A network security log noise reduction method, device, equipment and storage medium

Abstract

The network security log noise reduction method, device and equipment and storage medium of the present application first standardize the multi-source security alarm, form a structured security event set, then construct an entity relationship graph based on the event set, use the graph to analyze the correlation of the events, identify the potential abnormal event chain, then evaluate the risk of the abnormal event chain, filter out the high-confidence attack chain, and generate a security event report containing attack intent and disposal suggestions based on this. The present application can intelligently identify the potential correlation between events from discrete mass alarms through context correlation analysis based on the entity relationship graph, thereby linking apparently unrelated alarms into meaningful attack chains. This process effectively distinguishes background noise from real threats, realizes intelligent noise reduction of security logs, and further improves the accuracy of threat determination through risk assessment, avoiding false positives.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, apparatus, device, and storage medium for network security log noise reduction. Background Technology

[0002] With the rapid development and widespread adoption of information technology, the infrastructure and business systems of various organizations are increasingly reliant on cyberspace. However, while the internet brings convenience, it also faces severe security challenges. Malicious attackers are constantly evolving their attack methods, making cybersecurity threats more persistent and complex, thus ensuring cyberspace security has become a crucial task.

[0003] To combat the ever-evolving security threats, various network security devices and systems, such as firewalls and intrusion detection systems, are widely deployed at critical network nodes. These systems generate a large volume of security alert logs by monitoring network traffic and system activity in real time, providing security analysts with clues about potential threats. However, in actual operation, these alerts, originating from devices from different vendors and of different types, vary in format and are fragmented, resulting in an extremely large amount of data that security operations centers need to process daily. Faced with such massive, heterogeneous, and noisy security alert data, security analysts find it difficult to effectively identify truly threatening attack clues from this chaotic alert data manually.

[0004] Therefore, how to effectively identify high-value attack clues from massive and chaotic raw alerts is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0005] The present invention provides a network security log noise reduction method, apparatus, device, and storage medium, which can at least solve one of the technical problems in the background art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: A method for noise reduction in network security logs includes the following steps: S10. Based on the multi-source security alarm data, obtain a set of structured security events; S20. Based on the predefined core resource record table and the structured security event set, generate an asset event context network; S30. Based on the asset event context network, perform abnormal event identification on each event in the structured security event set to obtain an abnormal event chain; S40. Perform a threat confidence assessment on the abnormal event chain to obtain the risk assessment result of the abnormal event chain, and determine the abnormal event chain with a confidence level higher than the threshold as a high-confidence attack chain; S50. Generate a security incident report based on the multi-source security alarm data corresponding to the high-confidence attack chain.

[0007] As a preferred embodiment of the network security log noise reduction method of the present invention, step S10 specifically includes the following steps: S101. Perform event parsing on each original security log in the multi-source security alarm data to obtain security event type information and security event entity information. The security event entity information includes at least the source entity identifier and the destination entity identifier. S102. Generate an event type identifier and an event timestamp based on the security event type information; S103. Construct a structured security event from the original security log based on the event type identifier, event timestamp, and security event entity information; S104. Summarize the structured security events of each original security log to obtain the structured security event set.

[0008] As a preferred embodiment of the network security log noise reduction method of the present invention, step S20 specifically includes the following steps: S201. Generate a global relationship graph based on the entity connection relationships in the structured security event set; S202. Based on the core resource record table, determine the core asset nodes in the global relationship diagram; S203. Taking the core asset node as the center, extract its associated entities and corresponding event nodes to form an initial context graph; S204. Calculate the association strength between each associated entity and the core asset node in the initial context graph, and update the structure of the initial context graph according to the association strength to obtain the asset event context network.

[0009] As a preferred embodiment of the network security log noise reduction method of the present invention, step S30 specifically includes the following steps: S301. Under the topological constraints of the asset event context network, select events that have a path related to the core asset from the structured security event set to obtain the event set to be analyzed. S302. Sort the events in the set of events to be analyzed by timestamp, and perform time-series correlation according to a preset time continuity threshold to generate a candidate event timeline. S303. Based on the compliant interaction flow between entities defined in the asset event context network, perform compliance verification on the flow path of events in the candidate event timeline to obtain a compliant event flow; S304. Based on the predefined attack patterns in the attack behavior knowledge base, perform pattern matching on the compliant event flow to identify continuous event subsequences with abnormal interaction intent characteristics. S305. Perform causal logic consistency verification on the event subsequence, and take the continuous event subsequence that passes the verification as the abnormal event chain.

[0010] As a preferred embodiment of the network security log noise reduction method of the present invention, step S304 specifically includes the following steps: Based on the metadata of each security event in the compliance event stream, behavioral features are extracted and formatted to obtain a standardized sequence of behavioral features. Based on the time sequence of the compliance event flow, the standardized behavioral feature sequence is sorted and reorganized to obtain a time-sequential behavioral feature chain; The temporalized behavioral feature chain is compared with the predefined suspicious behavioral patterns in the behavioral knowledge base, and the similarity score between the behavioral feature chain and each suspicious behavioral pattern in the interaction intent dimension is calculated. Based on the similarity scores, behavioral intent confidence is fused to obtain the overall confidence of the temporal behavioral feature chain representing abnormal interaction intent; The overall confidence level is compared with a preset judgment threshold, and the continuous event sequences that meet the confidence level are identified and output as continuous event subsequences with abnormal interaction intent characteristics.

[0011] As a preferred embodiment of the network security log noise reduction method of the present invention, step S40 specifically includes the following steps: Based on the abnormal event chain, attack behavior is deduced to identify the key entity nodes that successfully execute the attack behavior in the abnormal event chain. Obtain the security configuration information of the key entity node, as well as the security case records corresponding to the entity type to which the key entity node belongs; Based on the security configuration information, a simulated attack was performed on the key entity node to obtain a defense strength score; Based on the security case records corresponding to the entity type to which the key entity node belongs, the historical defense record score is obtained; The risk assessment result of the abnormal event chain is obtained based on the defense strength score and the historical defense record score.

[0012] As a preferred embodiment of the network security log noise reduction method of the present invention, step S50 specifically includes the following steps: Based on the asset event context network, the interaction trajectory of the high-trust threat activity within it is reconstructed; Based on the interaction trajectory, generate an activity process summary; Extract raw alert data related to the high-confidence threat activities as supporting evidence; Based on the activity process summary and supporting evidence, generate an analysis report that includes a timeline, scope of impact, and recommendations for handling the situation.

[0013] A network security log noise reduction device based on alarm aggregation and correlation analysis includes: The data preprocessing module is used to obtain a structured set of security events based on multi-source security alarm data; The graph construction module is used to generate an asset event context network based on a predefined core resource record table and the structured security event set. The correlation analysis module is used to identify abnormal events in each event in the structured security event set based on the asset event context network, and obtain an abnormal event chain. The risk assessment module is used to assess the threat confidence of the abnormal event chain, obtain the risk assessment result of the abnormal event chain, and determine the abnormal event chain with a confidence level higher than the threshold as a high-confidence attack chain; The event report generation module is used to generate a security event report based on the multi-source security alarm data corresponding to the high-confidence attack chain.

[0014] In another aspect, the present invention also discloses a computer device, including a memory and a processor, the memory, the processor, and a network security log noise reduction program based on alarm aggregation and correlation analysis stored on the memory and running on the processor, such that the processor performs the steps of the above method.

[0015] In another aspect, the present invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method described above.

[0016] The beneficial effects of this invention are: This method first standardizes heterogeneous alarm data from different security components to form a unified set of security events. Then, it models entity relationships based on this set to construct a graph reflecting the interaction relationships between network entities. Next, it uses the contextual information of the graph to perform correlation analysis on security events and generate anomaly event chains that represent potential attack paths. Then, it performs multi-dimensional risk assessment on the anomaly event chains and selects high-confidence attack chains based on the assessment results. Finally, it generates detailed security event reports and handling recommendations based on the high-confidence attack chains.

[0017] This invention employs an entity relationship graph as a global context model for deep correlation analysis, thereby intelligently identifying attack sequences with inherent logical connections from massive and scattered security alerts. This process effectively filters out a large amount of irrelevant or low-risk alert noise, significantly improving the signal-to-noise ratio of threat detection. Furthermore, by conducting a comprehensive risk assessment of the attack chain, it ensures high reliability of the output results, reduces the interference of false alarms on security analysts, and, combined with automatically generated structured attack chain reports, presents the analysis results intuitively and systematically, directly assisting security personnel in quickly understanding the full picture of the attack and making effective responses, thus improving the overall efficiency of security operations and the accuracy of threat response. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating an embodiment of the network security log noise reduction method, apparatus, device, and storage medium of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the network security log noise reduction method, apparatus, device, and storage medium of this application. Figure 3 This is a flowchart illustrating Embodiment 3 of the network security log noise reduction method, apparatus, device, and storage medium of this application. Figure 4 This is a flowchart illustrating Embodiment 4 of the network security log noise reduction method, apparatus, device, and storage medium of this application. Figure 5 This is a schematic diagram of the module structure of the network security log noise reduction device based on alarm aggregation and correlation analysis according to an embodiment of this application; Figure 6 This is a schematic diagram of the hardware operating environment involved in the network security log noise reduction method, apparatus, device, and storage medium in the embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0020] This application first standardizes heterogeneous alarm data from different security components to form a unified set of security events. Then, based on this set, entity relationship modeling is performed to construct a graph reflecting the interaction relationships between network entities. Next, the contextual information of the graph is used to perform correlation analysis on security events, generating anomaly event chains representing potential attack paths. Then, a multi-dimensional risk assessment is performed on the anomaly event chains, and high-confidence attack chains are selected based on the assessment results. Finally, a detailed security incident report and handling recommendations are generated based on the high-confidence attack chains.

[0021] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or a network security log noise reduction device based on alarm aggregation and correlation analysis capable of achieving the above functions. The following description uses a network security log noise reduction device based on alarm aggregation and correlation analysis as an example to illustrate this embodiment and the subsequent embodiments.

[0022] Example 1 This embodiment provides a method for noise reduction of network security logs, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the network security log noise reduction method of this application.

[0023] In this embodiment, the network security log noise reduction method includes steps S10 to S50: Step S10: Obtain a structured security event set based on multi-source security alarm data.

[0024] It's important to note that multi-source security alert data refers to raw logs and alarm information generated by different types of security devices or software systems within the network, such as blocking records from intrusion detection systems, policy hit logs from firewalls, and abnormal behavior events reported by endpoint security management software. This raw data typically varies significantly in format, field definitions, and level of detail, and may contain a large number of redundant, invalid, or even incorrectly formatted entries, making it unsuitable for direct, efficient correlation analysis. The task of this step is to transform these heterogeneous, unstructured raw inputs into a clean, structured set of security events with uniform field definitions through a series of automated processing steps.

[0025] Understandably, this processing mainly includes key steps such as data parsing, key information extraction, standardized mapping, and event aggregation. Data parsing refers to identifying and understanding the unique log formats of different data sources, extracting meaningful text or key-value pairs. Subsequently, the system extracts core attributes crucial for security analysis from the parsed data, such as timestamps, source and destination network addresses, operation types, and related subject objects. Next is standardized mapping, a process of unifying the same concepts from different data sources with varying expressions into a standardized vocabulary. For example, "denied" in one brand's firewall logs and "blocked successfully" in another brand's intrusion prevention system logs are uniformly mapped to the standard operation type "blocked." Finally, duplicate alerts involving the same subject and action within a time window can be reasonably aggregated to reduce the total amount of data and highlight their frequency characteristics.

[0026] It should be understood that, after the above processing, each event in the final structured security event set follows a predefined, unified data model. For example, a processed event might clearly indicate that at a precise moment, a specific external network address initiated a failed password authentication attempt against an internal network server. Another example might be that, within a certain time period, an internal office host attempted to establish a large number of abnormal network connections to multiple different external addresses. These events are no longer chaotic raw messages, but rather structured records containing standardized elements such as time, subject, object, action, and result, laying a solid and consistent data foundation for subsequently constructing a network entity relationship graph.

[0027] Step S20: Generate an asset event context network based on a predefined core resource record table and a structured security event set.

[0028] It should be noted that this step aims to transform and organize the discrete security events obtained in the previous stage into a dynamic knowledge network that can characterize the interrelationships and behavioral patterns of various elements in the network. Entity relationship modeling refers to automatically identifying the core objects involved in each structured security event and the specific interactions between them. An entity refers to an important object in the network environment that can be uniquely identified and tracked, such as user accounts, computing devices, application processes, files, or data resources. Entity relationships describe the dynamic associations between entities in a specific security event, such as a user logging into a server through a specific network address, or a process creating an executable file on a host.

[0029] Understandably, the system traverses the structured security event set, creating or updating the corresponding node in the graph for each entity identified in the event. Simultaneously, based on the interaction behavior described by the event, it establishes a directional and attribute-based relationship edge between the related entity nodes. For example, from a login failure event, "User Entity A," "Source Address Entity B," and "Target Host Entity C" can be extracted, and a relationship edge can be established from Entity B to Entity C, with the type "attempted login" and the result "failed." As a large number of events are continuously added, the scattered points and lines gradually connect, forming an evolving and increasingly rich network topology graph. This graph not only statically displays which entities exist in the network, but more importantly, dynamically records the historical behavioral sequences between them, thus providing crucial context for understanding the significance of a single event within the overall network activity.

[0030] Step S30: Based on the asset event context network, identify abnormal events for each event in the structured security event set to obtain an abnormal event chain.

[0031] It's important to note that this analysis process places each new or historical structured security event within a macro-level network—the entity relationship graph—for evaluation. The system examines the existing connections and historical behavioral patterns of the entity nodes involved in the event within the graph, determining whether it's related to any observed anomalous behavior or whether it's part of a longer attack path. For example, a seemingly ordinary event of an internal host accessing a shared folder can be linked through the graph if the host previously communicated with an external address entity flagged as malicious. This connection, based on the "same host entity," forms a preliminary event chain from "external penetration" to "internal lateral movement." The analysis algorithm then traces the causes and effects forward within a time window along the entity relationship edges, connecting multiple seemingly unrelated low-risk alerts into a continuous attack storyline.

[0032] Understandably, event correlation analysis here refers to an intelligent analysis process that uses an entity relationship graph as a background knowledge base and graph analysis methods to find a series of events that are continuous in time, connected in entity relationships, and whose overall behavior deviates from the normal baseline or conforms to known threat patterns. Anomaly event chains specifically refer to a suspicious activity sequence identified through this correlation analysis, consisting of multiple events connected in a logical order. It often represents one or more stages in a complete attack chain.

[0033] Step S40: Perform a threat confidence assessment on the abnormal event chain to obtain the risk assessment result of the abnormal event chain, and determine the abnormal event chain with a confidence level higher than the threshold as a high-confidence attack chain.

[0034] It should be noted that the risk assessment in this solution refers to the process of calculating a comprehensive quantitative score for each chain of abnormal events based on a predefined multi-dimensional threat assessment model. This score comprehensively reflects the overall suspiciousness and potential harm of the event chain.

[0035] Understandably, the risk assessment process evaluates the event chain from multiple perspectives. Assessment dimensions typically include the severity of individual events within the chain, the logical coherence between events, the rarity of the entities or behaviors involved, and the potential business impact if the attack were successful. For example, an event chain consisting of several low-risk events, but whose behavioral patterns strictly conform to a known network intrusion tactic, may have a higher risk score due to the strong targeting of the behavioral patterns. Conversely, a chain containing high-risk events but with loose logic between events and a lack of clear attack targets may have a lower overall risk score. A preset risk threshold is a key security operation parameter, representing the lower limit of the security system's tolerance for risk. The system compares the assessment results of each event chain with this threshold.

[0036] In one embodiment, a threat confidence assessment is performed on the abnormal event chain to obtain a risk assessment result for the abnormal event chain. This includes: performing attack behavior simulation based on the abnormal event chain to identify the key entity nodes that successfully execute attack behavior; obtaining the security configuration information of the key entity nodes and the security case records corresponding to the entity type to which the key entity nodes belong; performing simulated attacks on the key entity nodes based on the security configuration information to obtain a defense strength score; obtaining a historical defense record score based on the security case records corresponding to the entity type to which the key entity nodes belong; and obtaining the risk assessment result for the abnormal event chain based on the defense strength score and the historical defense record score.

[0037] It should be noted that this embodiment provides a risk assessment method that combines quantitative and qualitative approaches. Its core idea is not only to focus on the attack chain itself, but also to deeply analyze the vulnerabilities of the key nodes upon which the attack chain relies in the current real-world environment. Attack behavior simulation aims to think in reverse, identifying which core entities the attacker must successfully compromise or exploit to ultimately achieve the attack objective (such as data theft or system damage) of the anomalous event chain; these entities are defined as key entity nodes. Security configuration information reflects the static defense capabilities of the nodes, while security incident records provide the statistical probability of this type of node being compromised in historical records.

[0038] Understandably, this method transforms the abstract risk of an attack chain into an assessment of specific, measurable objects (critical entity nodes). For example, an attack chain showing lateral movement from an external server to an internal database might have critical entity nodes including the external server acting as a springboard and the final target database. By checking whether this server has timely applied the latest vulnerability patches (security configuration) and querying the frequency of security incidents occurring on similar databases in the past period (case records), a more accurate assessment of the realistic probability of the current attack chain succeeding can be made, rather than solely based on the suspiciousness of the attack behavior itself.

[0039] It should be understood that this assessment method greatly improves the accuracy of risk assessment results and their value in guiding action. It achieves a leap from "potentially threatening" to "what is the threat level based on the current defensive posture." The final comprehensive risk assessment result, which integrates the defense strength score (current situation) and the historical defense record score (experience), can help security teams prioritize truly high-risk events with clear attack paths and genuine vulnerabilities in the current environment, thereby achieving optimal allocation of security resources.

[0040] Step S50: Generate a security incident report based on the multi-source security alert data corresponding to the high-confidence attack chain.

[0041] It should be noted that the core purpose of this step is to transform the highly credible attack chain that has been analyzed and verified above into a structured, readable, and decision-supporting final output, which aims to fully describe the timeline, technical details, scope of impact, and response recommendations of the highly credible attack activities present in the current numerous alerts.

[0042] Understandably, the system will use the analysis results of the high-confidence attack chains marked in the aforementioned steps as its core, automatically tracing back and extracting all original security alert logs and contextual data involved in constructing the chain. This includes the event time, source and target addresses, usernames, process information, behavior details, and the original rules triggered for each link in the attack chain. By fusing, deduplicating, and logically arranging this multi-source heterogeneous information, a coherent "attack logic chain" is formed. For example, for an attack chain from spear-phishing to final data leakage, the generated security incident report will clearly show the key stages in chronological order, such as the initial email arrival, malicious attachment execution, lateral movement within the intranet, sensitive data collection, and external transmission. Specific evidence from different sources, such as email gateways, endpoint detection, and network traffic analysis, will be integrated below each stage.

[0043] In one embodiment, a security incident report is generated based on multi-source security alert data corresponding to a high-confidence attack chain, including: reconstructing the interaction trajectory of high-confidence threat activities within an asset event context network; generating an activity process summary based on the interaction trajectory; extracting original alert data related to the high-confidence threat activities as supporting evidence; and generating an analysis report containing a timeline, scope of impact, and handling recommendations based on the activity process summary and supporting evidence.

[0044] It should be understood that the final security incident report serves to provide a roadmap for action for security analysts or incident response teams. This report not only accurately records what happened, but more importantly, explains how the attack unfolded. Such a report can significantly reduce manual investigation time, provide a solid chain of evidence, and offer direct support for subsequent containment, damage mitigation, and recovery efforts. This step represents a crucial transformation from massive amounts of complex alerts to accurate and actionable security intelligence, making it an indispensable part of the security operations closed loop.

[0045] This embodiment presents a technical solution for automatically constructing high-confidence attack event reports from raw alarms. The solution first cleanses and standardizes multi-source heterogeneous security alarm data to form a unified event set. Then, based on this set, entity relationship modeling is performed to construct an entity relationship graph reflecting the dynamic interactions of network objects. Next, event correlation analysis is conducted using the context of this graph to uncover abnormal event chains composed of multiple events. Then, multi-dimensional risk assessments are performed on these event chains to filter out high-confidence attack chains exceeding a preset risk threshold. Finally, original evidence is integrated around these attack chains to automatically generate logically coherent and well-supported security event reports.

[0046] In summary, this technical solution provides a global analytical perspective by constructing an entity relationship graph, enabling sporadic security events to be evaluated within their historical and network context. This effectively enhances the ability to identify complex and covert attack activities from massive alerts. By conducting risk assessments and screening of identified suspicious event chains, false positives are significantly reduced, high-threat attacks are accurately located, and security analysis resources are effectively focused. Finally, the automated generation of structured attack event reports transforms machine analysis results into intelligence that can directly guide response actions, greatly shortening manual investigation and response time. This achieves a closed loop from data to decision-making, significantly improving the overall efficiency of security operations and the effectiveness of responding to advanced threats.

[0047] Example 2 Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2Step S10 in the network security log noise reduction method includes steps S101 to S104: Step S101: Perform event parsing on each original security log in the multi-source security alarm data to obtain security event type information and security event entity information.

[0048] It should be noted that security event type information refers to the category of security activity or threat behavior described in the logs, such as specific actions like port scanning, brute-force attacks, or malicious file downloads. Security event entity information, on the other hand, refers to the specific network object or resource involved in the security activity. Typical entities include the source address of the attack, the destination host accessed, the user account triggered, and the files or processes involved.

[0049] Understandably, a dedicated event parsing engine enables the system to identify and extract these core elements. For example, faced with a raw log entry containing an abnormal login attempt, the parsing process will identify the event type as "login failed" and extract entity information, such as the username "admin" of the attempted login, the source address "external attack host," and the target server address "internal mail server." This parsing process is a crucial first step in transforming free text or raw data in a specific format into standardized information fields that are machine-understandable and can be further processed, providing a clear and standardized input data foundation for subsequent precise correlation and in-depth analysis.

[0050] Step S102: Generate an event type identifier and an event timestamp based on the security event type information.

[0051] It should be noted that the generation of event type identifiers refers to assigning a unique, computer-recognizable coded symbol to each specific security event type. This process maps textual descriptions such as "port scan" or "ransomware encryption" to predefined standardized codes within the system, aiming to eliminate potential naming differences for the same type of event from different data sources and lay the foundation for accurate cross-event correlation and statistics.

[0052] Step S103: Construct a structured security event from the original security log based on the event type identifier, event timestamp, and security event entity information.

[0053] It's important to note that the construction process involves combining and encapsulating these key elements according to a predefined data model. For example, a raw alert recording an abnormal login will, after this step, be constructed into a structured record containing a specific login failure type code, the occurrence time accurate to milliseconds, and information such as the attack source account and the accessed server address. In this way, the originally heterogeneous raw data is transformed into a unified format that is easy for machines to process and analyze, providing a directly usable data foundation for subsequent large-scale correlation calculations.

[0054] Step S104: Summarize the structured security events from each original security log to obtain a set of structured security events.

[0055] It should be noted that this step aims to collect and organize all structured security events generated in the previous processing. Specifically, it involves collecting and merging multiple scattered and independent structured security event records according to chronological order or other preset logic. Each of these records represents a standardized original alarm message, containing a unified event type, a precise timestamp, and relevant entity attributes.

[0056] Understandably, through the aggregation operation, the system integrates these isolated individual events, ultimately forming a complete and ordered data set. This set serves as the foundational dataset for subsequent advanced analyses, such as association rule mining and attack chain reconstruction. For example, when analyzing a network scanning attack lasting several hours, the structured record of a single probe event has limited value. However, by aggregating all relevant scanning events within this period into a single set through this step, analysts can observe the frequency of attacks, target distribution, and evolution patterns holistically. Therefore, this step transforms discrete data points into a systematic dataset, providing the necessary data preparation for examining the security posture from a higher perspective.

[0057] In this embodiment, the event types and entity information are extracted by parsing the original security logs. Then, the textual event types are mapped to standardized type identifiers and a unified time base is established. Based on the data model, these key elements are then encapsulated into structured security events in a unified format. Finally, all independent events are aggregated into an ordered set for analysis.

[0058] In summary, this technical solution achieves data integration and standardization by transforming multi-source, heterogeneous raw alarm information into a structured set of security events with a unified format and complete elements. Consequently, subsequent security analysis engines can directly process this standardized data, effectively solving the analysis difficulties caused by inconsistent multi-source data formats. This significantly improves the accuracy of security event correlation analysis and the efficiency of large-scale data processing, providing data quality assurance for the discovery of advanced threats and the overall assessment of the security posture.

[0059] Example 3 Based on the first embodiment of this application, in the third embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 Step S20 in the network security log noise reduction method includes steps S201 to S204: Step S201: Generate a global relationship graph based on the entity connection relationships in the structured security event set.

[0060] It's important to note that entity connections refer to the directed interactions between subjects and objects extracted from each security event record. For example, a login event record contains three key pieces of information: "User A," "Login Action," and "Server B." "User A" is the subject initiating the action, and "Server B" is the object receiving the action. The two establish a direct connection through the act of "login." This step involves traversing the entire structured security event set, identifying all such subjects and objects and their behavioral relationships, and abstracting each unique entity (such as user, server IP, or process name) as a node in a graph. Each specific interaction is abstracted as a directed edge connecting two nodes, thus systematically constructing a "global relationship graph" covering all known interaction history.

[0061] Understandably, the resulting global relationship diagram serves as the complete data foundation for all subsequent analytical operations. This diagram depicts how all entities within the entire IT environment are interconnected. It not only records normal business operations but may also conceal clues of abnormal or malicious behavior. Its value lies in providing a panoramic view, ensuring that when filtering activities related to core resources in subsequent steps, no potential connection paths are overlooked due to limitations in the data source.

[0062] It should be understood that this step, through the abstraction and integration of low-level event data, generates a high-level data model with a topological structure. This global graph model enables complex cybersecurity analysis problems to be reasoned and computed using graph theory algorithms, providing the possibility for subsequent focused analysis centered on core resources. It is the starting point for the entire method to accurately locate threat chains from massive amounts of data.

[0063] Step S202: Determine the core asset nodes in the global relationship graph based on the core resource record table.

[0064] It's important to note that the core resource log table is a predefined and configured list of critical assets, independent of the real-time security event logs. It is compiled by security administrators based on principles such as business importance and data sensitivity. This log table explicitly lists the core resource entities in the network that require focused monitoring and protection. These entities can be critical servers hosting core business applications, database systems storing important user information, or core user accounts with high-level management privileges. This step involves matching this static list of critical assets against the dynamically generated global graph, thereby filtering and marking these core resource nodes from among the many nodes in the graph.

[0065] Understandably, a global entity interaction graph may contain a vast number of entity nodes. Indiscriminate analysis of the entire graph would lead to wasted computational resources and a scattered focus of analysis. By introducing the prior knowledge of a core resource record table, the analysis process can shift from "comprehensive monitoring" to "focused protection," prioritizing limited resources on threat analysis of the most critical assets. For example, for an e-commerce platform, its core resource record table might list payment gateway servers and user databases. This step involves locating the nodes representing these two servers in the graph and identifying them as core nodes.

[0066] Step S203: Taking the core asset node as the center, extract its associated entities and corresponding event nodes to form an initial context graph.

[0067] It's important to clarify that extracting associated entities and corresponding event nodes refers to using a graph traversal algorithm. Starting from the marked core asset nodes, we explore and collect all nodes that are directly or indirectly connected to them within a specific step or logical jump. For example, starting from a core database node, we might discover an application server node that previously queried it, and this application server node is associated with a user terminal node that performed a login operation. These discovered associated entity nodes, along with the event nodes that record their specific interactions, collectively constitute the direct activity environment surrounding the core asset.

[0068] Understandably, the resulting "initial context graph" is a subgraph focused on the security context of core assets. It doesn't simply replicate the structure of the global graph; instead, it uses a focused search to include all entities and their behavioral chains that have interacted with the core assets in any form. This process effectively filters out a large amount of background noise data irrelevant to the core assets from the global graph, narrowing the scope of analysis to a more manageable scale. This initial context graph acts like a security surveillance lens, switching from wide-angle mode to focused mode, allowing security analysts to clearly observe all entities that have touched or approached the core assets and their activity trajectories.

[0069] It should be understood that the initial context graph produced in this step ensures that subsequent analysis and calculations are only performed on entities that are genuinely related to the core assets, thus avoiding unnecessary waste of resources. While this graph contains all possible connection paths, it may still be complex, containing both high-risk attack indications and a large number of normal business accesses. Therefore, as an intermediate product bridging the gap between the initial and subsequent steps, it prepares the ground for the next step of quantifying connection strength to distinguish between benign and malicious behavior and further simplifying the graph structure.

[0070] Step S204: Calculate the association strength between each associated entity and the core asset node in the initial context graph, and update the structure of the initial context graph according to the association strength to obtain the asset event context network.

[0071] It's important to note that association strength is a comprehensive quantitative assessment value. It's not determined by a single factor but is measured through a computational model that considers multiple factors, such as the frequency of interactions between a specific entity and core assets, the sensitivity of the behavior type, and the topological proximity of the connection path. For example, an external IP address that launches a large number of abnormal port scans on core servers within a short period will typically have a higher association strength value than an internal employee account that only performs routine file access during work hours. This is because the abnormal behavior indicates a more significant potential threat.

[0072] Understandably, updating the initial context graph structure based on association strength is a dynamic filtering and optimization process. This process typically sets a strength threshold and compares all calculated association strength values ​​to this threshold. Redundant or secondary connections with strengths below the threshold, such as weak associations generated by accidental network probes or irrelevant system logs, are pruned and removed from the graph. The remaining nodes and connections with higher association strengths constitute a more refined and risk-oriented network structure. This updated network is the final "asset event context network," which acts like a hotspot map focusing on high-risk activities, significantly improving the signal-to-noise ratio for subsequent analysis.

[0073] It should be understood that this step is crucial for the methodology to generate real security value. It transforms a potentially still complex initial relationship graph into a highly centralized analytical view based on quantified risk. The asset event context network not only clearly identifies which entities are most closely associated with and suspicious of core assets, but its structure itself also implicitly ranks attack paths, providing security analysts with intuitive and reliable data support for identifying truly high-priority threats. This ensures that security operations resources are precisely allocated to the most likely risk points.

[0074] In summary, this technical solution introduces core resources as analytical anchors and quantifies correlations based on path distances between key nodes. This enables the analysis process to automatically and intelligently filter out entities and behavioral chains strongly related to critical assets from a wide range of interactions across the entire network. This progressive refinement method, moving from macro to micro and from qualitative to quantitative analysis, effectively overcomes the noise interference and computational redundancy issues encountered when directly analyzing the global map. Therefore, the beneficial effect of this solution is that it significantly improves the targeting and efficiency of security threat analysis, allowing security personnel to quickly focus on the most potentially risky activity sequences, thereby achieving precise control and efficient response to the security posture of core resources.

[0075] Example 4 Based on the first embodiment of this application, in the fourth embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 Step S30 in the network security log noise reduction method includes steps S301 to S305: Step S301: Under the topological constraints of the asset event context network, select events that have a path related to the core assets from the structured security event set to obtain the event set to be analyzed.

[0076] It's important to clarify that the specific logic of the filtering process involves determining whether an event contains an entity within the context network of that asset event. For example, suppose the network contains three entity nodes: a core database server, a specific application service account, and an external IP address, and these are connected through authentication and access events. During filtering, only security events where the initiator or recipient is one of these three entities (such as login logs for that account or access attempts by that IP address to the server) will be retained. Events involving other entities not present in the network (such as operation logs from another unrelated printer within the company) will be filtered out. In this way, we obtain a highly relevant "set of events to be analyzed."

[0077] It should be understood that this step significantly improves the efficiency and signal-to-noise ratio of subsequent time-series analysis. It strictly limits the analysis scope to verified, strongly correlated entity activities related to core assets, effectively eliminating interference from a large number of background events unrelated to the security status of core assets. This allows subsequent steps to focus on a clear, risk-oriented contextual path, facilitating the rapid and accurate identification of attack event sequences hidden within normal business traffic.

[0078] Step S302: Sort the events in the event set to be analyzed by timestamp, and perform time-series correlation according to the preset time continuity threshold to generate candidate event timelines.

[0079] It should be noted that the set of events to be analyzed refers to all security event records determined to have a path related to core assets. Each event contains a key attribute: a timestamp, indicating the precise moment the event occurred. This step first sorts these events according to their timestamps in chronological order, forming a preliminary time series. Then, a time series correlation is performed based on a preset time continuity threshold. This threshold is a pre-defined maximum time interval used to determine whether two consecutive events are sufficiently close in time to form a coherent behavioral sequence. By calculating the time difference between adjacent events and comparing it to this threshold, events with time intervals less than the threshold are linked together, thereby generating one or more candidate event timelines.

[0080] Understandably, the temporal correlation process is essentially an attempt to string together discrete event points into a chain that may represent continuous activity. For example, an attack involving privilege escalation might consist of multiple steps, such as account login, access to sensitive directories, and database queries. If the timestamps of these events show that they occurred sequentially within a short time window, and the intervals between them did not exceed a preset threshold, then they would be correlated into a candidate event timeline. This approach effectively extracts tightly arranged sequences in the time dimension from a large number of events, providing a clear temporal framework for identifying potential multi-stage attacks.

[0081] It should be understood that generating candidate event timelines transforms previously isolated event points into a time-logical flow, greatly assisting security analysts in tracing attackers' actions. The candidate event timelines implicitly contain potential causal relationships between behaviors, allowing subsequent analysis to focus on temporally coherent combinations of events that are more likely to pose a real threat, thereby significantly improving the targeting and efficiency of security incident investigations.

[0082] Step S303: Based on the compliant interaction flow between entities defined in the asset event context network, perform compliance verification on the flow path of events in the candidate event timeline to obtain the compliant event flow.

[0083] It should be noted that the compliant interaction flow between entities refers to the predefined direction of entity behavior within the asset event context network that conforms to normal business logic or security policies. For example, it may stipulate that a "user account" should first initiate a login request to the "authentication service" before accessing the "database server," while the reverse flow or unauthorized access is considered non-compliant. This step compares the entity relationship of each adjacent event pair in the candidate event timeline with the predefined compliant flow in the network. Only timeline segments whose event flow paths completely conform to the preset direction can pass the verification and are ultimately marked as "compliant event flows."

[0084] Understandably, this step involves a deep verification of the logical plausibility of the event chain from a spatial or topological perspective. It ensures that the event chain depicts a possible attack path, rather than an arbitrarily pieced-together combination of events. For example, a compliant chain might be "attacker IP -> Web server -> Database server," while a chain that doesn't conform to entity dependencies might be "Database server -> Attacker IP -> Web server," the latter being unlikely to hold true under normal network access logic.

[0085] It should be understood that the event chain segment verified through entity flow consistency already possesses rationality in both time and space dimensions. It describes a credible sequence of activities that progresses step by step along the network topology within a specific time window. This greatly enhances the credibility of the analysis results and provides strong support for the final determination of whether it is a malicious attack chain.

[0086] Step S304: Based on the predefined attack patterns in the attack behavior knowledge base, perform pattern matching on the compliant event flow to identify continuous event subsequences with abnormal interaction intent characteristics.

[0087] It should be noted that the attack behavior knowledge base refers to an expert system that aggregates various known attack methods and strategies. Predefined attack patterns describe the typical sequences of actions and key characteristics that attackers take to achieve specific goals. The identification process aims to find consecutive subsequences of events in a compliant event stream that are highly similar to malicious patterns in structure and intent. The abnormal interactive intent characteristics exhibited by these subsequences are a direct manifestation of potential attack behaviors.

[0088] In a feasible embodiment, based on predefined attack patterns in an attack behavior knowledge base, the compliant event flow is matched to identify specific implementation steps for continuous event subsequences with abnormal interaction intent characteristics, including steps A10 to A40: Step A10: Extract and format behavioral features based on the metadata of each security event in the compliance event stream to obtain a standardized sequence of behavioral features.

[0089] It should be noted that a compliance event flow refers to a sequence of events generated by previous steps that has passed both temporal and logical verification. Metadata refers to the basic attribute information attached to each security event, such as operation type, source address, and target object. Behavioral feature extraction refers to extracting key indicators that can characterize regular interaction behavior patterns from this metadata, such as operation frequency and access path. Formatting involves uniformly organizing and encoding the extracted features according to preset specifications, ultimately outputting a standardized behavioral feature sequence with a consistent structure that is easy to calculate and analyze.

[0090] Understandably, this process aims to transform raw event records into feature data with analytical value. For example, from an event stream containing multiple database queries, features such as "number of queries" and "number of tables involved" might be extracted, and these values ​​would be uniformly converted into a standardized form with zero mean and unit variance. This approach eliminates differences in the units and ranges of the raw data, allowing subsequent models or algorithms to fairly handle different features.

[0091] It should be understood that generating standardized behavioral feature sequences is a fundamental preparatory step in the entire analysis process. It provides high-quality, standardized input data for subsequent anomaly detection or pattern recognition, significantly improving the accuracy and reliability of the analysis model. This step ensures that events from different sources and of different types can be compared and evaluated on a uniform scale.

[0092] Step A20: Based on the time sequence of the compliance event flow, sort and reorganize the standardized behavioral feature sequence to obtain a time-seriesd behavioral feature chain.

[0093] It should be noted that sorting and reorganization refers to rearranging these feature data according to the timestamp of each event, ensuring that their order is strictly consistent with the original event flow, thereby generating a coherent temporal behavioral feature chain that fully preserves the evolution trajectory of behavior in the time dimension.

[0094] Understandably, a compliance event flow should include events such as user authentication, data access, and network connection, with corresponding feature sequences from which information such as operation type and target object has been extracted. Through chronological sorting, these features are reorganized into a chain, clearly demonstrating the complete behavioral path from login to data retrieval to outbound transmission.

[0095] It should be understood that generating a temporally sequenced chain of behavioral features is to ensure that the temporal dependence of behavioral features is not destroyed, thus providing an accurate temporal context for subsequent pattern recognition or anomaly detection.

[0096] Step A30: Compare the temporal behavioral feature chain with the predefined suspicious behavioral patterns in the behavioral knowledge base, and calculate the similarity score between the behavioral feature chain and each suspicious behavioral pattern in the dimension of interaction intent.

[0097] It should be noted that the behavioral knowledge base refers to a database storing various known attack strategies. Predefined suspicious behavior patterns describe typical action sequences and their characteristics with malicious intent. The interaction intent dimension focuses on the underlying purpose behind the behavioral chain rather than the surface actions, while the similarity score is a calculated quantitative value used to accurately reflect the degree of alignment between the two actions in terms of behavioral purpose.

[0098] Understandably, this process aims for deep matching at the level of behavioral intent, rather than simply comparing surface features. For example, a knowledge base might define a "data leakage" pattern, characterized by intensive access to sensitive files followed by unusual outbound network connections. The system will compare the user's behavioral chain with this pattern. If it finds that the evolution of their characteristics is highly similar in intent, such as both first reading a large amount of data and then attempting to transmit it outwards, a high similarity score will be obtained, thus identifying potential risks.

[0099] It should be understood that the purpose of calculating similarity scores on the interaction intent dimension is to transform abstract behavioral intent into quantifiable evaluation metrics, enabling the system to move beyond judgments based on single events and keenly capture malicious clues from the overall intent of continuous behaviors. This step provides direct and objective data support for the final risk assessment and is a core component in achieving high-precision security situation awareness.

[0100] Step A40: Based on the similarity scores, perform behavioral intent confidence fusion to obtain the overall confidence of the temporal behavioral feature chain representing the abnormal interaction intent.

[0101] It's important to note that the core task of this step is to integrate and calculate multiple similarity scores to generate a unified evaluation metric. Each similarity score refers to the numerical matching degree obtained after comparing the behavioral feature chain with each suspicious behavioral pattern in the knowledge base. Behavioral intent confidence fusion refers to using mathematical methods such as weighted averaging or probability models to aggregate these scattered scores into a single value representing the overall tendency. The overall confidence score comprehensively reflects the total probability of the abnormal interaction intent represented by the temporally sequenced behavioral feature chain.

[0102] Understandably, this process is similar to combining independent scores from multiple experts to arrive at a final conclusion. For example, if a behavioral feature chain scores highly similar to the "data breach" pattern but scores low similarity to the "system detection" pattern, the confidence fusion will assign different weights to each pattern based on its importance. The calculated result may be a high overall confidence level, indicating that the behavioral chain has strong abnormal intent characteristics and requires an early warning.

[0103] Step A50: Compare the overall confidence level with the preset judgment threshold, identify the continuous event sequences that meet the confidence level, and output them as continuous event subsequences with abnormal interaction intent characteristics.

[0104] It should be noted that the preset judgment threshold refers to a pre-calibrated threshold value used to delineate the normal and abnormal boundaries of behavioral intent. Achieving the confidence level means that the overall confidence level reaches or exceeds this threshold, indicating that the probability of abnormal interaction intent is high enough to warrant an alert. Identification and output refers to the system automatically performing filtering and labeling operations, extracting event segments corresponding to high-confidence judgment results from the complete temporal behavioral feature chain to form the final result.

[0105] Understandably, this step is the decision-making stage of the entire analysis process, transforming quantified risk probabilities into clear judgments. For example, if the system calculates that the overall confidence level of a user's behavioral sequence over a period of time is high and exceeds a security threshold, then the system will output this event sequence, which includes abnormal logins, batch data access, and abnormal outbound connections, as a complete suspicious behavior subsequence to the security analyst for handling.

[0106] Step S305: Perform causal logic consistency verification on the event subsequence and take the continuous event subsequence that passes the verification as the abnormal event chain.

[0107] It's important to note that logical consistency verification is the final quality control step, designed to check for subtle logical inconsistencies within the event chain after the aforementioned multiple rounds of screening. For example, it verifies whether the same account appeared in different geographical locations at impossible times, or checks whether the privilege escalation event actually occurred after the acquisition of the corresponding credentials. The fusion operation, on the other hand, refers to piecing together multiple independent short chains that are sequential in time or related in objectives into a more complete and longer attack narrative chain.

[0108] Understandably, even if a segment of the event chain passes behavioral pattern matching, individual event data may contain errors or anomalies, and final verification can effectively remove this noise. Fusion, on the other hand, can reconstruct the full picture of the attack, presenting a complete picture of a complex, phased attack process, which is crucial for understanding the attacker's intent, assessing losses, and responding.

[0109] It should be understood that the final output of the anomaly event chain is a high-confidence attack activity report that has undergone four checks: temporal continuity, entity dependency, behavioral pattern matching, and final logical consistency. It is no longer an isolated security alert, but a complete attack storyline with context, logic, and evidence support, providing invaluable input for security teams to conduct accurate responses and source tracing analysis.

[0110] In this embodiment, related events are filtered based on an entity relationship graph, ensuring the relevance of the analysis foundation. Then, time window continuity checks and entity dependency verification are performed sequentially to ensure the rationality of the event sequence from both temporal and topological logic perspectives. Next, the initially filtered event chains are pattern-matched with a threat behavior knowledge base, and threat confidence is calculated and filtered based on behavioral characteristics. Finally, the filtered event chains are logically consistent and fused, outputting a high-confidence abnormal event chain.

[0111] In summary, this technical solution enables layered correlation and progressive filtering of discrete security events. This method effectively integrates entity association, spatiotemporal logic, and threat intelligence, resulting in an event chain that not only possesses temporal and topological coherence but also conforms to known attack behavior patterns. Therefore, this method significantly improves the ability to accurately identify real attack chains from massive alerts, facilitating rapid security threat localization and supporting efficient response decisions.

[0112] This application also provides a network security log noise reduction device based on alarm aggregation and correlation analysis. Please refer to [reference needed]. Figure 5 The network security log noise reduction device based on alarm aggregation and correlation analysis includes: Data preprocessing module 10 is used to obtain a structured security event set based on multi-source security alarm data; The graph construction module 20 is used to generate an asset event context network based on a predefined core resource record table and a structured security event set. The correlation analysis module 30 is used to identify abnormal events in each event in the structured security event set based on the asset event context network, and obtain the abnormal event chain. The risk assessment module 40 is used to assess the threat confidence of the abnormal event chain, obtain the risk assessment result of the abnormal event chain, and identify the abnormal event chain with a confidence level higher than the threshold as a high-confidence attack chain; The event report generation module 50 is used to generate a security event report based on the multi-source security alarm data corresponding to the high-confidence attack chain.

[0113] In one embodiment, the data preprocessing module 10 is further configured to perform event parsing on each original security log in the multi-source security alarm data to obtain security event type information and security event entity information, wherein the security event entity information includes at least a source entity identifier and a destination entity identifier; generate an event type identifier and an event timestamp based on the security event type information; construct structured security events of the original security logs based on the event type identifier, the event timestamp, and the security event entity information; and summarize the structured security events of each original security log to obtain a set of structured security events.

[0114] In one embodiment, the graph construction module 20 is further configured to: construct a global entity interaction relationship graph representing network access and permission relationships between entities based on the source entity identifier and destination entity identifier in the structured security event set; query the core resource node in the global entity interaction relationship graph based on the core resource record table; perform graph traversal on the global entity interaction relationship graph starting from the core resource node, extract all entity nodes and associated security events that have associated paths with the core resource node to construct an initial associated subgraph; calculate the association strength between each entity node and the core resource node based on the hop count of the associated path; and update the graph structure of the initial associated subgraph according to the association strength to obtain the entity relationship graph.

[0115] In one embodiment, the association analysis module 30 is further configured to: filter events with associated paths to core assets from the structured security event set under the topological constraints of the asset event context network to obtain a set of events to be analyzed; sort the events in the set of events to be analyzed by timestamps and perform temporal association according to a preset time continuity threshold to generate a candidate event timeline; perform compliance verification on the flow path of events in the candidate event timeline based on the compliant interaction flow between entities defined in the asset event context network to obtain a compliant event flow; perform pattern matching on the compliant event flow according to the predefined attack patterns in the attack behavior knowledge base to identify continuous event subsequences with abnormal interaction intent characteristics; perform causal logic consistency verification on the event subsequences and use the verified continuous event subsequences as an abnormal event chain.

[0116] In one embodiment, the correlation analysis module 30 is further configured to obtain the alarm type identifier of each security event in the event chain segment; sort the alarm type identifiers according to the temporal relationship of the security events in the event chain segment to obtain the alarm event evolution chain; match the alarm event evolution chain with the historical attack behavior alarm event chain of the threat behavior knowledge base, and calculate the threat confidence of the alarm event evolution chain according to the matching result; if the threat confidence is greater than a preset threshold, then mark the alarm event evolution chain as an event chain segment that meets the attack evolution behavior characteristics.

[0117] In one embodiment, the risk assessment module 40 is further configured to: perform attack behavior simulation based on the abnormal event chain; identify the key entity nodes that successfully execute the attack behavior based on the abnormal event chain; obtain the security configuration information of the key entity nodes and the security case records corresponding to the entity type to which the key entity nodes belong; perform simulated attacks on the key entity nodes based on the security configuration information to obtain a defense strength score; obtain a historical defense record score based on the security case records corresponding to the entity type to which the key entity nodes belong; and obtain the risk assessment result of the abnormal event chain based on the defense strength score and the historical defense record score.

[0118] In one embodiment, the event report generation module 50 is further configured to: obtain the attack path and key attack nodes mapped in the entity relationship graph based on the entity relationship graph; generate an attack behavior summary based on the attack path and key attack nodes; extract the multi-source security alarm data corresponding to the high-confidence attack chain to obtain the original security logs, and integrate the original security logs to obtain an evidence log set; and generate a security event report containing an attack timeline, impact scope assessment, and targeted handling suggestions based on the evidence log set and the attack behavior summary.

[0119] The network security log denoising device based on alarm aggregation and correlation analysis provided in this application, employing the network security log denoising method, device, equipment, and storage medium described in the above embodiments, can solve the technical problem in the prior art of how to effectively identify high-value attack clues from massive amounts of messy raw alarms. Compared with the prior art, the beneficial effects of the network security log denoising device based on alarm aggregation and correlation analysis provided in this application are the same as those of the network security log denoising method, device, equipment, and storage medium provided in the above embodiments, and other technical features in the network security log denoising device based on alarm aggregation and correlation analysis are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0120] This application provides a network security log noise reduction device based on alarm aggregation and correlation analysis. The network security log noise reduction device based on alarm aggregation and correlation analysis includes: at least one processor; and a memory communicatively connected to at least one processor; wherein the memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor to enable at least one processor to execute the network security log noise reduction method, apparatus, device and storage medium in the above embodiment 1.

[0121] The following is for reference. Figure 6 This document illustrates a structural diagram of a network security log noise reduction device suitable for implementing embodiments of this application based on alarm aggregation and correlation analysis. The network security log noise reduction device based on alarm aggregation and correlation analysis in this application embodiment may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 6The network security log noise reduction device based on alarm aggregation and correlation analysis shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0122] like Figure 6 As shown, the network security log noise reduction device based on alarm aggregation and correlation analysis may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the network security log noise reduction device based on alarm aggregation and correlation analysis. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the network security log noise reduction device based on alarm aggregation and correlation analysis to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a network security log noise reduction device based on alarm aggregation and correlation analysis with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented alternatively.

[0123] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0124] The network security log denoising device based on alarm aggregation and correlation analysis provided in this application, employing the network security log denoising method, apparatus, device, and storage medium described in the above embodiments, can solve the technical problem in the prior art of effectively identifying high-value attack clues from massive amounts of messy raw alarms. Compared with the prior art, the beneficial effects of the network security log denoising device based on alarm aggregation and correlation analysis provided in this application are the same as those of the network security log denoising method, apparatus, device, and storage medium provided in the above embodiments, and other technical features in this network security log denoising device based on alarm aggregation and correlation analysis are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0125] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0126] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0127] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the network security log noise reduction method, apparatus, device, and storage medium in the above embodiments.

[0128] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0129] The aforementioned computer-readable storage medium may be included in a network security log noise reduction device based on alarm aggregation and correlation analysis; or it may exist independently and not be assembled into a network security log noise reduction device based on alarm aggregation and correlation analysis.

[0130] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a network security log denoising device based on alarm aggregation and correlation analysis, the network security log denoising device based on alarm aggregation and correlation analysis performs the following actions: It obtains a structured security event set based on multi-source security alarm data; it generates an asset event context network based on a predefined core resource record table and the structured security event set; it identifies abnormal events in each event of the structured security event set based on the asset event context network to obtain an abnormal event chain; it performs threat confidence assessment on the abnormal event chain to obtain a risk assessment result for the abnormal event chain, and identifies abnormal event chains with confidence levels higher than a threshold as high-confidence attack chains; and it generates a security event report based on the multi-source security alarm data corresponding to the high-confidence attack chain.

[0131] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0133] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0134] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., computer programs) for executing the aforementioned network security log noise reduction method, apparatus, device, and storage medium. This addresses the technical problem in the prior art of effectively identifying high-value attack clues from massive amounts of messy raw alerts. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the network security log noise reduction method, apparatus, device, and storage medium provided in the above embodiments, and will not be elaborated upon here.

[0135] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network security log noise reduction method, apparatus, device, and storage medium described above.

[0136] The computer program product provided in this application can solve the technical problem of how to effectively identify high-value attack clues from massive and messy raw alerts in the prior art. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the network security log noise reduction method, apparatus, device and storage medium provided in the above embodiments, and will not be repeated here.

[0137] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for noise reduction in network security logs, characterized in that, Includes the following steps: S10. Based on the multi-source security alarm data, obtain a set of structured security events; S20. Based on the predefined core resource record table and the structured security event set, generate an asset event context network; Specifically, step S20 includes the following steps: S201. Generate a global relationship graph based on the entity connection relationships in the structured security event set; S202. Based on the core resource record table, determine the core asset nodes in the global relationship diagram; S203. Taking the core asset node as the center, extract its associated entities and corresponding event nodes to form an initial context graph; S204. Calculate the association strength between each associated entity and the core asset node in the initial context graph, and update the structure of the initial context graph according to the association strength to obtain the asset event context network. S30. Based on the asset event context network, perform abnormal event identification on each event in the structured security event set to obtain an abnormal event chain; S40. Perform a threat confidence assessment on the abnormal event chain to obtain the risk assessment result of the abnormal event chain, and determine the abnormal event chain with a confidence level higher than the threshold as a high-confidence attack chain; Specifically, step S40 includes the following steps: Based on the abnormal event chain, attack behavior is deduced to identify the key entity nodes that successfully execute the attack behavior in the abnormal event chain. Obtain the security configuration information of the key entity node, as well as the security case records corresponding to the entity type to which the key entity node belongs; Based on the security configuration information, a simulated attack was performed on the key entity node to obtain a defense strength score; Based on the security case records corresponding to the entity type to which the key entity node belongs, the historical defense record score is obtained; The risk assessment result of the abnormal event chain is obtained based on the defense strength score and the historical defense record score; S50. Generate a security incident report based on the multi-source security alarm data corresponding to the high-confidence attack chain.

2. The network security log noise reduction method according to claim 1, characterized in that: Step S10 specifically includes the following steps: S101. Perform event parsing on each original security log in the multi-source security alarm data to obtain security event type information and security event entity information. The security event entity information includes at least the source entity identifier and the destination entity identifier. S102. Generate an event type identifier and an event timestamp based on the security event type information; S103. Construct a structured security event from the original security log based on the event type identifier, event timestamp, and security event entity information; S104. Summarize the structured security events of each original security log to obtain the structured security event set.

3. The network security log noise reduction method according to claim 1, characterized in that: Step S30 specifically includes the following steps: S301. Under the topological constraints of the asset event context network, select events that have a path related to the core assets from the structured security event set to obtain the event set to be analyzed. S302. Sort the events in the set of events to be analyzed by timestamp, and perform time-series correlation according to a preset time continuity threshold to generate a candidate event timeline. S303. Based on the compliant interaction flow between entities defined in the asset event context network, perform compliance verification on the flow path of events in the candidate event timeline to obtain the compliant event flow; S304. Based on the predefined attack patterns in the attack behavior knowledge base, perform pattern matching on the compliant event flow to identify continuous event subsequences with abnormal interaction intent characteristics. S305. Perform causal logic consistency verification on the event subsequence, and take the continuous event subsequence that passes the verification as the abnormal event chain.

4. The network security log noise reduction method according to claim 3, characterized in that: Step S304 specifically includes the following steps: Based on the metadata of each security event in the compliance event stream, behavioral features are extracted and formatted to obtain a standardized sequence of behavioral features. Based on the time sequence of the compliance event flow, the standardized behavioral feature sequence is sorted and reorganized to obtain a time-sequential behavioral feature chain; The temporalized behavioral feature chain is compared with the predefined suspicious behavioral patterns in the behavioral knowledge base, and the similarity score between the behavioral feature chain and each suspicious behavioral pattern in the interaction intent dimension is calculated. Based on the similarity scores, the confidence scores of behavioral intentions are fused to obtain the overall confidence score of the temporalized behavioral feature chain representing the abnormal interaction intentions. The overall confidence level is compared with a preset judgment threshold, and the continuous event sequences that meet the confidence level are identified and output as continuous event subsequences with abnormal interaction intent characteristics.

5. The network security log noise reduction method according to claim 1, characterized in that: Step S50 specifically includes the following steps: Based on the asset event context network, the interaction trajectory of high-trust threat activities within it is reconstructed; Based on the interaction trajectory, generate an activity process summary; Extract raw alert data related to the high-confidence threat activities as supporting evidence; Based on the activity process summary and supporting evidence, generate an analysis report that includes a timeline, scope of impact, and recommendations for handling the situation.

6. A network security log noise reduction device based on alarm aggregation and correlation analysis, characterized in that, include: The data preprocessing module is used to obtain a structured set of security events based on multi-source security alarm data; The graph construction module is used to generate an asset event context network based on a predefined core resource record table and the structured security event set. The graph construction module is also used to generate a global relationship graph based on the entity connection relationships in the structured security event set; Based on the core resource record table, determine the core asset nodes in the global relationship graph; Centered on the core asset node, its associated entities and corresponding event nodes are extracted to form an initial context graph; the association strength between each associated entity in the initial context graph and the core asset node is calculated, and the structure of the initial context graph is updated according to the association strength to obtain the asset event context network; The correlation analysis module is used to identify abnormal events in each event in the structured security event set based on the asset event context network, and obtain an abnormal event chain. The risk assessment module is used to assess the threat confidence of the abnormal event chain, obtain the risk assessment result of the abnormal event chain, and determine the abnormal event chain with a confidence level higher than the threshold as a high-confidence attack chain; The risk assessment module is also used to perform attack behavior simulation based on the abnormal event chain, identify the key entity nodes that successfully execute the attack behavior in the abnormal event chain, and obtain the security configuration information of the key entity nodes, as well as the security case records corresponding to the entity type to which the key entity nodes belong. Based on the security configuration information, simulated attacks are performed on the critical entity nodes to obtain a defense strength score; and a historical defense record score is obtained based on the security case records corresponding to the entity type to which the critical entity nodes belong. The risk assessment result of the abnormal event chain is obtained based on the defense strength score and the historical defense record score; The event report generation module is used to generate a security event report based on the multi-source security alarm data corresponding to the high-confidence attack chain.

7. A network security log noise reduction device based on alarm aggregation and correlation analysis, characterized in that, include: The network security log noise reduction program based on alarm aggregation and correlation analysis, stored on the memory and running on the processor, is configured to implement the steps of the network security log noise reduction method, apparatus, device and storage medium as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium stores a network security log noise reduction program based on alarm aggregation and correlation analysis. When the network security log noise reduction program based on alarm aggregation and correlation analysis is executed by the processor, it implements the steps of the network security log noise reduction method, apparatus, device and storage medium as described in any one of claims 1 to 5.

Images