A network attack alarm noise reduction method and system based on association fusion analysis, an electronic device, and a storage medium

Abstract

The application provides a network attack alarm noise reduction method and system based on correlation fusion analysis, an electronic device and a storage medium. The method comprises the following steps: aggregating and time-sequencing original network attack alarm logs; performing fast Fourier transform on the alarm time sequence to extract amplitude spectrum and perform periodicity detection; calculating the correlation of candidate periodic values by using the Pearson correlation coefficient and filtering false positives; extracting statistical features of non-periodic alarm sequences and comprehensively determining by using a multi-agent collaborative mechanism based on a large language model; and finally merging and analyzing the results to output a real alarm set. The application greatly reduces the dependence of the model on full-quantity labeled samples, realizes semantic-level automatic correlation fusion, and has high accuracy and strong interpretability.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a network attack alarm noise reduction method, system, electronic device and storage medium based on correlation fusion analysis. Background Technology

[0002] As the core platform in a modern enterprise network security architecture, the Security Operations Center (SOC) is responsible for 24 / 7 monitoring of all activities across endpoints, servers, databases, web applications, websites, and other systems to detect potential threats in real time. It plays a crucial role in assisting enterprises in preventing, detecting, and rapidly responding to network security incidents. However, with the increasing complexity, novelty, sophistication, and stealth of network security threats, and the inherent rule-based or signature-based detection limitations of security devices such as intrusion detection systems and intrusion prevention systems, SOCs face a severe challenge in practice: a large number of false alarms. False network attack alerts not only consume resources and time to process but also reduce the sensitivity of security analysts to real attacks, diverting their attention from genuine security threats. Therefore, how to quickly and accurately eliminate false alarms from a massive volume of alerts has become a critical issue that urgently needs to be addressed in the field of network security operations.

[0003] Mainstream network attack alert noise reduction methods mainly fall into three categories: feature-based, context-based, and multi-source log correlation analysis-based. (1) Feature-based approaches extract features by analyzing the differences between false alarms and real alarms in multiple dimensions, and then use machine learning or deep learning models for classification. However, these methods have extremely high requirements for model fit, algorithm parameters, and sample quality, and it is difficult to achieve good results quickly in real-world environments.

[0004] (2) Context-based solutions assist in judgment by analyzing session information, asset information and other information associated with alarms. However, the context required for different types of alarms varies significantly, and the log formats of heterogeneous security devices are different, making it difficult to build a universal detection solution.

[0005] (3) Based on multi-source log association analysis, the scheme comprehensively analyzes heterogeneous data sources and uses rules or graph models to improve accuracy. However, the inconsistency of multi-source heterogeneous data in terms of time, space and semantics makes data association and fusion face huge challenges such as entity alignment and redundancy resolution. Moreover, it relies too much on manually predefined rules and is difficult to adapt to new types of attacks.

[0006] Existing technologies still face challenges such as a strong dependence on a full range of high-quality labeled samples and the difficulty in automatically associating, fusing, and reasoning with multi-source heterogeneous data. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention proposes a technical solution for network attack alarm noise reduction based on correlation fusion analysis.

[0008] The first aspect of this invention discloses a network attack alarm noise reduction method based on correlation fusion analysis. This method employs behavioral analysis and agent correlation judgment to filter and reduce noise from massive attack alarm logs reported by various security devices in a Security Operation Center (SOC), thereby improving the accuracy of network attack alarm judgment. The method includes: Step S1, Alarm Grouping and Time Sequence Construction: Preprocess the received raw network attack alarm logs, aggregate the raw network attack alarm logs according to preset dimensions, count the number of alarms within a continuous time window, and construct a structured alarm time sequence. Step S2: Periodicity detection based on Fast Fourier Transform (FFT): Perform Fast Fourier Transform on the alarm time series, extract the amplitude spectrum in the frequency domain, and determine whether there is a spectral peak in the amplitude spectrum that meets the significance threshold; if not, it is determined to be a non-periodic sequence and proceeds to step S4; if it exists, calculate the corresponding candidate period value and proceeds to step S3. Step S3: Periodic alarm noise reduction based on Pearson correlation coefficient: The alarm time series is grouped using the candidate period values, and the Pearson correlation coefficient between the subsequences is calculated; if it is determined to be strongly correlated and meets the preset filterable conditions, it is marked as a periodic false alarm and filtered; otherwise, proceed to step S4. Step S4: Non-periodic alarm noise reduction based on multi-agent collaboration: Extract multi-dimensional statistical features of the non-periodic alarm sequence, and concatenate the multi-dimensional statistical features with the original alarm fields to form an enhanced alarm feature vector; use a multi-agent system driven by a large language model (LLM) to perform multi-dimensional comprehensive judgment on the enhanced alarm feature vector and output the final judgment conclusion. Step S5, Alarm Merging: Based on the analysis results of Steps S3 and S4, remove false alarms marked as filtered and output the final set of real alarms.

[0009] Furthermore, in step S1, a sliding window method is used to count the number of alarms. The length of the time window is greater than the sliding step size, and there is overlap between adjacent time windows to smooth out the count fluctuations caused by the delayed arrival of alarms.

[0010] Furthermore, the specific process of step S2 is as follows: A fast Fourier transform is performed on the alarm time series to obtain a discrete spectrum, and the single-sided amplitude spectrum is calculated. The maximum value in the single-sided amplitude spectrum, excluding the DC component, and its corresponding index are found. If the maximum value is greater than a set peak significance threshold, a candidate period value is calculated based on the sampling time interval of the alarm time series and the index. Find the maximum value in the amplitude spectrum excluding the DC component and its corresponding index. If the maximum value is greater than the set peak significance threshold, calculate the candidate period value based on the sampling time interval of the original sequence and the index.

[0011] Furthermore, in step S3, when calculating the Pearson correlation coefficient between two periodic subsequences, a time lag tolerance mechanism is introduced to search for the maximum correlation coefficient within a set time unit range as the final similarity measure. The filterable conditions include: the alarm source IP belongs to a known whitelist, or the attack type is low-risk detection type; if the target asset level is greater than a preset threshold or the attack type involves core permissions, then it is forcibly retained and the process proceeds to step S4.

[0012] Furthermore, the multidimensional statistical features in step S4 include: spectral energy concentration, sequence variation coefficient, and peak-to-valley difference; The multi-agent system includes a main agent, a knowledge retrieval agent, an association query agent, and a reasoning agent; The main agent adopts a two-stage pipeline scheduling architecture: the first stage calls the knowledge retrieval agent to obtain the list of related plugins for expert judgment process and suggestion calls; the second stage uses the return results of the first stage as the context background to call the related query agent and reasoning agent in parallel, and finally outputs the judgment conclusion based on the preset fusion rules.

[0013] Furthermore, the knowledge retrieval agent has a built-in alarm analysis knowledge base based on expert experience. The knowledge base records attack types, verification steps, a list of associated plugins, ATT&CK tactical phase tags, and asset importance tags. During the vector embedding process, the knowledge retrieval agent uses a multi-task joint encoding method to weight and sum the attack type text, verification step text, ATT&CK tag encoding, and asset level encoding to obtain a comprehensive embedding vector. During the retrieval stage, if the current alarm preliminary tag overlaps with the knowledge base record tag, a soft weighting enhancement strategy is applied based on the similarity.

[0014] Furthermore, the reasoning agent incorporates a binary classification model fine-tuned based on the BERT architecture. The input to the binary classification model is a structured text sequence formed by concatenating the enhanced alarm feature vectors. The multidimensional statistical features are converted into vectors of the same dimension as the BERT pooling output and input into a fully connected classification layer. The output is the probability confidence of "false positive" or "true alarm" and a summary of the judgment basis generated by the interpretation generation module.

[0015] Furthermore, the pre-defined fusion rules of the main intelligent agent adopt a two-layer fusion architecture: The first layer is a hard veto: if the external evidence returned by the associated query agent hits a high-confidence malicious indicator, it will be directly judged as a real alarm. The second layer is soft weighted voting: if a hard veto is not triggered, the evidence weight matrix pre-set for the current attack type is read, and the maliciousness of the related query evidence, the matching degree of the knowledge retrieval process, and the probability value of the reasoning agent are linearly weighted and summed. A penalty term is applied according to the multidimensional statistical features, and the final judgment conclusion is output through the set global judgment threshold.

[0016] Furthermore, when the main agent receives the task and performs preprocessing, the alarm statistics and original context log information are converted into a structured text sequence. This is not a simple text concatenation, but rather a serialization template format with specific identifiers. Specifically, after extracting key fields such as source IP, destination IP, attack type, and alarm time, they are concatenated using a start identifier [CLS] and a field separator [SEP]. For example, the generated structured text sequence format is: [CLS] Source IP: {src_ip} [SEP] Destination IP: {dst_ip} [SEP] Attack Type: {attack_type} [SEP] Alert Time: {alert_time} [SEP]. This special token sequence format design allows the subsequent large language model to more accurately distinguish feature boundaries of different dimensions, effectively reducing the attention distraction problem when processing long text logs, thereby improving the accuracy of multi-agent collaborative reasoning.

[0017] A second aspect of this invention discloses a network attack alarm noise reduction system based on correlation fusion analysis, wherein the system employs the method described in any one of the first aspects above; the system includes: The time series construction module is used to aggregate the received raw alarm logs, count the number of alarms within a continuous time window, and construct an alarm time series. The first noise reduction module is used to identify candidate periodic values ​​of the sequence using FFT and to perform the first round of filtering of false alarms with stable and strong periodicity by combining the Pearson correlation coefficient. The second noise reduction module is used to extract multi-dimensional statistical features for the non-periodic alarm sequences of the diverted data, and to schedule the built-in multi-agent architecture to perform heterogeneous data semantic association and comprehensive voting reasoning to complete the second round of noise reduction judgment. The merge output module is used to merge the results of the above modules and output the actual alarm set.

[0018] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the network attack alarm noise reduction method based on correlation fusion analysis according to any one of the first aspects of this disclosure.

[0019] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a network attack alarm noise reduction method based on correlation fusion analysis according to any one of the first aspects of this disclosure.

[0020] The beneficial effects of this invention are as follows: (1) Significantly reduces the model's dependence on fully labeled samples: This invention proposes a dual-stream architecture of physical and logical traffic splitting followed by governance. By using time-series features with extremely low computational cost (FFT and Pearson correlation), it filters out 70%-80% of regular scanning false alarms in milliseconds. This not only solves the computational bottleneck of massive concurrent alarms, but also allows subsequent fine-tuning tasks of large models to focus on small-sample binary classification of non-periodic alarms, reducing the sample requirement by two orders of magnitude and achieving a fundamental leap from "strong dependence" to "weak dependence".

[0021] (2) Achieved true “semantic-level automatic association and fusion”: It abandoned the traditional method of relying on manual hard coding to achieve entity alignment, and used the natural language understanding ability of the main intelligent agent to uniformly map structured external intelligence, semi-structured knowledge graph and model classification probability into the natural language semantic space for processing.

[0022] (3) Combining high accuracy and strong interpretability: The knowledge retrieval agent introduces a multi-dimensional weighted retrieval strategy based on ATT&CK tags and asset levels. The reasoning agent outputs a semantic summary of the model's focus, and the main agent enforces voting according to a rule-based weight matrix. This system can not only provide accurate conclusions but also output a detailed chain of evidence for security analysts to review. Attached Figure Description

[0023] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart of the network attack alarm noise reduction method based on correlation fusion analysis in this embodiment of the invention. Figure 2 This is a diagram of the non-periodic false alarm analysis architecture based on multi-agent collaboration in this invention embodiment; Figure 3 This is a structural diagram of a network attack alarm noise reduction system based on correlation fusion analysis according to an embodiment of the present invention; Figure 4 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] The first aspect of this invention discloses a method for reducing noise in network attack alarms based on correlation fusion analysis.

[0027] Example 1: like Figure 1 As shown, this invention provides a network attack alarm noise reduction method based on correlation fusion analysis, which specifically includes five core steps: Step S1, Alarm Grouping and Time Sequence Construction: Preprocess the received raw network attack alarm logs, aggregate the raw network attack alarm logs according to preset dimensions, count the number of alarms within a continuous time window, and construct a structured alarm time sequence. First, the raw alarm logs received by the SOC are preprocessed. The alarm logs are then aggregated according to a triplet of (source IP, destination IP, attack type). To address the counting fluctuations caused by network latency and device time asynchrony, a sliding window method is used to count alarms. The window length is set to 1 hour, the sliding step to 30 minutes, and the window overlap rate to 50%, forming an alarm time series. ,in Let N represent the number of alarms in the i-th hour, and N represent the length of the time series.

[0028] Step S2, Periodicity detection based on Fast Fourier Transform: Perform Fast Fourier Transform on the alarm time series, extract the amplitude spectrum in the frequency domain, and determine whether there is a spectral peak in the amplitude spectrum that meets the significance threshold; if not, it is determined to be a non-periodic sequence and proceeds to step S4; if it exists, calculate the corresponding candidate period value and proceeds to step S3. By obtaining a discrete time series of length N The original sequence is directly converted to the frequency domain using an FFT. An FFT is then performed on the original sequence to obtain a discrete spectrum, and the single-sided amplitude spectrum is calculated. The maximum amplitude in the amplitude spectrum, excluding the DC component, and its corresponding index are found. A peak significance threshold is set; if the value does not exceed the threshold, the sequence is determined to be a non-periodic sequence and proceeds directly to step S4. If the threshold is met, the corresponding peak frequency and time period (main period value) are calculated based on the sampling time interval (1 hour in this example), and the process proceeds to step S3.

[0029] Step S3: Periodic alarm noise reduction based on Pearson correlation coefficient: The alarm time series is grouped using the candidate period values, and the Pearson correlation coefficient between the subsequences is calculated; if it is determined to be strongly correlated and meets the preset filterable conditions, it is marked as a periodic false alarm and filtered; otherwise, proceed to step S4. Not all periodic alarms are false alarms. Step S3 groups the time series by candidate period and calculates the Pearson correlation coefficient between the subsequences. A time lag tolerance mechanism is introduced during the calculation: it allows searching for the maximum correlation coefficient within a range of ±1 time unit (±1 hour).

[0030] If the similarity r > 0.85 (showing strong periodicity), and the alarm source IP belongs to a known internal scanner / operation whitelist, or the attack type is a low-risk detection type (such as ICMP scanning), then it is marked as a filterable false alarm.

[0031] Exception mechanism: If the target asset is a core business server or involves high-risk alerts such as data leakage or permission maintenance, it will be forcibly retained even if it has strong periodicity, and the process will proceed to step S4.

[0032] Step S4: Non-periodic alarm noise reduction based on multi-agent collaboration: Extract multi-dimensional statistical features of the non-periodic alarm sequence, and concatenate the multi-dimensional statistical features with the original alarm fields to form an enhanced alarm feature vector; use a multi-agent system driven by a large language model to perform multi-dimensional comprehensive judgment on the enhanced alarm feature vector and output the final judgment conclusion. like Figure 2 As shown, a multi-agent collaborative judgment mechanism is constructed for non-periodic alarms (irregular, sporadic, or complex advanced threats).

[0033] First, inheriting the features from the preceding steps, three-dimensional statistical features are extracted: spectral energy concentration, sequence variation coefficient, and peak-to-valley difference. These features are then concatenated into an enhanced alarm feature vector.

[0034] (1) Main agent scheduling (two-stage pipeline): The main intelligent agent adopts an open-source large model (such as Qwen2 or DeepSeek) and is configured with system prompt word parsing alarm triples and statistical features.

[0035] Phase 1: Invoking the knowledge retrieval intelligent agent.

[0036] The second stage involves inputting the context returned from the first stage into the relational query agent and the inference agent in parallel.

[0037] (2) Knowledge retrieval agent execution: It incorporates an expert experience base based on a vector database (such as FAISS). The knowledge base records include verification steps, ATT&CK tags, asset importance, etc. Multi-task joint encoding is employed: text semantic weight is set to 0.5, ATT&CK tag weight to 0.3, and asset grade weight to 0.2. A soft weighting enhancement strategy is used during retrieval; if ATT&CK tags overlap, the similarity score is increased by 0.15 to ensure that rules with high semantic relevance are recalled.

[0038] (3) Execution of the associated query agent: Built-in plugin manager: IOC matching plugin (connects to VirusTotal / Microstep to obtain malicious tags online), IP address query plugin (obtains ASN / organization), and network behavior query plugin (analyzes NetFlow internal and external data). It automatically selects plugins from the suggestion list of the knowledge retrieval agent and returns JSON-formatted evidence.

[0039] (4) Execution of the reasoning agent: It incorporates a BERT-based fine-tuned classifier. Sequences begin with the [CLS] marker, and specific fields are separated by [SEP], such as: "[CLS] Source IP: xxx [SEP] Destination IP: xxx [SEP] Attack Type: SSH brute-force attack...". Furthermore, the 3D statistical features initially extracted by S4 are linearly mapped and added to the BERT pooling output. The final output is the probability confidence score for "false positive" or "true alert," and an interpretation generation module is used to generate a judgment summary (e.g., indicating anomalies in payload distribution).

[0040] (5) Comprehensive fusion judgment of the main intelligent agent: It adopts a "hard veto + soft weighted voting" structure.

[0041] First level (hard rejection): If the correlation query returns at least 3 independent threat intelligence sources marked as malicious or high-risk, it is directly judged as a "real alert".

[0042] The second layer (weighted voting) reads a pre-set weight matrix based on the attack type. For example, in "SSH brute-force attack," IP reputation has a weight of 0.45, knowledge flow 0.30, and reasoning agent 0.25; while in "SQL injection," the weight of the reasoning agent is increased to 0.50 due to its reliance on payload analysis. The scores are linearly added to obtain a comprehensive score. If the statistical characteristics show irregular extreme fluctuations, a penalty of -0.1 is applied. A final score ≥ 0.65 is considered a genuine alert; otherwise, it is considered a false positive (scores between 0.45 and 0.65 are labeled for manual review).

[0043] Step S5, Alarm Merging: Based on the analysis results of Steps S3 and S4, remove false alarms marked as filtered, output the final set of real alarms, and output the final alarm set with low noise and high purity to the security analyst.

[0044] Example 2: Figure 1 This is a flowchart of a network attack alarm noise reduction method based on correlation fusion analysis according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes: Step S1, Alarm Grouping and Time Sequence Construction: The received raw network attack alarm logs are preprocessed and aggregated according to preset dimensions. The number of alarms is counted within a continuous time window to construct a structured alarm time sequence. The alarm count is counted using a sliding window method. The length of the time window is greater than the sliding step size, and there is overlap between adjacent time windows to smooth out the count fluctuations caused by alarm delays.

[0045] In this embodiment, the raw alarm logs received by the SOC are first preprocessed. The alarm logs are aggregated according to the triplet (source IP, destination IP, attack type), and the number of alarms for each triplet within a continuous time window is counted hourly to form an alarm time series. ,in Indicates the first alarm count per hour This indicates the length of the time series. This step transforms massive amounts of discrete alarm logs into structured time-series data, laying the foundation for subsequent periodic analysis. It can be expanded to quintuples or aggregated by asset group depending on network size.

[0046] In real-world network environments, alarm logs may exhibit timestamp discrepancies due to network latency, device time asynchrony, or log collection jitter, causing the original alarms to miss the time window corresponding to their actual occurrence. To address this issue, this step employs a sliding window approach to count alarms during time series construction. The window length is set to 1 hour, the sliding step to 30 minutes, and the window overlap rate to 50%. This overlap-based statistical approach smooths out count fluctuations caused by alarms arriving late near the window boundaries.

[0047] Step S2, Periodicity detection based on Fast Fourier Transform: Perform Fast Fourier Transform on the alarm time series, extract the amplitude spectrum in the frequency domain, and determine whether there is a spectral peak in the amplitude spectrum that meets the significance threshold; if not, it is determined to be a non-periodic sequence and proceeds to step S4; if it exists, calculate the corresponding candidate period value and proceeds to step S3. Specifically, a fast Fourier transform is performed on the alarm time series to obtain a discrete spectrum, and a single-sided amplitude spectrum is calculated. The maximum value in the single-sided amplitude spectrum, excluding the DC component, and its corresponding index are found. If the maximum value is greater than a set peak significance threshold, a candidate period value is calculated based on the sampling time interval of the alarm time series and the index. Find the maximum value in the amplitude spectrum excluding the DC component and its corresponding index. If the maximum value is greater than the set peak significance threshold, calculate the candidate period value based on the sampling time interval of the original sequence and the index.

[0048] Specifically, obtain the length as Discrete time series The time-domain sequence is directly transformed to the frequency domain by performing an FFT, and then the principal period of the sequence is identified and calculated by analyzing the amplitude distribution characteristics of the spectrum. First, an FFT is performed on the original sequence to obtain the discrete spectrum. ,in It is a discrete frequency index in the frequency domain. It is the imaginary unit.

[0049]

[0050] Then, the one-sided magnitude spectrum is calculated. Since the input sequence is a real sequence, its spectrum is conjugate symmetric, requiring only the use of... Previous frequency point. Amplitude spectrum. Defined as:

[0051] Then the amplitude spectrum was found. DC component excluded Maximum value outside of) and its corresponding index :

[0052] Set a peak significance threshold, if If the value does not exceed the threshold, it is determined that there are no significant peaks in the spectrum, and the sequence is a non-periodic sequence, thus it is diverted to the non-periodic alarm processing flow (S4). If the threshold condition is met, candidate period values ​​are calculated based on this. The calculation method is based on the sampling time interval of the original sequence. In the invention, the sampling time interval is 1 hour, and the peak frequency is... and the corresponding time period They are respectively:

[0053]

[0054] The principal period value of the sequence can be obtained through the above calculations. And then proceed to the next stage of periodic verification.

[0055] Step S3: Periodic alarm noise reduction based on Pearson correlation coefficient: The alarm time series is grouped using the candidate period values, and the Pearson correlation coefficient between the subsequences is calculated; if it is determined to be strongly correlated and meets the preset filterable conditions, it is marked as a periodic false alarm and filtered; otherwise, proceed to step S4. When calculating the Pearson correlation coefficient between two periodic subsequences, a time lag tolerance mechanism is introduced to search for the maximum correlation coefficient within a set time unit range as the final similarity measure. The filterable conditions include: the alarm source IP belongs to a known whitelist, or the attack type is low-risk detection type; if the target asset level is greater than a preset threshold or the attack type involves core permissions, then it is forcibly retained and proceeds to step S4.

[0056] Specifically, since not all periodic alarms detected by FFT are false alarms, the Pearson correlation coefficient is used to perform a secondary verification of the stability of candidate periods to avoid filtering out genuine periodic attacks. For time series... Assuming there is a period p, group the sequence. , equivalent to Where m is the number of groups. The similarity calculation formula is:

[0057] Where r is the correlation coefficient. This represents the mean of the i-th group. The value of r determines the correlation between the variables. If the similarity is greater than 0.85, it is considered to be strongly correlated, and the periodic value is considered correct. If the sequence is strongly periodic (r>0.85), and the alarm source IP belongs to a known internal scanner / operation whitelist, or the attack type is a low-risk detection type (such as ICMP scanning), it is marked as a filterable false alarm; if the target asset is a core business server or the attack type involves data leakage or privilege escalation, even if it is periodic, it must be forcibly retained and transferred to step S4 for in-depth analysis, and cannot be directly filtered.

[0058] In practical calculations, if alarm delays cause slight shifts in the time axis of data points in the same phase across different periods (for example, the data in the i-th hour of period 1 actually corresponds to the data in the (i+1)-th hour of period 2), directly performing point-by-point Pearson correlation calculations may underestimate the true correlation between sequences. Therefore, this invention introduces a time lag tolerance mechanism when calculating the correlation coefficient: when calculating the Pearson correlation coefficient between two periodic subsequences, it allows searching for the maximum correlation coefficient within ±1 time unit (i.e., ±1 hour). Specifically, using one subsequence as a baseline, the other subsequence is shifted forward or backward by a maximum of 1 unit in the time domain, and the maximum Pearson correlation coefficient at each position after the shift is calculated as the final similarity measure.

[0059] Step S4: Non-periodic alarm noise reduction based on multi-agent collaboration: Extract multi-dimensional statistical features of the non-periodic alarm sequence, and concatenate the multi-dimensional statistical features with the original alarm fields to form an enhanced alarm feature vector; use a multi-agent system driven by a large language model to perform multi-dimensional comprehensive judgment on the enhanced alarm feature vector and output the final judgment conclusion. Among them, the multidimensional statistical characteristics include: spectral energy concentration, sequence variation coefficient, and peak-to-valley difference; The multi-agent system includes a main agent, a knowledge retrieval agent, an association query agent, and a reasoning agent; The main agent adopts a two-stage pipeline scheduling architecture: the first stage calls the knowledge retrieval agent to obtain the list of related plugins for expert judgment process and suggestion calls; the second stage uses the return results of the first stage as the context background to call the related query agent and reasoning agent in parallel, and finally outputs the judgment conclusion based on the preset fusion rules.

[0060] The knowledge retrieval agent has a built-in alarm analysis knowledge base based on expert experience. The knowledge base records attack types, verification steps, a list of associated plugins, ATT&CK tactical phase tags, and asset importance tags. During the vector embedding process, the knowledge retrieval agent uses a multi-task joint encoding method to weight and sum the attack type text, verification step text, ATT&CK tag encoding, and asset level encoding to obtain a comprehensive embedding vector. During the retrieval stage, if the current alarm preliminary tag overlaps with the knowledge base record tag, a soft weighting enhancement strategy is applied based on the similarity.

[0061] In some specific embodiments, the reasoning agent has a built-in binary classification model fine-tuned based on the BERT architecture. The input of the binary classification model is a structured text sequence formed by concatenating the enhanced alarm feature vectors. The multidimensional statistical features are converted into vectors of the same dimension as the BERT pooling output and input into the fully connected classification layer. The output is the probability confidence of "false positive" or "real alarm" and a summary of the judgment basis generated by the interpretation generation module. The pre-defined fusion rules of the main intelligent agent adopt a two-layer fusion architecture: The first layer is a hard veto: if the external evidence returned by the associated query agent hits a high-confidence malicious indicator, it will be directly judged as a real alarm. The second layer is soft weighted voting: if a hard veto is not triggered, the evidence weight matrix pre-set for the current attack type is read, and the maliciousness of the related query evidence, the matching degree of the knowledge retrieval process, and the probability value of the reasoning agent are linearly weighted and summed. A penalty term is applied according to the multidimensional statistical features, and the final judgment conclusion is output through the set global judgment threshold.

[0062] In some specific embodiments, for non-periodic alarms (including irregular sporadic false alarms and complex advanced persistent threats) diverted from steps S2 and S3, this invention constructs a multi-agent collaborative judgment mechanism based on LLM. It is worth emphasizing that the periodic detection in steps S2 and S3 not only serves as a pre-filter for alarm diversion, but the sequence statistical features generated during their calculation are also inherited as structured context features in the in-depth judgment of step S4, forming data coupling and knowledge inheritance between the preceding and following stages. Specifically, for each alarm sequence determined to be non-periodic by steps S2 and S3, the system automatically extracts the following statistical feature vectors: spectral energy concentration (the proportion of the energy of the first three largest peaks in the amplitude spectrum to the total energy), reflecting the degree of energy distribution concentration of the sequence; the sequence variation coefficient (the ratio of the standard deviation to the mean of the alarm quantity time series), reflecting the severity of fluctuations in the alarm quantity; and the peak-to-valley difference (the difference between the maximum and minimum values ​​of the sequence), reflecting the dynamic range of the alarm quantity.

[0063] The aforementioned three-dimensional statistical features are concatenated with the original alarm fields (source IP, destination IP, attack type, etc.) to form an enhanced alarm feature vector, which is then input into the inference agent (BERT classifier) ​​and the main agent in stage S4. For the BERT classifier, this statistical feature vector is converted into a vector of the same dimension as the BERT pooling output through a linear mapping layer. The two are then added together and input into the fully connected classification layer, allowing the model to obtain overall statistical distribution information of the alarm sequence in addition to semantic features. For the main agent, this statistical feature vector is converted into a natural language description, embedded as additional background information in the input prompts of the main agent, and used as an auxiliary criterion in the final fusion rule.

[0064] As attached Figure 2 As shown, the specific implementation details of this step are as follows: (1) Selection and Construction of Underlying Model: This invention is not limited to a specific AI model vendor or version, but rather designs the architecture based on functional modules. The main agent can be a large language model with strong reasoning capabilities and tool call interfaces. This model needs to be able to parse complex natural language instructions, decompose sub-tasks, and schedule external tools. The reasoning agent can be a text classification model based on supervised learning fine-tuning. This model uses a pre-trained language model (such as the Encoder architecture) to extract deep semantic features of alarm texts and outputs classification probabilities through a fully connected layer. At the same time, an explanation generation module is configured to output a summary of the judgment basis. The knowledge retrieval agent can be a dense retrieval technology stack, including a vector embedding model and a vector database, to achieve semantic similarity matching of expert knowledge bases. In the preferred embodiment, the main agent can adopt an open-source large model (such as Qwen2-72B or DeepSeek-V3) with local private deployment capabilities or a commercial closed-source model with equivalent performance. The reasoning agent is fine-tuned based on the BERT-base architecture. The vector embedding model specifically adopts BGE-large, and the vector database adopts FAISS. However, those skilled in the art should understand that the above specific implementation is merely an example, and any model replacement that can achieve the same function should fall within the protection scope of this invention.

[0065] (2) Task decomposition and scheduling of the main agent: In order to achieve efficient collaboration among multiple agents, this invention adopts a two-stage pipeline scheduling architecture instead of simple parallel calls. First stage: The main agent first calls the knowledge retrieval agent to obtain the expert judgment process and the list of related plugins to be called for the current alarm type; Second stage: The main agent uses the return result of the knowledge retrieval agent as the context background and calls the related query agent (passing in the list of suggested plugins to guide the selection of plugins) and the reasoning agent (passing in the alarm structured text) in parallel to shorten the overall processing latency.

[0066] The main agent is configured with a system prompt: You are a network security alert analysis expert. Your task is to analyze given alert information and, following a two-stage process, schedule available auxiliary agents to complete false alarm detection. There are three available auxiliary agents: First, a knowledge retrieval agent, which inputs the attack type and returns the corresponding expert analysis process and a list of recommended plugins; second, an association query agent, which inputs the alert information and a list of recommended plugins, automatically performing IOC matching, IP reputation query, and NetFlow behavior analysis, and returning external evidence; third, an inference agent, which inputs the structured text and statistical feature description of the alert and returns a preliminary judgment of "false positive" or "true alert," confidence level, and a summary of the analysis basis. Please follow these steps: First, parse the alert, extracting key fields and three-dimensional statistical features; then, enter the first stage, calling the knowledge retrieval agent; then, enter the second stage, calling the association query agent and the inference agent in parallel based on the knowledge retrieval results; finally, synthesize the three types of returned results and output the final judgment conclusion and reasons according to the preset fusion rules. The main agent receives an alarm record in JSON format, which includes source IP, destination IP, attack type, timestamp, alarm description, and three-dimensional statistical characteristics (spectral energy concentration, coefficient of variation, peak-valley difference), and automatically generates invocation instructions for each auxiliary agent based on this.

[0067] To achieve standardized communication and data interaction among multiple agents, this invention defines a unified JSON data exchange format. When the main agent calls any auxiliary agent, the request message includes the following required fields: request_id is a unique request identifier used to associate the request and response; the caller field is fixed as "main agent," identifying the source of the call; the target field specifies the name of the target auxiliary agent; the action field describes the specific operation name requested; the payload field is a nested object containing an alert sub-object and a context sub-object. The alert sub-object records the core information of the alarm to be analyzed, including the source IP address, destination IP address, attack type, alarm timestamp, alarm description text, and three-dimensional statistical features. The context sub-object is used to carry the results returned in the previous stage (such as embedding the output of the knowledge retrieval agent in the context when calling the related query and inference agents in the second stage) to support pipelined information transmission; the timestamp field records the call initiation time. Each auxiliary agent's response message uniformly includes the following fields: request_id (fills in the corresponding request identifier), source field (indicates the name of the auxiliary agent from which the response originated), status field (takes the value "success" or "error" to indicate the execution status), result field (a nested object where the data field carries the specific result content returned by the agent, the data_type field indicates the data type of the result (e.g., text, json, or vector), the confidence field is an optional value between 0 and 1 representing the confidence level of the result, and the timestamp records the return time. After receiving the return results from the auxiliary agents, the main agent maps the heterogeneous data to the natural language semantic space using a preset prompt word template.

[0068] (3) Knowledge Retrieval Agent Execution: This agent has a built-in alarm analysis knowledge base constructed based on expert experience. Each record in the knowledge base contains the attack type, verification steps (described in natural language), a list of recommended related plugins, and ATT&CK tactical phase tags and asset importance tags. The vector embedding model concatenates the attack type and verification steps of each record into a 768-dimensional vector and stores it in the FAISS index. When an attack type is received, the knowledge retrieval agent performs the following operations: First, it converts the received attack type into a query vector using the same embedding model; then, it retrieves the top 3 records with the highest similarity in the FAISS index, with a similarity threshold of 0.75; finally, it returns the verification step field and the list of recommended plugins from the most matching record.

[0069] To construct the message returned to the main agent, the knowledge retrieval agent uses a short prompt: Based on the attack type "XXX attack type," the knowledge base suggests the following analysis process: First, check if the source IP is a known scanner address within the enterprise; second, query the login logs of the target host to confirm if there are any successful login records; third, if all login attempts fail and the source IP is an external address, mark it as suspicious. In actual use, the specific content will be dynamically filled in based on the search results.

[0070] Unlike the vector retrieval method in general RAG systems that is based solely on text semantic similarity, this invention constructs a multi-dimensional knowledge base index structure that integrates security tags and attack chain stage weights, specifically tailored to the domain characteristics of network security alert scenarios. Specifically, each record in the knowledge base is appended with two dimensions of structured tags before vectorization: the first is the ATT&CK tactical stage tag, where each record can be labeled with one or more tags, including but not limited to Reconnaissance, Initial Access, Execution, Persistence, and Command and Control, to reflect the multiple attack stages applicable to the assessment process; the second is the asset importance tag, divided into three levels: core business servers, general business servers, and test servers, to identify the asset environment applicable to the assessment process. During the vector embedding process, the aforementioned label information is not simply concatenated after the text, but is integrated into the embedding vector through a multi-task joint encoding method: the attack type text, verification step text, ATT&CK label encoding, and asset level encoding are mapped to vectors of the same dimension through four independent encoding sub-networks, and then the final comprehensive embedding vector is obtained by weighted summation, where the weight of the text semantic part is set to 0.5, the weight of the ATT&CK label is set to 0.3, and the weight of the asset level is set to 0.2.

[0071] During the retrieval phase, the knowledge retrieval agent employs a soft weighting enhancement strategy rather than hard exclusion. Specifically, if the initial ATT&CK stage label of the current alarm (obtained from alarm type mapping) overlaps with at least one label in the knowledge base record, an additional +0.15 similarity bonus is added to the cosine similarity; if there is no overlap, no bonus is added, but no record is excluded. The final ranking is based on the weighted total similarity, ensuring that even if the labels do not match perfectly, records with high semantic relevance can still be recalled, avoiding retrieval blind spots caused by hard filtering of single-stage labels. In addition, each record in the knowledge base also stores the minimum asset level requirement to which this judgment rule applies; only records with an asset level not lower than the target asset level of the current alarm are recalled during retrieval. Through the above multi-dimensional weighted retrieval mechanism based on security labels and the ATT&CK framework, the recall accuracy of the knowledge retrieval agent of this invention is significantly better than that of pure text semantic matching schemes, fully demonstrating the customized design for network security scenarios.

[0072] (4) Execution of the Correlation Query Agent: This agent has a built-in plugin manager that supports the following three types of plugins. The first type is the IOC matching plugin, which calls the threat intelligence API (such as VirusTotal or Microstep Online), inputs the IP address, domain name or file hash, and returns indicators such as malicious tags, first discovery time, and number of hits. The second type is the IP address query plugin, which queries the geographical location (including country and city), ASN, affiliated organization (such as cloud service provider or IDC), and historical blacklist records of the IP. The third type is the network behavior query plugin, which queries the communication behavior of the source IP within one hour before and after the alarm time through a pre-aggregated NetFlow data table, including the number of destination IPs connected, protocol distribution, traffic size, and whether there are periodic outbound connections. After receiving the alarm information from the main agent and the suggested plugin list returned by the knowledge retrieval agent, the correlation query agent automatically filters the sequence of plugins to be called according to the suggested list. If there is no suggested list, the default plugin is automatically selected according to the attack type. For example, for SSH brute-force attacks, the IP address query plugin and the network behavior query plugin are called first; for SQL injection attacks, the IOC matching plugin is called first. The call results are returned in structured JSON format, including IP query results (country, ASN, affiliated organization, number of malicious records) and network flow analysis results (number of unique destination IPs, total number of bytes, whether it is periodic).

[0073] (5) Execution of the inference agent: The inference agent internally loads a finely tuned BERT binary classification model. The model input is an enhanced alarm feature vector, in which the original alarm fields are concatenated into a structured text sequence according to a predetermined format, and the three-dimensional statistical features are converted into a vector of the same dimension as the BERT pooling output through a linear mapping layer. The two are added together and input into the fully connected classification layer. The model output layer is a binary softmax, which outputs the probabilities of "false positive" (label 0) and "true alarm" (label 1), respectively. The one with the higher probability is taken as the preliminary conclusion, and the probability value is attached as the confidence level. In addition to the conclusion and confidence level, the inference agent is equipped with a rule-based summary generation module. This module generates a readable summary of the judgment criteria based on the activation strength of the pooling vector at the [CLS] position of the model on several predefined key semantic dimensions (such as "whether the payload contains an attack signature", "whether the time pattern is abnormal", and "whether the statistical features deviate from the mean"). For example: "The BERT model detected that SQL keywords in the attack payload are mixed with normal business parameters at the [CLS] position. This pattern has a 78% correlation with false positives in the fine-tuned samples." If the confidence level is lower than 0.6, it is additionally marked "requires manual review" in the returned result. The message returned by the inference agent to the main agent will include the following information: preliminary conclusion ("false positive" or "real alarm"), confidence level (0~1 value), summary of the judgment criteria, and a mark indicating whether manual review is required.

[0074] (6) Comprehensive judgment by the main agent: After completing the two-stage call, the main agent collects the judgment process returned by the knowledge retrieval agent, the external evidence returned by the association query agent, the preliminary conclusion / confidence / basis summary returned by the reasoning agent, and the initial three-dimensional statistical features, and makes the final judgment according to the two-layer fusion architecture of "hard veto + soft weighted voting".

[0075] First layer (hard veto): If the IOC matching results returned by the associated query agent contain a high-confidence malicious indicator (defined as: at least 3 independent threat intelligence sources consistently mark it as malicious, or the threat intelligence source directly gives a "high risk" label), it will be directly judged as a "real alarm", the subsequent process will be terminated, and the final conclusion and the reason for the judgment will be output (with the evidence of the associated query).

[0076] The second layer (soft weighted voting): If no hard veto condition is triggered, the system proceeds to the weighted voting stage. The system pre-sets evidence weight matrices for different attack types to quantify the relative importance of various types of evidence in the final judgment. The weight matrices are stored in the main agent in the form of configuration files. For example, for "SSH brute-force" alerts, the weight of the associated query evidence (especially IP reputation) is 0.45, the weight of the knowledge retrieval process is 0.30, and the weight of the reasoning agent's conclusion is 0.25; for "SQL injection" alerts, the weight of the semantic analysis result of the reasoning agent is 0.50, and because its judgment relies more on payload text features, the weight of the knowledge retrieval process is 0.30, and the weight of the associated query evidence is 0.20. The main agent first reads the corresponding weight coefficients based on the attack type of the current alert, and then linearly weights the outputs of each auxiliary agent: multiplying the maliciousness of the associated query evidence (0 if there are no malicious indicators, 0.3 if there are low-risk indicators, and 0.7 if there are medium-risk indicators) by the corresponding weight, multiplying the matching degree of the knowledge retrieval process (based on similarity score normalization) by the weight, and multiplying the probability value of the reasoning agent outputting a "real alert" by the weight, and summing the three to obtain the comprehensive score. Simultaneously, three-dimensional statistical features are used as auxiliary criteria. If the spectral energy concentration of the sequence is below 0.2 and the coefficient of variation is greater than 1.0 (indicating that the alerts occur irregularly and fluctuate wildly), a penalty of -0.1 is applied to the comprehensive score to reduce the risk of occasional fluctuations being misjudged as real attacks.

[0077] A global judgment threshold of 0.65 is set. Cases with a comprehensive score ≥ 0.65 are output as "True Alarm," and those < 0.65 are output as "False Positive." Cases with scores between 0.45 and 0.65 are marked as "Requires Manual Review," prompting security analysts to conduct focused review. The final output of the main agent includes: the final judgment ("True Alarm" or "False Positive"), the comprehensive score, a detailed explanation (summarizing each piece of evidence and its weight contribution), and a flag indicating whether manual review is required.

[0078] The aforementioned two-layer fusion architecture is implemented through a structured decision table in the prompts provided by the main agent. This decision table is written in a formalized "condition-action" rule language, clearly defining the hard veto conditions, the logic for reading the weight matrix, and the scoring method. The main agent is forced to execute according to this decision table, rather than relying on the model's own "thinking" to arrive at the fusion conclusion, thereby ensuring the interpretability and reproducibility of the judgment results.

[0079] Suppose the inference agent returns a "false positive, confidence level 0.95, based on the summary, the payload pattern is close to the false positive sample," but the correlation query agent's IP query results show that the source IP hits high-threat intelligence (malicious label "Brute-Force-Bot"), and NetFlow behavior analysis shows that it initiated SSH connections to more than 500 different destination IPs within one hour. Since the correlation query evidence meets the hard rejection condition of "at least 3 independent threat intelligence sources consistently labeled" (in this example, both Microstep Online and VirusTotal give a malicious label), the main agent triggers the first-layer mechanism, directly outputting "real alert," along with the correlation query evidence as a reason, without further weighted voting. If, in this example, the correlation query evidence is only a low-risk indicator (such as the IP belonging to a cloud service provider but without a malicious label), then it enters the second-layer weighted voting, calculated according to the SSH brute-force attack weight matrix. If the final score is higher than 0.65, it is still judged as a real alert; otherwise, it is a false positive. This process demonstrates the main agent's ability and flexibility in prioritizing and deciding among multi-source heterogeneous evidence.

[0080] Step S5, Alarm Merging: Based on the analysis results of Steps S3 and S4, remove false alarms marked as filtered and output the final set of real alarms.

[0081] Example 3: Based on the above method, some application scenarios are shown below: A company's SOC received 12,847 "SSH brute-force attack" alerts targeting internal network server A in a single day.

[0082] After applying the system of this invention: In the S2 / S3 stage, the sequence of (internal network IP A1, server A) is identified as having a strong 24-hour period (correlation coefficient 0.93), and is quickly identified as an internal scanner, automatically filtering tens of thousands of records.

[0083] The occasional alarms (external IP address B, server A) are offloaded to S4. The main agent, following the knowledge base prompt, "verify external intelligence." The correlation query agent discovers that IP address B belongs to a cloud service provider and is marked as "Brute-Force-Bot" by the intelligence source. The inference agent outputs a real alarm with 95% confidence. Ultimately, through the first layer of hard veto, the system accurately retains 1587 real external network attack alarms, achieving an overall noise reduction rate of 87.7%. This process demonstrates that the present invention achieves excellent noise reduction performance and computational efficiency without requiring a large number of fully labeled samples.

[0084] The second aspect of this invention discloses a network attack alarm noise reduction system based on correlation fusion analysis. Figure 3 This is a structural diagram of a network attack alarm noise reduction system based on correlation fusion analysis according to an embodiment of the present invention; as shown below. Figure 3 As shown, the system 100 includes: The time series construction module 101 is used to aggregate the received raw alarm logs, count the number of alarms within a continuous time window, and construct an alarm time series. The first noise reduction module 102 is used to identify candidate period values ​​of the sequence using fast Fourier transform, and to perform the first round of filtering of false alarms with stable and strong periodicity by combining the Pearson correlation coefficient. The second noise reduction module 103 is used to extract multi-dimensional statistical features for the non-periodic alarm sequence of the diverted data, and to schedule the built-in large language model multi-agent architecture to perform heterogeneous data semantic association and comprehensive voting reasoning to complete the second round of noise reduction judgment. The merge output module 104 is used to merge the results of the above modules and output the actual alarm set.

[0085] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the network attack alarm noise reduction method based on correlation fusion analysis according to any one of the first aspects of this invention.

[0086] Figure 4 This is a structural diagram of an electronic device according to an embodiment of the present invention, such as... Figure 4 As shown, the electronic device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0087] Those skilled in the art will understand that Figure 4 The structure shown is merely a structural diagram of the part related to the technical solution of this disclosure and does not constitute a limitation on the electronic device to which the solution of this application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0088] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the network attack alarm noise reduction method based on correlation fusion analysis according to any one of the first aspects of this invention.

[0089] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A network attack alarm noise reduction method based on correlation fusion analysis, characterized in that, The method includes: Step S1, Alarm Grouping and Time Sequence Construction: Preprocess the received raw network attack alarm logs, aggregate the raw network attack alarm logs according to preset dimensions, count the number of alarms within a continuous time window, and construct a structured alarm time sequence. Step S2, Periodicity detection based on Fast Fourier Transform: Perform Fast Fourier Transform on the alarm time series, extract the amplitude spectrum in the frequency domain, and determine whether there is a spectral peak in the amplitude spectrum that meets the significance threshold; if not, it is determined to be a non-periodic sequence and proceeds to step S4; if it exists, calculate the corresponding candidate period value and proceeds to step S3. Step S3: Periodic alarm noise reduction based on Pearson correlation coefficient: The alarm time series is grouped using the candidate period values, and the Pearson correlation coefficient between the subsequences is calculated; if it is determined to be strongly correlated and meets the preset filterable conditions, it is marked as a periodic false alarm and filtered; otherwise, proceed to step S4. Step S4: Non-periodic alarm noise reduction based on multi-agent collaboration: Extract multi-dimensional statistical features of the non-periodic alarm sequence, and concatenate the multi-dimensional statistical features with the original alarm fields to form an enhanced alarm feature vector; use a multi-agent system driven by a large language model to perform multi-dimensional comprehensive judgment on the enhanced alarm feature vector and output the final judgment conclusion. Step S5, Alarm Merging: Based on the analysis results of Steps S3 and S4, remove false alarms marked as filtered and output the final set of real alarms.

2. The network attack alarm noise reduction method based on correlation fusion analysis according to claim 1, characterized in that, In step S1, a sliding window method is used to count the number of alarms. The length of the time window is greater than the sliding step size, and there is overlap between adjacent time windows to smooth out the count fluctuations caused by alarm delays.

3. The network attack alarm noise reduction method based on correlation fusion analysis according to claim 2, characterized in that, The specific process of step S2 is as follows: A fast Fourier transform is performed on the alarm time series to obtain a discrete spectrum, and the single-sided amplitude spectrum is calculated. The maximum value in the single-sided amplitude spectrum, excluding the DC component, and its corresponding index are found. If the maximum value is greater than a set peak significance threshold, a candidate period value is calculated based on the sampling time interval of the alarm time series and the index. Find the maximum value in the amplitude spectrum excluding the DC component and its corresponding index. If the maximum value is greater than the set peak significance threshold, calculate the candidate period value based on the sampling time interval of the original sequence and the index.

4. The network attack alarm noise reduction method based on correlation fusion analysis according to claim 3, characterized in that, In step S3, when calculating the Pearson correlation coefficient between two periodic subsequences, a time lag tolerance mechanism is introduced to search for the maximum correlation coefficient within a set time unit range as the final similarity measure. The filterable conditions include: the alarm source IP belongs to a known whitelist, or the attack type is low-risk detection type; if the target asset level is greater than a preset threshold or the attack type involves core permissions, then it is forcibly retained and the process proceeds to step S4.

5. A network attack alarm noise reduction method based on correlation fusion analysis according to claim 4, characterized in that, The multidimensional statistical features in step S4 include: spectral energy concentration, sequence variation coefficient, and peak-valley difference. The multi-agent system includes a main agent, a knowledge retrieval agent, an association query agent, and a reasoning agent; The main agent adopts a two-stage pipeline scheduling architecture: the first stage calls the knowledge retrieval agent to obtain the list of related plugins for expert judgment process and suggestion calls; the second stage uses the return results of the first stage as the context background to call the related query agent and reasoning agent in parallel, and finally outputs the judgment conclusion based on the preset fusion rules.

6. The network attack alarm noise reduction method based on correlation fusion analysis according to claim 5, characterized in that, The knowledge retrieval agent has a built-in alarm analysis knowledge base based on expert experience. The knowledge base records attack types, verification steps, a list of associated plugins, ATT&CK tactical phase tags, and asset importance tags. During the vector embedding process, the knowledge retrieval agent uses a multi-task joint encoding method to weight and sum the attack type text, verification step text, ATT&CK tag encoding, and asset level encoding to obtain a comprehensive embedding vector. During the retrieval stage, if the current alarm preliminary tag overlaps with the knowledge base record tag, a soft weighting enhancement strategy is applied based on the similarity.

7. A network attack alarm noise reduction method based on correlation fusion analysis according to claim 5, characterized in that, The reasoning agent has a built-in binary classification model fine-tuned based on the BERT architecture. The input of the binary classification model is a structured text sequence formed by concatenating the enhanced alarm feature vectors. The multidimensional statistical features are converted into vectors of the same dimension as the BERT pooling output and input into the fully connected classification layer. The output is the probability confidence of "false positive" or "real alarm" and a summary of the judgment basis generated by the interpretation generation module. The pre-defined fusion rules of the main intelligent agent adopt a two-layer fusion architecture: The first layer is a hard veto: if the external evidence returned by the associated query agent hits a high-confidence malicious indicator, it will be directly judged as a real alarm. The second layer is soft weighted voting: if a hard veto is not triggered, the evidence weight matrix pre-set for the current attack type is read, and the maliciousness of the related query evidence, the matching degree of the knowledge retrieval process, and the probability value of the reasoning agent are linearly weighted and summed. A penalty term is applied according to the multidimensional statistical features, and the final judgment conclusion is output through the set global judgment threshold.

8. A network attack alarm noise reduction system based on correlation fusion analysis, characterized in that, The system includes: The time series construction module is used to aggregate the received raw alarm logs, count the number of alarms within a continuous time window, and construct an alarm time series. The first noise reduction module is used to identify candidate periodic values ​​of the sequence using fast Fourier transform, and to perform the first round of filtering of false alarms with stable and strong periodicity by combining the Pearson correlation coefficient. The second noise reduction module is used to extract multi-dimensional statistical features for the non-periodic alarm sequences of the diverted traffic, and to schedule the built-in large language model multi-agent architecture to perform heterogeneous data semantic association and comprehensive voting reasoning to complete the second round of noise reduction judgment. The merge output module is used to merge the results of the above modules and output the actual alarm set.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, it implements the steps of the network attack alarm noise reduction method based on correlation fusion analysis as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the network attack alarm noise reduction method based on correlation fusion analysis as described in any one of claims 1 to 7.

Images