation module, and closed-loop response and knowledge accumulation module; The cross-platform data fusion module is used to uniformly orchestrate service catalogs and data buses, periodically pull IPs, hostnames and service affiliations and write them to the local database, bind SLAs to generate service dependency topologies, map role permissions to achieve fine-grained isolation, centrally manage the internal intelligence database, output asset risk values, perform dedicated alignment of CMDB assets and intelligence indicators, assign weights based on 30-day historical hit rates and determine equivalence and establish associations when IPs or domains are consistent, homomorphically encrypt asset IPs and intelligence indicators, and complete network segment affiliation judgment and attack analysis under ciphertext to achieve usability without visibility; The asset detection and association completion module is used to remotely scan and identify the IP liveness, port, service and system of newly added assets using automated detection tools and to parse and provide feedback. It dynamically increases the port scanning priority based on the detection hit and reconnects incrementally when the information is incomplete. It extracts identification events through mirrored traffic, extracts network assets, aggregates active and passive results to calculate consistency and completeness indicators for cross-validation, and provides feedback on passive key information to achieve in-depth mining. It aligns and maps newly added assets based on multi-value identifiers, evaluates the reliability of completion based on attribute importance weight and equivalence judgment, and uses regular expression matching to selectively complete missing ports, services, systems and status. The multi-source alarm fusion and aggregation module is used to provide a unified standard structure for receiving isolated heterogeneous alarms and deduplicate them using fingerprint hashing. It calculates dissimilarity by semantic dimension for seamless fusion and reduction, queries CMDB to supplement business departments and suppresses secondary alarms based on topology. The built-in business impact score recalculates priority routing based on the number of affected users, SLA level and estimated financial loss weights. It generates super alarms by combining ITSM role mapping permission level, asset number and time decay, performs category division to load extraction and combines state machine reward value to determine real attacks and filter out false alarms. The closed-loop response and knowledge accumulation module is used to generate mitigation solutions based on super alarms using a large language model and break them down into sub-tasks. After expert review, these sub-tasks are executed, and the handling records are stored in a vector database to support similar scenario matching.

2. The data center security incident operation and maintenance system based on threat intelligence association as described in claim 1, characterized in that, The cross-platform data fusion module includes an asset ledger and service catalog arrangement unit, a multi-source threat intelligence consumption unit, an asset intelligence specific association unit, and a privacy protection computing subunit. The asset ledger and service catalog orchestration unit is used to obtain the security asset ledger from the CMDB system, synchronize the open service data from the ITSM system to meet the requirements of the software items related to the service catalog, and obtain users and permissions through the data bus platform to achieve bilateral synchronization of permissions within the software management system and the integrated system. The multi-source threat intelligence consumption unit is used to centrally manage a multi-category threat intelligence database, including internal black IPs / domains and external Internet intelligence DNS, Whois, URL, and sample MD5, through a threat intelligence platform. The asset intelligence specific association unit is used to execute a dedicated alignment algorithm between CMDB asset attributes and threat intelligence indicators to establish a centralized management association between security assets and intelligence. The privacy-preserving computing subunit is used to perform homomorphic encryption on CMDB asset IPs and threat intelligence indicators, and to complete network segment attribution and attack analysis under ciphertext, thereby achieving centralized management that is usable but invisible.

3. A data center security incident operation and maintenance system based on threat intelligence association as described in claim 2, characterized in that, The asset intelligence specific association unit incorporates a matching confidence algorithm specifically designed for secure asset-intelligence mapping, and its formula is limited to: Where C is the confidence level of the association between assets and intelligence indicators, which is dimensionless and ranges from [0,1]. The learning weights for the k-th intelligence source are assigned based on their historical hit rates over the past 30 days; these weights are dimensionless. This is a dimensionless function that determines the equivalence between asset attributes and intelligence indicators. It takes the value 1 when the IP / domain name in the CMDB is completely consistent with the active and passive intelligence, and 0 otherwise. This refers to the feature value of the k-th dimension attribute of a CMDB asset, where the k-th dimension attribute is the IP address and domain name, expressed as a network address or string. The k-th type of indicator feature value provided by the threat intelligence platform, wherein the k-th type of indicator feature value is black IP, DNS and URL, the unit is network address or string, n is the total number of attribute dimensions participating in the comparison, the unit is number, the algorithm only retains the address and string specific alignment features, and does not involve recurrent neural network or reinforcement learning general model; The multi-source threat intelligence consumption unit incorporates a comprehensive threat scoring algorithm to eliminate conflicts between multi-source intelligence and output asset risk values. Its formula is defined as follows: Where S represents the multi-source integrated threat score faced by the asset, which is dimensionless. Let be the credibility coefficient of the j-th intelligence source, assigned based on the compliance audit of information security level protection, dimensionless, and ranging from [0,1]. As an intelligence timeliness decay factor, by Confirmed, among which The decay constant is expressed in hours. -1 , This is the difference between the intelligence generation time and the current system time, in hours. denoted as the original severity of the j-th source intelligence, dimensionless, and taking the integer value from 1 to 5; m is the number of intelligence sources involved in the calculation, in units of individuals.

4. A data center security incident operation and maintenance system based on threat intelligence association as described in claim 2, characterized in that, The asset ledger and service catalog orchestration unit includes a CMDB interface synchronization subunit, an ITSM service catalog alignment subunit, and a bus permission proxy subunit: The CMDB interface synchronization subunit is used to periodically retrieve the IP, hostname, and business system affiliation fields from the asset ledger and write them into the local security information database. The ITSM service catalog alignment subunit is used to bind asset ledger software items to ITSM service catalog SLA levels to generate business dependency topologies. The bus permission agent subunit is used to obtain user roles through the data bus and map them to security asset viewing permissions, thereby achieving fine-grained isolation from a management perspective.

5. A data center security incident operation and maintenance system based on threat intelligence association as described in claim 1, characterized in that, The asset detection and association completion module includes: an active detection unit, a passive acquisition unit, a switch configuration acquisition unit, a log parsing and aggregation unit, and an information association completion unit; The active detection unit is used to execute remote IP scanning scripts using automated detection tools to identify the IP activity, open ports, open services and operating system types of newly added assets within the jurisdiction, and to determine the target device IP and port open information based on the device IP database, establish a communication connection with it, and parse feedback data packets. The passive acquisition unit is used to extract asset identification events and asset port information by mirroring the network traffic to be detected and analyzing traffic and event log data, and push it to the asset security information database. The switch configuration acquisition unit is used to log in to the switches in the jurisdiction to collect ARP table, MAC table and interface information table, and extract initial network assets to help discover new assets; The log parsing and aggregation unit is used to aggregate and merge the results of active and passive detection, improve asset information, and extract key information from the passive detection results and feed it back to the active detection unit to achieve in-depth mining of key assets. The information association and completion unit is used to align and map the newly added asset security information with other existing asset security information based on the unified asset model multi-value identifier, and to complete the missing information on open ports, services, operating system types and security status.

6. A data center security incident operation and maintenance system based on threat intelligence association as described in claim 5, characterized in that, The active detection unit includes a port dictionary dynamic optimization subunit with a built-in weight update algorithm designed for asset port detection, the formula of which is: ,in The dynamic scan priority weight of the j-th port in the target port dictionary is dimensionless. The initial preset weight for the j-th port is dimensionless. Let be the weight increment constant after each successful detection and verification, which is dimensionless. The port exposure determination function takes a value of 1 when the port is detected to be open and 0 otherwise. It is dimensionless. The active detection unit is also used to parse the device asset information data packet fed back by the target device IP, classify the asset information of the target device and determine whether it is complete. If not, the communication connection with the target device IP is re-established so that the target device feeds back the device asset information data packet again. The classification and integrity judgment steps are performed based on the newly obtained asset information to realize incremental detection. The log parsing and aggregation unit incorporates an active-passive probe cross-validation algorithm that uses a consistency metric formula and a completeness metric formula to evaluate the comprehensiveness of the probe results. The consistency metric formula... Where y represents the consistency index, in percentage. This indicates the number of network data assets detected by both active and passive detection, expressed in units of [number]. This indicates the number of network data assets detected, expressed in units. This indicates the number of items actively detected but not passively detected, expressed in units of [number]. This represents the number of items passively detected but not actively detected, expressed in units of [number]. The formula for the integrity index is: Where w represents the completeness index, in percentage. This indicates the total number of network data assets recorded in the network data asset database, expressed in units of individuals.

7. A data center security incident operation and maintenance system based on threat intelligence association as described in claim 5, characterized in that, The information association completion unit incorporates an asset attribute completion confidence algorithm and a regular expression matching classification subunit. The completion confidence formula is as follows: ,in To fill in the confidence level for missing asset attributes, dimensionless, with a value range of [0,1]. Let be the importance weight of the i-th asset attribute, which is dimensionless. This is a function to determine attribute equivalence; it returns 1 if the attributes match, otherwise 0. It is dimensionless. For the i-th dimension feature value of the newly added asset, The i-th dimension feature value of the existing asset security information database is denoted as , and m is the total number of attribute dimensions participating in the completion comparison (unit: ). The regular expression matching classification subunit is used to perform asset object field matching on the parsed asset information using regular expressions, so as to determine the category and perform targeted completion of missing information.

8. A data center security incident operation and maintenance system based on threat intelligence association as described in claim 1, characterized in that, The multi-source alarm fusion and aggregation module includes an alarm receiving and normalization unit, a fine-grained semantic fusion unit, a context enrichment and suppression unit, a user permission association aggregation unit, and a false alarm judgment subunit. The alarm receiving and normalization unit is used to receive multi-source heterogeneous fragmented alarms generated by isolated distributed security devices, unify the log format and extract the source, type, level, timestamp and asset identification fields, and unify the heterogeneous alarms into a standard structure containing source, type, severity, timestamp and host. The fine-grained semantic fusion unit is used to introduce a fine-grained alarm fusion strategy, calculate the dissimilarity of attributes between alarms according to security semantics and seamlessly fuse alarms with dissimilarity below a preset threshold to achieve alarm reduction. The context enrichment and suppression unit is used to query the CMDB based on the alarm hostname to automatically supplement the business department and person in charge, and to suppress downstream secondary alarms based on the service dependency topology. The user permission association aggregation unit is used to combine user permissions and identity information to aggregate the reduced alarms according to the business system or attack chain dimension and generate a super alarm for management to view the entire network threat and trace its source. The false alarm analysis subunit is used to classify alarms into major categories, subdivide attack methods, capture communication directions, and extract request / response load features based on a five-level classifier framework. It also combines state machine reward values ​​to determine real attacks and filter out alarms disguised as normal business operations.

9. A data center security incident operation and maintenance system based on threat intelligence correlation according to claim 8, characterized in that, The fine-grained semantic fusion unit incorporates an attribute dissimilarity algorithm specifically designed for secure semantic comparison, the formula of which is: Where D(A,B) is the degree of semantic dissimilarity between alarms A and B, which is dimensionless and ranges from [0,1]. The k-th security semantic dimension includes preset weights for attack type, source IP range, destination asset, and alarm level. These weights are dimensionless. , The normalized feature values ​​of the semantic attributes of A and B in the k-th dimension are given for alarm purposes. These are dimensionless, and t is the total number of semantic dimensions involved in the comparison, expressed in units of 1. The alarm receiving and normalization unit is equipped with a fingerprint hash algorithm designed for deduplication of multi-source alarms, the formula of which is: Where F is the alarm fingerprint identifier, in the form of a string hash value, H is a one-way hash function, source is the alarm source detector code, name is the attack or anomaly name, service is the business component to which it belongs, and environment is the deployment environment identifier, all in the form of strings. Based on this fingerprint, duplicate alarms are identified and merged within a preset time window.

10. A data center security incident operation and maintenance system based on threat intelligence correlation according to claim 8, characterized in that, The user permission association aggregation unit incorporates a super alarm generation weighting algorithm to evaluate the priority of alarm aggregation from the user's perspective. The formula is as follows: ,in The super alert is assigned a user-centric priority score, which is dimensionless. This is a user permission level coefficient, obtained from ITSM role mapping, dimensionless, and ranging from 1 to 5. The number of assets associated with a user's identity, in units of [number]. This represents the time difference between alarms originating from the same source, in seconds. The time decay constant is in seconds. This algorithm combines user permissions and identity information to generate super alarms. The context enrichment and suppression unit incorporates a service impact scoring algorithm for recalculating aggregated alarm priorities. The formula is as follows: ,in The alarm service impact score is dimensionless and ranges from 0 to 100. The weights for category b business metrics include the number of affected users, SLA level, and estimated financial losses; these weights are dimensionless. The normalized value of the corresponding indicator is dimensionless, and q is the total number of indicator dimensions in units of 1. Alarms are routed to different response channels based on the scoring results.

Images