A network security alarm intelligent processing method and device

Abstract

This invention discloses an intelligent processing method and apparatus for network security alarms, relating to the field of network security technology. The method includes: receiving raw alarm streams and performing adaptive filtering using a dynamic filtering rule set; calculating a comprehensive confidence score for alarms that pass the filtering using a multi-dimensional confidence evaluation model with dynamically adjustable weight parameters; performing causal correlation analysis on candidate alarms and their confidence scores to construct attack chains and mark real attack nodes and noisy nodes; generating rule optimization instructions and model optimization instructions based on the analysis results, dynamically updating the filtering rule set and evaluation model weights to form a closed-loop collaborative optimization; and outputting a structured attack chain report. This invention enables network security systems to possess the self-evolutionary capability to learn from misjudgments and dynamically focus on key risk indicators.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for intelligent processing of network security alarms. Background Technology

[0002] With the increasing sophistication of cyberattacks and the accelerated digitalization of enterprises, security detection systems such as intrusion detection systems, endpoint detection and response systems, and web application firewalls generate massive amounts of alerts daily, with false positive rates as high as 30%-70%. This massive noise of alerts not only drowns out real threats but also overwhelms security analysts, resulting in persistently high average detection and response times, posing a serious challenge to security operations.

[0003] Existing technologies have explored various approaches to alarm noise reduction and correlation analysis. One type of method filters alarms based on predefined static rules or statistical thresholds. While fast, this method suffers from rigid rules, failing to identify unknown threats and prone to false negatives. Another approach calculates risk scores for alarms by associating them with contextual information such as asset information and threat intelligence. However, these scoring models often rely on manually set weights, making it difficult to dynamically reflect the true importance of evidence across different attack patterns. A third approach utilizes graph computing techniques to perform causal correlation analysis on alarms to reconstruct attack paths. However, the analysis results are typically only used to generate post-incident reports, forming a separate post-incident analysis module.

[0004] However, the above methods are all open-loop systems. Once the parameters, rules, and models of each module are set, they are fixed, and the data transmission relationship between them is loose and unidirectional. They cannot form an organic intelligent system that can dynamically adapt to the adversarial environment, intelligently coordinate among components, and continuously improve overall performance. This is the underlying technical reason why the problems of alarm fatigue and slow response have been difficult to eradicate for a long time. Summary of the Invention

[0005] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a network security alarm intelligent processing method and device based on a closed-loop dynamic collaborative mechanism. By constructing a collaborative control architecture that enables processing modules at all levels to provide real-time, dynamic, and intelligent feedback, verification, and optimization to each other, the alarm processing system can use the results of deep causal analysis to correct and optimize the judgment logic and parameters of the alarm filtering module and the confidence assessment module in real time, thereby achieving synergistic enhancement and continuous evolution of processing accuracy, efficiency, and adaptive capabilities at the system level.

[0006] One aspect of the present invention provides an intelligent processing method for network security alarms, comprising the following steps: Receive the raw alarm data stream, determine whether there is a filtering rule in the dynamic filtering rule set that matches the alarm characteristics, and discard the alarm if it does. Obtain the multidimensional context information associated with each remaining alarm after discarding, convert the multidimensional context information into a multidimensional confidence vector, input the multidimensional confidence vector into a multidimensional confidence evaluation model with dynamically adjustable weight parameters, and obtain the comprehensive confidence of each alarm. Perform causal correlation analysis on each remaining alarm after it is discarded and its corresponding overall confidence level to construct the attack chain; Based on the results of causal correlation analysis, rule optimization instructions for optimizing the dynamic filtering rule set and model optimization instructions for optimizing the multidimensional confidence assessment model are generated; the rule optimization instructions and the model optimization instructions are executed to dynamically update the weight parameters of the dynamic filtering rule set and the multidimensional confidence assessment model, and the updated dynamic filtering rule set and multidimensional confidence assessment model are used for filtering new alarm data streams; Output a structured attack chain report.

[0007] In another aspect, the present invention provides a network security alarm intelligent processing device, comprising: The alarm filtering module is used to receive the raw alarm data stream, determine whether there is a filtering rule in the dynamic filtering rule set that matches the alarm characteristics, and discard the alarm if it does. The alarm confidence assessment module is used to obtain the multi-dimensional context information associated with each remaining alarm after it is discarded, convert the multi-dimensional context information into a multi-dimensional confidence vector, and input the multi-dimensional confidence vector into a multi-dimensional confidence assessment model with dynamically adjustable weight parameters to obtain the comprehensive confidence of each alarm. The causal correlation analysis module is used to perform causal correlation analysis on each remaining alarm after it is discarded and its corresponding comprehensive confidence level in order to construct an attack chain; The collaborative optimization module is used to generate rule optimization instructions for optimizing the dynamic filtering rule set and model optimization instructions for optimizing the multidimensional confidence assessment model based on the results of causal correlation analysis; execute the rule optimization instructions and the model optimization instructions to dynamically update the weight parameters of the dynamic filtering rule set and the multidimensional confidence assessment model, and use the updated dynamic filtering rule set and multidimensional confidence assessment model for filtering new alarm data streams; The report output module is used to output structured attack chain reports.

[0008] The intelligent network security alarm processing method and apparatus provided by this invention have the following beneficial effects: (1) The dynamic filtering rule set is optimized by the rule optimization instruction, so that the alarm filtering module can learn from its own misjudgment and dynamically correct the filtering rules. While maintaining high processing efficiency, the accuracy of filtering can be adaptively improved with the system running time, fundamentally reconciling the contradiction between filtering efficiency and filtering accuracy.

[0009] (2) The multidimensional confidence assessment model is optimized by model optimization instructions, so that the multidimensional confidence assessment model can dynamically focus on the most relevant risk indicators based on actual attack patterns, so that the output comprehensive confidence contains the contextual logic of the attack chain, and the sensitivity to identify complex and roundabout attacks is significantly enhanced.

[0010] (3) By integrating discrete processing modules into a complete loop of perception-cognition-decision-execution-reperception, the overall performance of the system can continuously and autonomously evolve with the accumulation of adversarial data. This is a systematic technical effect that cannot be achieved by any static, open-loop technology combination.

[0011] (4) By constructing a temporal attribute causal graph and applying a community discovery algorithm, it is possible to intelligently mine deep causal chains from massive alarms, automatically restore logically rigorous attack paths, and significantly improve the accuracy of source tracing and anti-interference capabilities.

[0012] (5) The filter rules are equipped with lifespan and hit detection, which automatically eliminates invalid rules and retains active rules, ensuring that the rule base is concise and efficient, so as to achieve the adaptive evolution of the filter engine. Attached Figure Description

[0013] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating an embodiment of the intelligent network security alarm processing method provided in this application; Figure 2 This is a schematic diagram of the structure of a network security alarm intelligent processing device provided in one embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Before elaborating on the method of this invention in detail, for ease of understanding, the key technical terms involved in this invention will first be defined: Dynamic filtering rule set: A set of alarm filtering rules that can be automatically added, deleted, and modified online. Its content can be updated in real time and incrementally through commands issued by the collaborative optimization module.

[0016] Multidimensional confidence vector: A feature vector generated for alerts using multidimensional contextual information, representing the threat credibility of the alert in different dimensions (such as asset value dimension, threat intelligence dimension, and behavioral anomaly dimension).

[0017] Multidimensional Confidence Assessment Model: A computational model for transforming multidimensional confidence vectors into a single comprehensive confidence score. The core of this model is a set of dynamically adjustable weight parameters. The dynamic adjustment of these weight parameters is achieved through model optimization instructions issued by the collaborative optimization module.

[0018] Causal correlation analysis: a deep analysis technique distinct from simple temporal or rule-based correlations. This invention constructs a temporal attribute causal graph and employs graph algorithms such as community detection and path analysis to uncover inherent causal relationships between alerts that conform to attack logic, thereby constructing a complete attack chain.

[0019] Collaborative Optimization Module: This is the intelligent hub connecting the alarm filtering module, alarm confidence assessment module, and causal correlation analysis module in this invention. It is responsible for parsing the results of causal correlation analysis, generating targeted rule optimization instructions and model optimization instructions, and scheduling their execution to drive the system to form a closed-loop evolution.

[0020] Closed-loop dynamic collaboration: This is the systematic mechanism implemented in this invention, meaning that the alarm filtering module, alarm confidence assessment module, and causal correlation analysis module no longer have a unidirectional data flow, but instead form a real-time, dynamic, and intelligent feedback closed loop. The processing result of the causal correlation analysis module is used as a truth signal and fed back to the alarm filtering module and alarm confidence assessment module in real time for their own logic and parameter optimization.

[0021] This embodiment details a method for intelligent processing of network security alarms based on closed-loop dynamic collaboration. For example... Figure 1 As shown, the method mainly includes the following steps: Step S101: Receive the original alarm data stream, determine whether there is a filtering rule in the dynamic filtering rule set that matches the alarm characteristics, and discard the alarm if there is.

[0022] This step aims to build a rule base that can be updated in real time, online, and dynamically by subsequent steps, enabling preliminary, rapid, and increasingly adaptive filtering of alarm streams.

[0023] Specifically, it first receives raw alarm data streams from multiple heterogeneous security data sources (such as intrusion detection systems, endpoint detection and response systems, web application firewalls, etc.). These raw alarms are processed by the front-end data acquisition and standardization module and converted into alarm data objects with a unified pattern. Each alarm data object contains at least key fields such as timestamp, source IP, destination IP, alarm type, and original load characteristics.

[0024] Subsequently, an adaptive filtering engine built into memory performs real-time matching on each alarm. This engine maintains a dynamic filtering rule set, which is stored in an in-memory hash table to support high-speed access. Each rule in the dynamic filtering rule set is a data structure containing multiple fields, specifically including: a rule ID for unique identification, a conditional expression for matching alarm characteristics (supporting regular expression matching and IP network segment matching), an action field for defining the action to be performed after matching (action types include discard, allow, priority marking, etc.), and a confidence threshold representing the credibility of the rule.

[0025] When the adaptive filtering engine receives an alarm, it iterates through all rules in the dynamic filtering rule set, comparing the alarm's feature fields with the matching condition expression of each rule. If a filtering rule matching the alarm's features is found, and the rule's action field is "discard," the alarm is judged as noise and immediately discarded, not proceeding to further processing. If the alarm does not match any rule, or only matches a rule with an action field of "allow" or "priority mark," the alarm is allowed and proceeds to the next processing step.

[0026] More preferably, each filtering rule in the dynamic filtering rule set also includes three fields for lifecycle management: lifespan, most recent hit timestamp, and hit count. The system's built-in rule lifecycle management module periodically scans each filtering rule in the dynamic filtering rule set and performs the following maintenance operations: (1) Silent rules are automatically eliminated If the difference between the current system time and the most recent hit timestamp of a filtering rule reaches or exceeds its set lifespan, and its hit count is zero, it indicates that the rule has not been hit by any alarms within a whole lifespan and is no longer suitable for the current alarm environment. The module will automatically delete the filtering rule to free up rule base space and maintain matching efficiency.

[0027] (2) The active rules are retained. When any filtering rule is successfully matched by an incoming alarm feature, the system triggers its corresponding action, simultaneously updates the rule's most recent hit timestamp to the current time, increments its hit count by one, and resets its lifetime to its initial value. This mechanism ensures that frequently hitting, high-value rules are retained and prevents them from being mistakenly eliminated.

[0028] The aforementioned lifecycle management mechanism endows the dynamic filtering rule set with the ability to self-purify and weed out inferior rules. It can automatically adapt to the evolution of alarm modes and attack methods without relying on manual intervention, and always maintain the simplicity, efficiency and timeliness of the rule base.

[0029] This step serves as the system's first line of defense. Its matching algorithm is designed to be lightweight and efficient, aiming to rapidly reduce massive alerts with minimal overhead, thus alleviating computational pressure for subsequent complex analysis. By introducing a dynamic filtering rule set, the filtering process is given the ability to accept feedback and continuously evolve. This dynamic filtering rule set is no longer a manually set, unchanging barrier, but a living knowledge base that can be continuously optimized by the system's internal intelligent mechanisms. This solves the technical problem of the incompatibility between accuracy and efficiency in static filtering.

[0030] Step S102: Obtain the multi-dimensional context information associated with each remaining alarm after discarding, convert the multi-dimensional context information into a multi-dimensional confidence vector, input the multi-dimensional confidence vector into a multi-dimensional confidence evaluation model with dynamically adjustable weight parameters, and obtain the comprehensive confidence of each alarm.

[0031] This step aims to address the inaccuracy caused by the fixed weights in existing assessment techniques, which fail to dynamically focus on truly relevant risk indicators. To this end, this invention generates a multidimensional confidence vector by associating multidimensional contextual information and utilizes an assessment model with dynamically adjustable weight parameters to calculate a more indicative comprehensive confidence score.

[0032] Specifically, a context assessment engine receives the remaining alerts after they have been discarded and initiates a multi-dimensional context information acquisition process. This context assessment engine integrates with or can call the application programming interfaces (APIs) of multiple external knowledge bases or systems (such as the APIs of asset management systems, threat intelligence platforms, and user behavior analysis systems) to query and acquire multi-dimensional context information related to the alert in real time. After being acquired, this multi-dimensional context information is quantified and organized into a standardized multi-dimensional confidence vector. ,in The total number of context dimensions enabled. These dimensions may include, but are not limited to: Asset Value Dimension: A floating-point number between 0 and 1, derived from the asset importance label in the configuration management database. The closer the value is to 1, the more critical the affected asset is.

[0033] Threat intelligence dimension: A floating-point number between 0 and 1, derived from the reputation query results of indicators in alerts from external threat intelligence platforms. The closer the value is to 1, the more malicious the indicator.

[0034] User behavior anomaly dimension: A floating-point number between 0 and 1, derived from the real-time deviation score between the user and entity behavior analysis system for the user or entity related to the alarm. The closer the value is to 1, the more abnormal the behavior.

[0035] Defense status dimension: A floating-point number between 0 and 1, representing whether the attack path has been mitigated or blocked by other nodes in the network. 0 indicates no mitigation, and 1 indicates complete blocking.

[0036] Next, the system invokes a multidimensional confidence assessment model. The core of this model is a set of dynamically adjustable weight vectors. The weight vector is initialized to preset values, with the sum of all weights being 1. The multidimensional confidence assessment model calculates the overall confidence of the alarm using the following formula. : After the calculation is completed, the system uses a preset high confidence threshold. and low confidence threshold The alarms are categorized. The overall confidence level is then determined. ≥ Alarms are marked as high-confidence candidates; ≤ Alarms marked as low confidence pending; others are between the threshold. and threshold Alarms are marked as medium-confidence candidates. All marked candidate alarms, along with their overall confidence score and multidimensional confidence vector, are sent to the next processing step.

[0037] This step introduces an evaluation model with dynamically adjustable weight parameters, so that the model weights are no longer fixed at once, but can be dynamically optimized according to actual attack patterns. This allows the subsequent comprehensive confidence score to more sensitively and accurately reflect the real threat level of the alert, effectively avoiding the obliteration of key signals of complex attacks caused by weight averaging.

[0038] Step S103: Perform causal correlation analysis on each remaining alarm after discarding and its corresponding comprehensive confidence level to construct the attack chain.

[0039] This step aims to utilize high-quality, weighted alert inputs to construct attack chains that go beyond simple temporal relationships and reveal deep causal connections. Its core principle is to build a temporal attribute causal graph using alerts with comprehensive confidence levels as nodes, and then leverage graph algorithms to discover high-confidence attack activity clusters and critical paths within massive datasets.

[0040] First, a temporal attribute cause-effect graph is constructed. The system uses each alarm event in the candidate alarm set output in step S102 and its associated asset entities (such as hosts, user accounts, file paths, etc.) as vertices in the temporal attribute cause-effect graph. Simultaneously, the system analyzes the relationships between vertices, using their temporal sequence, network connection, or process call relationships as directed edges, pointing from cause to effect. Each edge is accompanied by a relationship type attribute (such as trigger, access, write, execution, etc.) and a time difference. The final constructed temporal attribute cause-effect graph is a directed acyclic graph or a temporal graph, where each vertex in the graph uses the overall confidence level of the alarm as an important attribute value.

[0041] Next, the attack community is identified. In this step, the system applies community detection algorithms, such as the classic Louvain algorithm or the connected component algorithm based on temporal reachability, to segment the constructed temporal attribute causal graph. By optimizing metrics such as modularity, the algorithm automatically identifies subgraph structures in the graph that are tightly connected internally and sparsely connected externally; these subgraphs are identified as candidate attack activity clusters. Each cluster represents a set of alarms that are inherently related and may be triggered by the same attacker or the same attack activity.

[0042] Next, critical path extraction is performed. Within each candidate attack activity cluster, the system traverses all possible paths from the starting node to the ending node. For each path, the system calculates the cumulative confidence score based on the overall confidence score attribute of each vertex on the path. The cumulative confidence score can be calculated as the product of the overall confidence scores of each alarm on the path, or as their weighted sum. Then, the system selects the top N paths with the highest cumulative confidence scores and identifies these paths as high-fidelity attack chains.

[0043] Based on the constructed attack chain and community findings, the system marks alert nodes throughout the graph structure. Alert nodes located on confirmed attack chain paths are marked as actual attack nodes; these nodes constitute the core storyline of the attack. Simultaneously, nodes that do not belong to any attack activity cluster and whose overall confidence level is below the low-confidence threshold are also marked. Isolated alarm nodes are identified as noise nodes, meaning they are likely false alarms or background noise unrelated to the attack. After labeling, the labeling information of all nodes, along with the attack chain and cause-effect graph, will be passed to the core collaborative optimization step.

[0044] This step, by constructing a weighted temporal causal graph and performing community and critical path mining, achieves a leap from discrete, isolated alarm points to continuous, logical attack chains. The labels of real attack nodes and noisy nodes produced in this step are high-fidelity judgments based on a global perspective and deep causal relationships, and also serve as standard signals driving the entire system to achieve intelligent evolution.

[0045] Step S104: Based on the results of causal association analysis, generate rule optimization instructions for optimizing the dynamic filtering rule set and model optimization instructions for optimizing the multidimensional confidence assessment model; execute the rule optimization instructions and the model optimization instructions to dynamically update the weight parameters of the dynamic filtering rule set and the multidimensional confidence assessment model, and use the updated dynamic filtering rule set and multidimensional confidence assessment model for filtering new alarm data streams.

[0046] This step aims to address the problem of isolated modules and the inability to evolve collaboratively in existing technologies. It enables the system to reflect on and learn from the results of deep analysis. Its core principle is: a collaborative optimization controller continuously receives the causal correlation analysis results produced in step S103, generates structured optimization instructions according to predefined strategies, and atomically executes closed-loop optimization of the dynamic filtering rule set and the multidimensional confidence assessment model.

[0047] Specifically, the collaborative optimization controller receives the constructed attack chain and a set of alarms marked with real attack nodes or noisy nodes. Based on this information, the collaborative optimization controller constructs rule-based optimization instructions and model-based optimization instructions according to preset optimization instruction generation rules.

[0048] (1) Generate rule optimization instructions and construct the feedback path from step S103 to step S101. This path is designed to enable the alarm rule filtering module to learn from its own misjudgments (missed reports, false reports).

[0049] False Negative Detection Correction Learning Mechanism: The collaborative optimization controller analyzes all alarms identified as genuine attack nodes. If an alarm of this type is found whose characteristics (such as source IP and alarm type combination) exactly match the matching condition expression of a discard rule in the dynamic filtering rule set, then a false negative has occurred. This means that the genuine attack clue was incorrectly filtered. To solve this problem, the collaborative optimization controller generates a false negative correction instruction for this rule. This instruction performs at least one of the following operations: relaxing the filtering rule condition, adding an exception condition to the filtering rule (such as adding an exception source IP whitelist), or lowering the priority of the filtering rule. By executing this instruction, similar genuine attack clues will no longer be mistakenly deleted in the future.

[0050] False Alarm Correction Learning Mechanism: The Cooperative Optimization Controller analyzes all alarms marked as noisy nodes. When at least K (K is a configurable integer) such noisy alarms are found, sharing the same alarm type and having similar dimensional characteristics (e.g., similar source IP ranges, or the same classless inter-domain routing prefixes), the Cooperative Optimization Controller determines that these alarms constitute a new, filterable noise pattern. To address this issue, the Cooperative Optimization Controller generates a false alarm correction instruction. This instruction is used to: tighten the threshold of the existing filtering rule if the noise pattern can be covered by the conditional expression of an existing filtering rule but does not trigger a drop action (e.g., lower its confidence threshold or narrow the matching range) to make it easier to filter such noise; if no existing rule can be tightened, the instruction adds a drop rule with matching conditions that simultaneously satisfy the alarm type and the IP range, sets an initial confidence threshold for it, and records the reason for rule creation as automatic false alarm learning. By executing the false alarm correction instruction, such a large number of repetitive noises will be efficiently filtered at the first line of defense, thereby improving the overall system processing efficiency.

[0051] (2) Generate model optimization instructions and construct the feedback path from step S103 to step S102. This path aims to make the multi-dimensional confidence assessment model dynamically focus on the most relevant risk features.

[0052] First, the collaborative optimization controller, based on the attack chain constructed by the causal correlation analysis module, statistically analyzes the frequency of different context feature combinations in all alarms marked as real attack behaviors. The context feature combination refers to the co-occurrence of specific value patterns in two or more dimensions of the multidimensional confidence vector. When the frequency of a certain context feature combination exceeds a preset threshold, it indicates that the combination is highly indicative of a real attack. The collaborative optimization controller then generates a weight adjustment instruction to increase the calculation weight of the feature dimension corresponding to that context feature combination in the multidimensional confidence evaluation model. For example, if the combination of access from a specific geographical location and login at an infrequent time occurs frequently in real attacks, the weights of the geographical location dimension and the time dimension are increased respectively. After weight adjustment, all weights are normalized to ensure that the sum of the adjusted weights is 1. This mechanism enables the evaluation model to automatically focus on the most discriminative feature combinations verified in practice, significantly enhancing the sensitivity to complex and circuitous attacks.

[0053] Next, the collaborative optimization controller, based on the attack chain constructed by the causal correlation analysis module, statistically analyzes the frequency of different attack sequence patterns in all alarms marked as genuine attack behaviors. The attack sequence pattern refers to a recurring sequence of alarm types with a fixed order within the attack chain (e.g., suspicious process creation → abnormal file modification). When the frequency of a certain attack sequence pattern exceeds a preset threshold, the collaborative optimization controller determines it as a stable attack behavior template and generates a correlation reinforcement instruction. This instruction is used to register a correlation rule in the multi-dimensional confidence assessment model. Subsequently, during subsequent evaluations, when the model detects the occurrence of a preceding event of this attack sequence pattern, the correlation rule is triggered, providing correlation bonuses for the confidence calculation of subsequent events. This mechanism endows the confidence assessment model with the ability to memorize attack patterns, enabling its confidence output to contain the contextual logic of the attack chain, achieving early, highly sensitive detection of progressive attacks.

[0054] Then, after generating all the aforementioned optimization instructions, the collaborative optimization controller places them into an instruction queue and executes them asynchronously and non-blockingly in a first-in, first-out (FIFO) order. It calls the rule base interface of the adaptive filtering engine to update the dynamic filtering rule set; simultaneously, it calls the model interface of the context evaluation engine to update the weight vector and association rules. Once all update operations are complete, the updated dynamic filtering rule set and multi-dimensional confidence evaluation model are immediately hot-loaded and applied to process subsequent new alarm data streams.

[0055] This step, by constructing closed-loop feedback paths (rule optimization) from steps S103 to S101 and (model optimization) from steps S103 to S102, couples the previously fragmented alarm processing modules into a co-evolving organic whole. This enables the system to learn from the final processing results and automatically correct and improve its front-end processing logic for the first time, achieving a systematic effect where overall performance continuously improves with runtime.

[0056] Step S105: Output a structured attack chain report.

[0057] While completing the aforementioned closed-loop optimization process, the report output module formats the high-fidelity attack chain verified by causal correlation analysis, generating a structured attack chain report. This report can be in both machine-readable and human-readable format, and its content includes at least: a detailed description of each stage of the attack (e.g., initial access, execution, persistence, lateral movement, target achievement), a list of involved assets (hosts, accounts), a timestamp sequence of key attack events, and recommended actions. This report can be directly sent to security analysts or used as input for automated response systems.

[0058] The following ransomware attack scenario comprehensively demonstrates the closed-loop dynamic collaborative process of the method of this invention. This embodiment is merely an example and is not intended to limit the scope of application of this invention.

[0059] Scenario: A company has deployed the system of this invention. In its initial state, the system loads preset basic filtering rules and initial weight vector values. There is one office host (Host-A) and one internal file server (Server-B) on the network. An attacker sends ransomware to Host-A via phishing emails and attempts to spread it to Server-B.

[0060] 1. First round of attack After an employee accidentally clicked on a phishing email, the endpoint detection and response system generated alarm A1 on Host-A: Suspicious email attachment execution detected, with characteristics F1 including a specific process name and network domain name. The system also generated other routine noise alarms, such as too many failed login attempts on Host-C.

[0061] Alert A1 (signature F1) enters the adaptive filtering engine. Due to the novelty of the attack method, signature F1 partially matches a somewhat ambiguous rule R1 in the dynamic filtering rule set, which is used to filter low-suspicious emails. However, because it does not fully match the specific conditions, it is not immediately discarded, but is marked with a lower priority. The noisy alert "Login Failed" is matched and discarded by another explicit filtering rule.

[0062] Alert A1, after filtering, enters the context evaluation engine. The system queries the threat intelligence platform and finds the domain reputation in A1 to be unknown; it also queries the user behavior analysis system and finds the user behavior deviation to be moderate. Ultimately, alert A1 scores low in the threat intelligence and behavioral anomaly dimensions, only achieving a moderate score in the asset value dimension (Host-A is marked as a host belonging to a regular R&D personnel). The overall confidence level C_A1 is calculated to be 0.55, falling into the medium confidence candidate range.

[0063] Subsequently, the ransomware ransomware ran on Host-A, generating alert A2: a large number of file extensions were abnormally modified (feature F2), and alert A3: abnormal encrypted traffic was initiated to port 445 of Server-B (feature F3). In the system's evaluation of F2 and F3, due to their very clear behavior, they scored highly in the behavioral anomaly dimension, with overall confidence scores C_A2 and C_A3 both exceeding 0.9, and were marked as high-confidence candidates. All candidate alerts were sent to the causal correlation analysis module.

[0064] The causal association analysis module uses Host-A as the core vertex, constructing a tight subgraph of A1, A2, A3, and their associated processes and file entities. A1 (process creation) → A2 (file modification) → A3 (network connection) forms a clear causal chain. The community detection algorithm identifies this as an attack activity cluster, and critical path extraction confirms a high-confidence attack chain from A1 to A3. Based on this, the system marks A1, A2, and A3 as the actual attack nodes.

[0065] Upon receiving the above analysis results, the collaborative optimization controller triggers the following optimization actions: (1) Missed Alarm Correction. The Cooperative Optimization Controller discovered that alarm A1, which was the starting point of the attack chain, was almost filtered by rule R1. In order to avoid similar attacks being blocked in the future, the Cooperative Optimization Controller generated a missed alarm correction instruction, which added an exception condition to rule R1, adding the specific domain name in feature F1 to the exception list, thereby ensuring that alarms matching F1 in the future can pass with higher priority.

[0066] (2) Model Optimization. Backtracking analysis of the controller revealed that in this type of attack, the abnormal file behavior dimension (the dimension associated with feature F2) is crucial for identifying the core malicious behavior. Therefore, a model weighting instruction was generated to significantly increase the weight of this dimension. Next, the collaborative optimization controller identified a strongly correlated sequence in the attack chain: process creation (A1) → file modification (A2). Therefore, a correlation strengthening instruction was generated, and a correlation rule was registered: when a suspicious process creation event similar to feature A1 is detected again, confidence scores are added to the related file modification event in subsequent evaluations.

[0067] (3) Instruction execution. The collaborative optimization controller executes these optimization instructions, updating the weights of the dynamic filtering rule set and the confidence evaluation model.

[0068] 2. Second round of attack The same attacker later used a similar method to send phishing emails to members of another host, Host-D.

[0069] Alarm A1' was generated on Host-D, and its characteristics F1' are very similar to F1 (same domain name, similar process).

[0070] When A1' enters the filtering engine, because the exception condition added to rule R1 in the previous round of optimization has taken effect, A1' is accurately identified and allowed to pass, and is marked with high priority to enter the next stage.

[0071] The system detected alarm A1' and temporarily stored its context. When the attack progressed to the file encryption stage and generated an alarm A2' similar to A2, the association rules registered in the previous round were triggered, giving A2' an additional association score ΔC. Simultaneously, because the weight of the abnormal file behavior dimension had been increased, A2''s own high-dimensional score contributed more to the overall confidence score. Ultimately, A2's overall confidence score C_A2' was significantly higher than its score in the first round, and it was marked as a high-confidence candidate early in the attack's spread.

[0072] The causal correlation analysis module aggregates higher-confidence inputs at a faster speed, almost instantly confirming the attack chain of ransomware proliferation. This allows the system to output precise alerts to the security operations team or automated response system much earlier, before the attack impacts Server-B, triggering emergency isolation of Host-D.

[0073] 3. Continuous Evolution The aforementioned closed-loop process of perception, judgment, decision-making, and optimization is continuously repeated during system operation. As the number of attacks and alerts processed increases, the dynamic filtering rule set will be consolidated into a highly optimized noise reduction knowledge base for its specific network environment, and the weights of the multi-dimensional confidence assessment model will also approach the optimal configuration. The system's overall early warning capability, signal-to-noise ratio, and processing efficiency against advanced threats will continue to improve over time.

[0074] See Figure 2 Another embodiment of the present invention provides a network security alarm intelligent processing device 200, including an alarm filtering module 201, an alarm confidence assessment module 202, a causal correlation analysis module 203, a collaborative optimization module 204, and a report output module 205. The network security alarm intelligent processing device 200 is capable of executing the network security alarm intelligent processing method in the method embodiment.

[0075] Specifically, the network security alarm intelligent processing device 200 includes: The alarm filtering module 201 is used to receive the original alarm data stream, determine whether there is a filtering rule in the dynamic filtering rule set that matches the alarm characteristics, and discard the alarm if it does. The alarm confidence assessment module 202 is used to obtain the multi-dimensional context information associated with each remaining alarm after it is discarded, convert the multi-dimensional context information into a multi-dimensional confidence vector, and input the multi-dimensional confidence vector into a multi-dimensional confidence assessment model with dynamically adjustable weight parameters to obtain the comprehensive confidence of each alarm. The causal correlation analysis module 203 is used to perform causal correlation analysis on each remaining alarm after it is discarded and its corresponding comprehensive confidence level in order to construct an attack chain; The collaborative optimization module 204 is used to generate rule optimization instructions for optimizing the dynamic filtering rule set and model optimization instructions for optimizing the multidimensional confidence assessment model based on the results of causal correlation analysis; execute the rule optimization instructions and the model optimization instructions to dynamically update the weight parameters of the dynamic filtering rule set and the multidimensional confidence assessment model, and use the updated dynamic filtering rule set and multidimensional confidence assessment model for filtering new alarm data streams; Report output module 205 is used to output a structured attack chain report.

[0076] It should be noted that the network security alarm intelligent processing device 200 provided in this embodiment corresponds to the technical solutions that can be used to execute various method embodiments. Its implementation principle and technical effect are similar to the methods, and will not be repeated here.

[0077] Figure 3 This is a schematic diagram of the structure of an electronic device 300 provided in another embodiment of the present invention. The electronic device 300 is used to implement the intelligent network security alarm processing method in the method embodiment. The electronic device 300 in the embodiments of the present invention may include, but is not limited to, smartphones, tablet computers, PCs, laptops, etc. Figure 3 The electronic device 300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0078] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments described herein, based on a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing device 301, ROM 302, and RAM 303 are interconnected via a bus 305. An input / output (I / O) interface 304 is also connected to the bus 305.

[0079] Typically, the following devices can be connected to I / O interface 304: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0080] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method for intelligent processing of network security alarms, characterized in that, Includes the following steps: Receive the raw alarm data stream, determine whether there is a filtering rule in the dynamic filtering rule set that matches the alarm characteristics, and discard the alarm if it does. Obtain the multidimensional context information associated with each remaining alarm after discarding, convert the multidimensional context information into a multidimensional confidence vector, input the multidimensional confidence vector into a multidimensional confidence evaluation model with dynamically adjustable weight parameters, and obtain the comprehensive confidence of each alarm. Perform causal correlation analysis on each remaining alarm after it is discarded and its corresponding overall confidence level to construct the attack chain; Based on the results of causal correlation analysis, rule optimization instructions for optimizing the dynamic filtering rule set and model optimization instructions for optimizing the multidimensional confidence assessment model are generated; the rule optimization instructions and the model optimization instructions are executed to dynamically update the weight parameters of the dynamic filtering rule set and the multidimensional confidence assessment model, and the updated dynamic filtering rule set and multidimensional confidence assessment model are used for filtering new alarm data streams; Output a structured attack chain report.

2. The intelligent processing method for network security alarms according to claim 1, characterized in that, The step of generating rule optimization instructions for optimizing the dynamic filtering rule set includes: When an incomplete attack chain exists in the result of the causal association analysis, and the attack chain is inferred to be missing a preceding alarm node based on the attack logic, when the feature of the missing preceding alarm node matches a certain filtering rule in the dynamic filtering rule set, a false negative correction instruction is generated for that filtering rule; the false negative correction instruction is used to perform at least one of the following operations: relaxing the conditions of the filtering rule, adding an exception condition to the filtering rule, and reducing the priority of the filtering rule. When the causal correlation analysis results show multiple noisy alarms that are determined to be unrelated to the attack chain, and the number of noisy alarms reaches a preset threshold, and the multiple noisy alarms share the same alarm type and similar feature dimensions, a false alarm correction instruction is generated for the dynamic filtering rule set; the false alarm correction instruction is used to execute new filtering rules and / or tighten the threshold of existing filtering rules.

3. The intelligent processing method for network security alarms according to claim 2, characterized in that, The step of generating model optimization instructions for optimizing the multidimensional confidence assessment model includes: The attack chain constructed based on causal association analysis is statistically analyzed to determine the frequency of different context feature combinations in alarms marked as real attack behaviors. When the frequency of a certain context feature combination exceeds a preset threshold, a weighting instruction is generated to increase the calculation weight of the feature dimension corresponding to that context feature combination in the multidimensional confidence assessment model. Furthermore, based on the attack chain constructed by causal association analysis, the frequency of different attack sequence patterns in alarms marked as real attack behaviors is statistically analyzed. When the frequency of a certain attack sequence pattern exceeds a preset threshold, an association strengthening instruction is generated for registering association rules in the multidimensional confidence evaluation model. The association rule is used to provide a correlation score for the confidence calculation of subsequent events when the preceding event of the attack sequence pattern is detected in subsequent evaluations.

4. The intelligent processing method for network security alarms according to claim 1, characterized in that, The step of performing causal correlation analysis on each remaining alarm after discarding and its corresponding comprehensive confidence level to construct an attack chain includes: A time-series attribute cause-effect graph is constructed based on each remaining alarm after being discarded and its corresponding comprehensive confidence level. The time-series attribute cause-effect graph uses each alarm event and its associated asset entity as vertices, the temporal sequence relationship, network connection relationship or process call relationship between alarm events as directed edges, and the comprehensive confidence level of each alarm as the attribute value of the corresponding vertex. The community detection algorithm is used to identify communities in the temporal attribute causal graph and each community is used as a candidate cluster of attack activities. Within each candidate attack activity cluster, the cumulative confidence score is calculated based on the overall confidence score of each alarm on the path, and the path whose cumulative confidence score meets the preset conditions is selected as the attack chain.

5. The intelligent processing method for network security alarms according to claim 1, characterized in that, Also includes: Periodically scan each filtering rule in the dynamic filtering rule set, which has records of lifespan, most recent hit timestamp, and hit count; If the difference between the current time of a filtering rule and the most recent hit timestamp reaches or exceeds the lifetime, and the hit count is zero, then the filtering rule is deleted; when any filtering rule is matched with an alarm, the most recent hit timestamp of the filtering rule is updated, the hit count is incremented by one, and the lifetime is reset to the initial value.

6. A network security alarm intelligent processing device, characterized in that, include: The alarm filtering module is used to receive the raw alarm data stream, determine whether there is a filtering rule in the dynamic filtering rule set that matches the alarm characteristics, and discard the alarm if it does. The alarm confidence assessment module is used to obtain the multi-dimensional context information associated with each remaining alarm after it is discarded, convert the multi-dimensional context information into a multi-dimensional confidence vector, and input the multi-dimensional confidence vector into a multi-dimensional confidence assessment model with dynamically adjustable weight parameters to obtain the comprehensive confidence of each alarm. The causal correlation analysis module is used to perform causal correlation analysis on each remaining alarm after it is discarded and its corresponding comprehensive confidence level in order to construct an attack chain; The collaborative optimization module is used to generate rule optimization instructions for optimizing the dynamic filtering rule set and model optimization instructions for optimizing the multidimensional confidence assessment model based on the results of causal correlation analysis; execute the rule optimization instructions and the model optimization instructions to dynamically update the weight parameters of the dynamic filtering rule set and the multidimensional confidence assessment model, and use the updated dynamic filtering rule set and multidimensional confidence assessment model for filtering new alarm data streams; The report output module is used to output structured attack chain reports.

7. The intelligent network security alarm processing device according to claim 6, characterized in that, The collaborative optimization module is further used for: When an incomplete attack chain exists in the result of the causal association analysis, and the attack chain is inferred to be missing a preceding alarm node based on the attack logic, when the feature of the missing preceding alarm node matches a certain filtering rule in the dynamic filtering rule set, a false negative correction instruction is generated for that filtering rule; the false negative correction instruction is used to perform at least one of the following operations: relaxing the conditions of the filtering rule, adding an exception condition to the filtering rule, and reducing the priority of the filtering rule. When the causal correlation analysis results show multiple noisy alarms that are determined to be unrelated to the attack chain, and the number of noisy alarms reaches a preset threshold, and the multiple noisy alarms share the same alarm type and similar feature dimensions, a false alarm correction instruction is generated for the dynamic filtering rule set; the false alarm correction instruction is used to execute new filtering rules and / or tighten the threshold of existing filtering rules.

8. The intelligent network security alarm processing device according to claim 7, characterized in that, The collaborative optimization module is further used for: The attack chain constructed based on causal association analysis is statistically analyzed to determine the frequency of different context feature combinations in alarms marked as real attack behaviors. When the frequency of a certain context feature combination exceeds a preset threshold, a weighting instruction is generated to increase the calculation weight of the feature dimension corresponding to that context feature combination in the multidimensional confidence assessment model. Furthermore, based on the attack chain constructed by causal association analysis, the frequency of different attack sequence patterns in alarms marked as real attack behaviors is statistically analyzed. When the frequency of a certain attack sequence pattern exceeds a preset threshold, an association strengthening instruction is generated for registering association rules in the multidimensional confidence evaluation model. The association rule is used to provide a correlation score for the confidence calculation of subsequent events when the preceding event of the attack sequence pattern is detected in subsequent evaluations.

9. The intelligent network security alarm processing device according to claim 6, characterized in that, The causal correlation analysis module is further used for: A time-series attribute cause-effect graph is constructed based on each remaining alarm after being discarded and its corresponding comprehensive confidence level. The time-series attribute cause-effect graph uses each alarm event and its associated asset entity as vertices, the temporal sequence relationship, network connection relationship or process call relationship between alarm events as directed edges, and the comprehensive confidence level of each alarm as the attribute value of the corresponding vertex. The community detection algorithm is used to identify communities in the temporal attribute causal graph and each community is used as a candidate cluster of attack activities. Within each candidate attack activity cluster, the cumulative confidence score is calculated based on the overall confidence score of each alarm on the path, and the path whose cumulative confidence score meets the preset conditions is selected as the attack chain.

10. The intelligent processing device for network security alarms according to claim 6, characterized in that, It also includes a rule lifecycle management module, used for: Periodically scan each filtering rule in the dynamic filtering rule set. Each filtering rule has a lifespan, a recent hit timestamp, and a hit count record. If the difference between the current time of a filtering rule and the recent hit timestamp reaches or exceeds the lifespan, and the hit count is zero, then the filtering rule is deleted. When any filtering rule is matched with an alarm, update the recent hit timestamp of the filtering rule, increment the hit count by one, and reset the lifespan to its initial value.

Images