A network security alarm processing method, system and storage medium

Abstract

This invention relates to a network security alarm processing method, system, and storage medium, belonging to the field of network security technology. The method includes: acquiring real-time alarm streams and performing time slicing; dynamically calculating the predicted alarm quantity and error boundary based on an enhanced exponential weighted moving average algorithm to determine whether a macroscopic abnormal alarm situation has occurred in the current time slice; if an anomaly occurs, performing spatial correlation analysis on the alarms within the time slice, constructing an alarm graph with network entities as nodes and alarms as edges, and clustering the alarms into alarm clusters with intrinsic relationships using a community partitioning algorithm; matching the characteristics of the alarm clusters with a predefined alarm pattern library, and executing the corresponding handling strategy for the matched pattern. This invention integrates time series anomaly detection and spatiotemporal correlation analysis, enabling rapid early warning of macroscopic anomalies, compressing massive discrete alarms into a small number of alarm clusters and patterns that can be processed in batches, and improving the automation level and handling efficiency of network security monitoring.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically relates to a network security alarm processing method, system, and storage medium. Background Technology

[0002] As enterprises become increasingly information-based and digitally-driven, cybersecurity threats are becoming more severe. Critical information infrastructures in sectors such as power, finance, and telecommunications are facing increasingly massive and complex cyberattacks. Existing cybersecurity situational awareness platforms (such as the S6000 full-scenario cybersecurity situational awareness platform) can aggregate alarm data from various security devices. However, these platforms typically only provide alarm lists and macro-level statistics, resulting in a large number of alarms, diverse types, wide distribution, and significant difficulty in analysis. Monitoring personnel must analyze massive, discrete alarms one by one, leading to inefficiency and difficulty in quickly and accurately locating real high-risk attack events from a sea of ​​invalid alarms, resulting in delayed security response and insufficient situational awareness capabilities. Summary of the Invention

[0003] To address the above problems, this invention provides a network security alarm processing method, comprising: Acquire real-time alarm streams generated by network security devices; The real-time alarm stream is sliced ​​into time segments according to a preset time window to obtain multiple consecutive alarm time slices; Based on the enhanced exponentially weighted moving average (EWMA) algorithm, the predicted number of alarms and the dynamic prediction error boundary of the current alarm time slice are calculated. Based on the relationship between the actual number of alarms in the current alarm time slice and the prediction error boundary, it is determined whether an abnormal alarm situation has occurred. If an abnormal alarm situation is determined, spatial correlation analysis is performed on the alarms within the current alarm time slice, an alarm graph is constructed with network entities as nodes and alarm types as edges, and the alarm graph is divided into communities to obtain at least one alarm cluster, where each alarm cluster contains a group of alarms with potential correlation. The alarm cluster's characteristics are matched against a predefined alarm pattern library. If a match is found, the handling strategy associated with the matched alarm pattern is executed.

[0004] Furthermore, based on the enhanced exponentially weighted moving average (EWMA) algorithm, the predicted number of alarms for the current alarm time slice and the dynamic prediction error boundary are calculated, including: The estimated squared prediction error for the i-th time slice is calculated using the following formula. (i): (i)=max{λ2×e 2 (i)+(1 λ2)× (i 1), } The prediction error boundary LCL for the (i+1)th time slice is calculated using the following formula. e(i+1) and UCL e(i+1) : LCL e(i+1) = U α / 2 ×e p (i), UCL e(i+1) =U α / 2 ×e p (i) Among them, e(i)=x(i) z(i 1) represents the actual number of alarms in the i-th time slice, x(i) and its EWMA smoothed value z(i) from the previous time slice. 1) residual; z(i)=λ1×x(i)+(1 λ1)×z(i 1); λ1 is the smoothing coefficient, λ2 is the prediction error control coefficient, σ U is the sample variance of the prediction error. α / 2 For boundary control coefficients; and, when e p (i)>limit high At that time, let e p (i)=limit high , where limit high This is the preset upper limit threshold.

[0005] Furthermore, the alarm graph is divided into communities to obtain at least one alarm cluster, including: The application community discovery algorithm clusters the alarm graph to obtain multiple initial subgraphs; Identify and remove edge connections in the subgraph that occur with a frequency below the first threshold and / or whose associated alarm threat level is below the second threshold; The processed subgraph is identified as an alarm cluster.

[0006] Furthermore, the predefined alarm pattern library is constructed in the following way: Obtain historical, manually verified alarm clusters; Extract structural and content features from historical alarm clusters. Structural features include topological connections, and content features include at least one of the following: source IP address range, destination IP address, port number range, and attack type combination. The extracted features are associated with manually specified handling strategies to form alarm patterns, which are then stored in the alarm pattern library.

[0007] Furthermore, the handling strategy includes at least one of the following: generating instructions to perform network blocking on the associated source IP address, marking the alarm cluster as high priority and pushing it to the manual review queue, generating an early warning report containing alarm cluster details, and adding the associated IP address to the monitoring-free whitelist.

[0008] Furthermore, the smoothing coefficient λ1 and the prediction error control coefficient λ2 both have a range of (0, 1).

[0009] Furthermore, it also includes: Pattern analysis steps: Record the historical records of each alarm pattern in the alarm pattern library being matched and hit; Based on historical records, the system statistically analyzes and displays the trend of the number of hits for each alarm mode over time.

[0010] The present invention also provides a network security alarm processing system, comprising: The data access module is configured to acquire real-time alarm streams generated by network security devices; The time-series analysis module is configured to slice the real-time alarm stream into time windows according to a preset time window, and determine whether an abnormal alarm situation has occurred in the current alarm time slice based on the enhanced exponentially weighted moving average (EWMA) algorithm. The graph construction and clustering module is configured to construct an alarm graph and perform community division on the alarms within the current alarm time slice when the time series analysis module determines that an abnormal alarm situation has occurred, so as to obtain at least one alarm cluster. The pattern matching and handling module is configured to match the characteristics of alarm clusters with a predefined alarm pattern library and execute the handling strategy associated with the matched alarm patterns.

[0011] Furthermore, it also includes a linkage interface module, configured to communicate with the full-scenario network security situation awareness platform; When the pattern matching and handling module executes the handling strategy, it specifically calls the application programming interface (API) provided by the full-scenario network security situation awareness platform through the linkage interface module to perform IP blocking, early warning notification, or event reporting operations.

[0012] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0013] Compared with the prior art, the present invention has the following advantages: First, by performing time-series analysis on the number of alarms using the enhanced EWMA algorithm, macro-level anomalies can be quickly detected (e.g., within 5 minutes), filtering out minor daily fluctuations and improving the accuracy and timeliness of early warnings. Compared to traditional EWMA, this algorithm effectively avoids over-adjustment of boundary values ​​and misjudgments caused by temporary abnormal fluctuations by introducing a minimum prediction error limit and upper bound control, thus balancing monitoring sensitivity and situational awareness reliability. Second, through spatiotemporal correlation analysis and community segmentation, massive discrete alarms are aggregated into alarm clusters with inherent correlations, reducing the number of individual alarms that monitoring personnel need to handle from tens of thousands to a small number of alarm clusters, significantly reducing the complexity of analysis. Finally, through alarm pattern library matching, recurring or specific attack behaviors can be automatically or semi-automatically batch-processed, greatly reducing repetitive manual workload and achieving "one-time definition, long-term effectiveness," significantly improving the efficiency and intelligence level of network security monitoring.

[0014] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart illustrating a network security alarm processing method according to an embodiment of the present invention.

[0017] Figure 2 This is a flowchart illustrating the enhanced EWMA algorithm in one embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram illustrating the process of alarm graph construction and community segmentation in one embodiment of the present invention.

[0019] Figure 4 This is a schematic diagram illustrating the process of constructing and using the alarm mode library in one embodiment of the present invention.

[0020] Figure 5 This is a schematic diagram of alarm mode temporal situation analysis in one embodiment of the present invention.

[0021] Figure 6This is a schematic diagram of a network security alarm processing method in one embodiment of the present invention.

[0022] Figure 7 This is a schematic diagram of a network security alarm processing system in one embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] This embodiment uses alarm data from the State Grid's full-scenario network security situation awareness platform (S6000) as an example for illustration, but the invention is not limited to this. It should be noted that this invention points out that the core pain point of existing technologies lies in the "discrete, unrelated, and inability to process alarms in batches," rather than simply detecting anomalies. This invention organically combines "anomaly situation awareness" in the time dimension with "alarm correlation clustering" in the spatial dimension through the bridge of "time slicing." Furthermore, this invention utilizes the results of anomaly detection to selectively trigger computationally complex graph clustering analysis (performed only during anomaly periods), thereby achieving "simultaneous macro-level rapid early warning while precisely focusing resources for micro-level correlation analysis," ultimately compressing massive alarms into a small number of alarm clusters / patterns that can be processed in batches. This solves the dual dilemmas of "large computational load from blind clustering" and "low efficiency of line-by-line analysis" in existing technologies.

[0025] A network security alarm processing method according to an embodiment of the present invention includes steps S101 to S105 (see Figure 6 ).

[0026] Step S101: Obtain the real-time alarm stream. Alarm logs are collected in real-time from network security devices such as firewalls, intrusion detection systems, and web application firewalls deployed at critical network nodes via Syslog, APIs, etc., forming a continuous alarm stream. Alarm information includes at least a timestamp, source IP address, destination IP address, port, alarm type, and threat level.

[0027] Step S102, Time Slicing. Set a time window (in practical applications, 5-10 minutes is usually used as the statistical unit for alarm fluctuations) to cut the continuous alarm stream into non-overlapping alarm time slices. This step aims to discretize the continuous data to facilitate statistical and correlation analysis within the time period.

[0028] Step S103, Abnormal Situation Awareness Based on Enhanced EWMA Algorithm. The purpose of this step is to quickly detect abnormal surges in the number of alarms over time, with the core being the calculation of dynamic prediction error boundaries. Compared to traditional EWMA control charts, the enhanced EWMA algorithm of this invention addresses the problems of traditional methods being difficult to use directly when data has autocorrelation or non-fixed mean and variance, and being susceptible to temporary abnormal fluctuations, through the following two key improvements: The specific algorithm is as follows: The enhanced EWMA algorithm described above effectively avoids the problem of traditional EWMA being overly sensitive to temporary anomalies, providing a more stable anomaly detection threshold. If the actual number of alarms x(t) in the current time slice t exceeds the prediction error boundary [LCL] calculated based on the data at time t-1... e(t) UCL e(t) If the time slice is found to be in an abnormal state, an alarm is triggered, and the subsequent spatial correlation analysis process is initiated. Formula (7) introduces the max operation and σ... e 2 The minimum prediction error is limited to the sample variance, preserving the characteristic that the control boundary fluctuates with the observed values ​​while limiting the fluctuation amplitude. Formula (8) calculates the boundary and combines it with the limit. high Parameters for e p (i) is controlled by the upper bound to prevent excessive expansion of the boundary due to a single extreme anomaly, thereby avoiding the neglect of subsequent smaller anomalies. For example... Figure 1 As shown, the enhanced EWMA algorithm (blue line) used in this invention has a smoother and more stable prediction boundary compared to the traditional EWMA algorithm (green line), which can effectively filter out small daily fluctuations and more accurately capture real abnormal surges (as shown by the red line).

[0029] Step S104: Spatiotemporal correlation analysis and alarm cluster generation. Upon detecting an abnormal situation, spatial correlation analysis is performed on all alarms within the time slice that triggered the anomaly. Optionally, alarms with rare attack types within that time slice can be isolated and processed separately. Subsequently, as... Figure 3 As shown, an alert graph is constructed using IP addresses (source IP or destination IP) as nodes and alert types (or attack behaviors) as directed edges (from source IP to destination IP). Next, a community discovery algorithm (such as the Leuven algorithm) is used to cluster the graph, grouping closely connected nodes and edges into the same community (subgraph). After clustering, post-processing is performed: for example, identifying and removing edges with low connection frequency and low threat level to simplify the cluster structure and focus on high-risk, persistent attack behaviors. Each resulting subgraph is called an "alert cluster," which visually represents the attack source, target, attack path, and attack methods involved in a potential attack event.

[0030] Step S105, Pattern Matching and Handling. The system maintains a predefined alarm pattern library. Each alarm pattern is formed by extracting features (such as attack chain patterns, IP segment patterns, port patterns, etc.) from historically confirmed high-risk alarm clusters and manually reviewing and labeling them, and is bound to a handling strategy (such as "automatically block the source IP", "urgently notify the analyst", "add to whitelist and ignore", etc.). The features of the alarm clusters generated in step S104 are matched with the pattern library. If a pattern is matched, the handling strategy associated with that pattern is automatically executed, for example, calling the S6000 platform's API to temporarily block the attack source IP. If no pattern is matched, the alarm cluster is pushed to monitoring personnel for manual analysis, and new alarm patterns can be defined and added to the pattern library based on the analysis results.

[0031] The enhanced EWMA algorithm described in step S103 is one of the key improvements of this invention. See also Figure 2 The specific process includes: initializing parameters, including the smoothing coefficient λ1 (e.g., 0.2), the prediction error control coefficient λ2 (e.g., 0.1), and the boundary control coefficient U. α / 2 (e.g., 2.0), minimum prediction error (Calculated based on historical data) and upper limit threshold high For each arriving alarm time slice i, read its actual alarm count x(i). First, update the EWMA smoothing value z(i) according to the formula z(i) = λ1x(i) + (1-λ1)z(i-1). Next, calculate the current prediction error e(i) = x(i) - z(i-1). Then, according to... (i)=max{λ2×e 2 (i)+(1 λ2)× (i 1), } Calculate the estimated value of the squared prediction error. (i), this formula introduces a max operation and This ensures that the prediction error boundary does not shrink indefinitely, avoiding over-adjustment during periods of stable alarm volume and improving stability. Subsequently, based on LCL... e (i+1)= U α / 2 ×e p (i), UCL e (i+1)=U α / 2 ×e p (i) Calculate the upper bound UCL_e(i+1) and lower bound LCL_e(i+1) of the prediction error for the next time slice (i+1). Finally, perform a boundary protection check: if e p (i)>limithigh Then let e p (i)=limit high This limit high The parameters control the upper bound of the boundary and are one of the key design features of the "enhanced" algorithm. When x(i) exceeds [z(i-1) + LCL]... e(i) z(i-1)+UCL e(i) When the range is within ], it is considered an abnormal situation. For example Figure 1 As shown, the enhanced EWMA algorithm (blue line) used in this invention has a smoother and more stable prediction boundary compared to the traditional EWMA algorithm (green line), which can effectively filter out small daily fluctuations and more accurately capture real abnormal surges (as shown by the red line).

[0032] More specifically, Figure 1 The X-axis (time axis) marks the time span from June 1st to June 25th, representing the continuous monitoring time window. The Y-axis (numerical axis) ranges from -60 to 100, representing the number of alarms or prediction deviation.

[0033] The black solid lines represent the actual number of alarms received per hour. As can be seen in the graph, it exhibits non-stationary characteristics, with obvious peaks appearing near Jun01, Jun20, and Jun25, while remaining relatively stable in the middle period (Jun05-Jun15).

[0034] The red solid line represents the one-step lead prediction error (i.e., the actual value minus the predicted value). This curve oscillates slightly around the 0 axis during the plateau period (Jun05-Jun15), but the error rapidly increases during abnormal spikes (such as Jun25). This corresponds to the step of "calculating the prediction error e(i)" in the instruction manual.

[0035] The blue dashed lines represent the upper and lower bounds of control calculated by the enhanced EWMA algorithm. Compared to the classic algorithm, the blue lines are narrower during stable periods and recover more smoothly after being affected by sudden spikes. This corresponds to the "calculation of the upper bound of the prediction error UCL". e and the lower bound LCL e It also embodies the "border protection" mechanism.

[0036] The green dashed line represents the control limits of the traditional EWMA algorithm. It can be seen that the control limits are relatively wide during the stationary period, and after the single spike at Jun 20, the control limits undergo drastic deformation (widening significantly and then contracting), demonstrating its oversensitivity to sudden anomalies and susceptibility to contamination.

[0037] Therefore, as shown by the green dashed line (classical EWMA control limits) in the figure, when the system experiences a brief surge in alarms around June 20 (black scattering), the control limits of the classic algorithm fluctuate drastically, exhibiting a trend of over-widening followed by rapid tightening. This unstable boundary easily leads to false alarms during stable periods or a loss of early warning function when consecutive anomalies occur. In contrast, the blue dashed line (enhanced EWMA control limits), due to the introduction of a lower bound for the estimation of the squared prediction error and a boundary protection mechanism, remains smooth and stable even under the disturbance of June 20, demonstrating the filtering capability of the 'enhanced' algorithm for daily small oscillations.

[0038] Furthermore, the red solid line (one-step advance prediction error) significantly exceeded the blue control limit during the actual anomaly outbreak period of June 25, closely matching the abnormal increase in the actual number of alarms (black dots). This indicates that the present invention, by calculating dynamic control limits, can accurately distinguish between 'normal fluctuations' and 'true abnormal situations,' solving the problems of boundary sensitivity and susceptibility to contamination in traditional algorithms. Additionally, during the actual anomaly surge period of June 25, the red error line exceeded the blue control limit, and the actual number of alarms (black dots) also far exceeded the normal range, demonstrating that the enhanced algorithm can accurately identify true anomalies, rather than noise in the middle of false alarms.

[0039] It should be noted that those skilled in the art will understand that the parameters in the enhanced EWMA algorithm can be determined using conventional techniques in the field. In one specific implementation, the parameters are determined as follows: smoothing coefficient λ1, prediction error control coefficient λ2, and boundary control coefficient U. α / 2 The optimal value can be determined by training on historical alarm datasets using optimization methods such as grid search and cross-validation to maximize the F1 score (harmonic mean of precision and recall) or other evaluation metrics for anomaly detection. The sample variance σ of the prediction error... e 2 The upper limit threshold is obtained by selecting a period of historical stable alarm data and calculating the variance of its one-step prediction error sequence {e(i)}. high The sensitivity of the system to abnormal situations can be empirically set. For example, it can be set to K times the standard deviation of the historical average number of alarms (K is usually 3 to 5), or it can be set by analyzing the alarm volume of historical extreme abnormal events. Experiments have verified that, for a power company's network scenario, taking λ1=0.2, λ2=0.1, U... α / 2 =2.0, limit high =500, which can effectively distinguish between daily fluctuations and real attacks, achieving good monitoring results.

[0040] in addition, Figure 2The X-axis represents the time axis, ranging from 16:40:00 on August 11, 2023 to 15:20:00 on August 12, 2023, showing the dynamic changes over approximately 24 hours. The Y-axis represents the prediction deviation value, ranging from -400 to 400, quantifying the degree to which the prediction deviates from the actual value.

[0041] The red solid line (deviation) represents the deviation between the actual number of observed attacks and the EWMA model's prediction. A curve fluctuating around the 0 axis indicates accurate prediction; a curve far from the 0 axis indicates a large prediction deviation.

[0042] The gray solid lines (upper / lower bounds) represent the control limits (thresholds) dynamically calculated by the enhanced EWMA algorithm. These two lines are not fixed, but adaptively adjust over time according to data fluctuations, reflecting the core idea of ​​"dynamic boundaries".

[0043] Figure 2 The floating box in the lower right corner captured specific data for the time 07:50:00 on August 12, 2023: The deviation is 6.94. The red curve shows a sharp upward peak here, breaking through the upper limit, indicating that the actual total number of attacks far exceeds the model's prediction.

[0044] The upper bound is 72.55, and the lower bound is -72.55. These two values ​​represent the limits of the normal fluctuation range that the system considers acceptable at that moment. The red spike (6.94) is much larger than the upper bound (72.55), which constitutes a clear abnormal alarm trigger condition.

[0045] At the peak, the red curve not only exceeded the limit, but the gray control limit also showed a delayed opening shape, which then quickly tightened. This is consistent with the exponential weighted smoothing characteristics of the EWMA algorithm when processing abrupt data.

[0046] Figure 3 The X-axis represents the time axis, ranging from 16:40:00 on August 11, 2023 to 15:20:00 on August 12, 2023. Figure 2 Maintaining consistency facilitates cross-dimensional comparative analysis. The Y-axis represents the prediction deviation value, ranging from -15 to 15. Compared to Figure 2 (Y-axis range -400~400). The deviation in this graph is significantly reduced, indicating that the fluctuation of the "number of alarm types" is relatively smooth, or has undergone normalization. The red solid line (deviation) represents the difference between the actual observed number of alarm types and the predicted value of the EWMA model. This curve oscillates slightly around the 0 axis, with a small overall fluctuation range, indicating that the model's prediction of the number of alarm types is relatively accurate. The gray solid lines (upper / lower bounds) represent the control limits dynamically adjusted by the enhanced EWMA algorithm. These control limits also adapt over time, but show a more pronounced change in the graph than... Figure 2 The more "compact" form reflects a more refined control over the number of alarm types.

[0047] Figure 3 The floating box in the lower right corner captured specific data for the time 09:40:00 on August 12, 2023: The deviation is 0.73. The red curve shows an upward peak here, breaking through the upper limit, indicating that the increase in the number of alarm types at this time exceeds the model's expectations.

[0048] The upper bound is 7.37 and the lower bound is -7.37. These two values ​​are very close and symmetrical, representing the "normal fluctuation threshold" set by the system at that moment. The red peak (7.37) is exactly equal to the upper bound, triggering the alarm condition.

[0049] The gray control limit exhibits a slight "wavy" fluctuation within the time period of the floating box, rather than a fixed straight line. This reflects the dynamic weighting characteristics of the EWMA algorithm based on historical data, which can automatically fine-tune the control boundary according to the recent trend of the number of alarm types.

[0050] The specific process of community segmentation in step S104 is as follows: Figure 4As shown in the diagram, within the time slice where an anomaly is detected, assume there are alarms A (IP1->IP2, attack type X), B (IP1->IP3, attack type X), and C (IP2->IP4, attack type Y). First, an alarm graph is constructed using IP1, IP2, IP3, and IP4 as nodes and attack types X and Y as directed edges. Then, community detection algorithms such as the Louvain algorithm are applied to cluster this graph. The algorithm optimizes based on modularity, grouping tightly connected nodes and edges into the same community (subgraph). For example, it might group {IP1, IP2, IP3} and the edges between them into one cluster (suspicious attack source IP1 scanning multiple targets), and {IP2, IP4} and the edges between them into another cluster (suspicious lateral movement of the attack). After clustering, post-processing is performed: for example, if an edge (a certain attack) appears only once in the entire time slice (frequency below the first threshold), or its threat level is "low", it can be removed from its cluster to simplify the cluster structure and focus on high-risk, persistent attack behaviors. Each alert cluster obtained in the end clearly shows the "attack path map" of a potential attack event. The "second threshold" refers to a benchmark value used to distinguish between high and low threat alerts. Threat levels can be provided by network security devices in their original alert logs (e.g., high-risk, medium-risk, low-risk), or by a situational awareness platform based on alert type, CVE score, and other information for secondary assessment. The "second threshold" can be a pre-defined threat level label (e.g., considering alerts at "low-risk" and below as "below the second threshold"), or a quantified score threshold (e.g., in a 0-10 threat scoring system, alert connections with scores below 3 are removed). In one specific implementation, the system administrator can set this "second threshold" in the configuration interface according to security policies, for example, specifying that only alerts at "medium-risk" and above are retained for correlation analysis.

[0051] It should be noted that, see Figure 4 (Spatiotemporal correlation community segmentation), specifically the spatial correlation analysis in step S103, is manifested as follows: transforming alarms within the current alarm time slice into an 'alarm graph' (intermediate graph), where nodes are network entities and edges represent alarm correlations; subsequently, the community segmentation in step S104 (such as...) Figure 4 The 'colored clustering nodes' in the middle, through a community discovery algorithm, cluster closely related nodes into 'alarm clusters' (such as...). Figure 4 The right side ('Alarm Event Clusters 1~n') transforms the data from 'massive amounts of raw alarm events' (left side) to 'a small number of clusters to be processed' (right side). Figure 4The left side presents a "timestamped alarm list" (similar to a table / log screenshot), with each row containing fields such as alarm time, source IP, destination IP, alarm type, and severity level (i.e., a massive amount of raw alarm events). This part corresponds to the raw input after steps S101 "Obtain Real-time Alarm Stream" and S102 "Time Slicing," consisting of discrete alarm data that has not undergone correlation analysis, reflecting the characteristics of alarms being "massive, disordered, and fragmented." Figure 4 The alarm is presented in the middle in the form of a "colored node + connecting line" diagram: Node: Each node represents a network entity (such as an IP address, device, or service). The color / size of a node may map the number of alarms and the severity level (e.g., red nodes indicate a concentration of high-risk alarms). Edges: The lines connecting nodes represent the relationships between alarms (such as alarm relationships between source IP and destination IP, or alarm type similarity relationships within the same time window). Clustering Results: Nodes are "colored" into groups (e.g., green, red, and blue clusters). The corresponding community partitioning results are then processed using community discovery algorithms (e.g., Louvain, CNM algorithms) to group closely related alarm nodes into a single cluster (alarm cluster), reflecting a combination of "spatial association" (inter-entity association) and "temporal association" (within the same time slice). This part corresponds to steps S103 "Spatial Association Analysis (Constructing an Alarm Graph)" and S104 "Community Partitioning," the core of which is to transform discrete alarms into "internally related alarm clusters," achieving alarm aggregation "from point to surface."

[0052] Figure 4 The right side is presented in a "list + icon" format, with each item representing a cluster of alert events: Each cluster is identified by a "circle / custom icon" (such as a small green circle or a red star), labeled "alarm event cluster 1, 2, 3...n"; The cluster implicitly contains "aggregated alarm characteristics" (such as central IP, alarm type distribution, and time range), reflecting the characteristics of "small quantity, batch processing" (compared to "massive original alarms" on the left, the number of clusters on the right is greatly reduced).

[0053] This part corresponds to the input of step S104 "obtain at least one alarm cluster" and the subsequent "pattern matching". The core is to compress "massive discrete alarms" into "a small number of related clusters", solving the pain point of "too many alarms and inability to process them in batches" in existing technologies.

[0054] The construction and use of the alarm pattern library is a continuous learning and optimization process. When monitoring personnel manually analyze a new alarm cluster with an unmatched pattern, if it is confirmed to be a new attack pattern, the characteristics of the alarm cluster can be extracted through the pattern definition interface. Structural characteristics may include "star topology (one source IP attacks multiple destination IPs)" or "chain topology (IP1->IP2->IP3)". Content characteristics may include "source IP segment belongs to 10.10.1.0 / 24" or "attack type combination is 'vulnerability scan' followed by 'SQL injection attempt'". These characteristics are saved as a new "alarm pattern" and associated with a handling policy (such as "automatically block source IP / 24 network segment"). Afterwards, any newly generated alarm cluster, as long as its characteristics match the pattern definition, will automatically trigger a blocking action. The system also provides an alarm pattern time analysis function, recording the number of hits for each pattern, and can display a bar chart of the number of hits by time dimension (such as day, week), facilitating retrospective analysis and evaluation of the effectiveness of the pattern. Furthermore, in order to transform alarm clusters into reusable knowledge, this invention proposes an alarm pattern extraction and generation mechanism, such as... Figure 5 As shown, the mechanism first receives the initial alarm clusters discovered through community analysis on the left. Subsequently, the system performs subgraph feature extraction, such as... Figure 5 As shown in the middle section, a specific quantization algorithm (such as formula Z) is used. M The system calculates the structural feature deviation of alarm clusters, transforming unstructured topological data into standardized feature vectors. Finally, based on the extracted features, the system performs alarm pattern mining, classifying alarm clusters into specific patterns shown on the right (such as single-center divergent type, multi-center convergent type, etc.), and assigning key tags such as the center IP to each pattern, forming a structured alarm pattern library to provide a basis for subsequent automated handling.

[0055] It should be noted that, Figure 5 The left side displays multiple boxes with connected nodes side-by-side, labeled "Community Discovery Clustering" below. This represents... Figure 4 The output consists of alarm event clusters (i.e., the initially aggregated alarm sets). The graph within each box is visualized as a small "alarm graph". These clusters are the raw materials for subsequent pattern extraction; they already possess a certain relational structure but have not yet been assigned semantic labels.

[0056] Figure 5 The center displays complex mathematical symbols and matrix / vector diagrams arranged vertically. The formula at the center is:

[0057] Among them, Z M This represents the normalization or standardization of the extracted feature vectors (such as Z-score standardization). Where nM It is a certain feature value of the current cluster. It is the historical average. It is the standard deviation. The purpose of this step is to eliminate dimensional differences, so that alarm clusters of different sizes and types can be compared in a unified metric space.

[0058] The waveform / matrix above: a sequence of structural features of the metaphorical alarm cluster (such as the degree distribution of nodes and the change of centrality measure over time).

[0059] The waveform / matrix below: a sequence of content features of the metaphorical alarm cluster (such as the statistical distribution of alarm types).

[0060] Figure 5 The right side lists multiple entries (Pattern 1, Pattern 2...Pattern N), each containing a visual icon and attribute description. This is the final result of pattern generation, the "alarm pattern library" from the steps above. The figure shows different types of icons (such as "single-center divergent," "single-center convergent," and "multi-center convergent"), indicating that the algorithm has identified different topological patterns of alarms in spatial structure. Each pattern is labeled with "Center IP: xxx.xxx.xxx" and "Type: xxx". This shows that the system not only identified the structural pattern but also extracted the key identifier (center node) and semantic features (pattern type) of the pattern, forming a standardized pattern record.

[0061] The execution of the handling strategy is crucial for closed-loop handling. The pattern matching handling module has multiple pre-set handling action templates. For example, when a "worm outbreak" pattern is matched, the strategy might be "automatically block the source IP" and "generate an emergency warning notice." The system, through the linkage interface module, calls the IP blocking API provided by the S6000 platform to add the attacking source IP to the blacklist. Simultaneously, it calls the S6000's warning notice interface to generate a work order containing alarm cluster details and pushes it to the security operations center. For alarm clusters matched with a "false alarm" pattern (such as alarms triggered by normal operations of a specific administrator), the strategy might be "automatically add to the whitelist and ignore," thereby reducing interference. These linked operations ensure an automated closed loop from detection and analysis to handling.

[0062] In the parameter settings of the enhanced EWMA algorithm, extensive experimental verification has shown that the values ​​of the smoothing coefficient λ1 and the prediction error control coefficient λ2 have a significant impact on the algorithm's sensitivity and stability. Preferably, the values ​​of λ1 and λ2 are both between 0 and 1. More preferably, λ1 can be between 0.1 and 0.3, and λ2 can be between 0.05 and 0.2. Within this range, the algorithm can effectively suppress false alarms caused by random fluctuations while maintaining sufficient sensitivity to abnormal situations.

[0063] Optionally, the present invention also includes a visualization step: displaying the alarm clusters in the form of a topology diagram, where nodes identify network entities, edges identify alarm types and directions, and key information related to the alarm clusters is displayed. This key information includes source IP address, destination IP address, port number, alarm time, and alarm type. Visualization is an important means of improving monitoring efficiency. The system provides a topology diagram display interface for alarm clusters. Different icons represent different types of network devices (such as servers and workstations), lines represent alarms, and color and thickness characterize the threat level and number of alarms. Clicking on any alarm cluster will pop up a details panel in the sidebar, displaying all source IPs, destination IPs, ports, precise alarm times, and specific attack types (such as CVE numbers) involved in that cluster. This visualization method allows monitoring personnel to "see the whole picture of the attack at a glance" and quickly locate the source and scope of the attack.

[0064] This embodiment provides a network security alarm processing system for implementing the network security alarm processing method described in any of the above embodiments. Physically, the system can be a functional module running as software on a full-scenario network security situation awareness platform (S6000), or a dedicated system deployed on a standalone server or security hardware device. See also... Figure 7 (A system module architecture diagram can be attached here.) This system includes the following functional modules: The data access module is configured to communicate with various security devices in the network, such as firewalls, intrusion detection systems, and web application firewalls. It acquires and parses alarm logs from these devices in real time through standard protocols (such as Syslog and API) to form a structured real-time alarm stream.

[0065] The time-series analysis module is configured to receive the alarm stream output by the data access module. This module incorporates the enhanced exponentially weighted moving average (EWMA) algorithm to slice the alarm stream over time and dynamically calculate the predicted alarm count and prediction error margin (UCL / LCL) for each time slice. Its core function is to determine whether an abnormal alarm situation has occurred in the current time slice based on whether the actual alarm count exceeds the prediction error margin, and to output an abnormal trigger signal.

[0066] The graph construction and clustering module is configured to start upon receiving an anomaly trigger signal from the time series analysis module. For all alarms within the time slice that triggered the anomaly, this module performs the following operations: constructing an alarm graph with IP addresses as nodes and alarm types as directed edges; subsequently, it calls a community detection algorithm (such as the Leuven algorithm) to partition the alarm graph into multiple alarm clusters; and it performs post-processing on the clustering results, such as removing low-frequency or low-threat connections.

[0067] The pattern matching and handling module is configured to access a predefined alarm pattern library. This module receives alarm clusters output by the graph construction and clustering module, extracts features (structural and content features) of each alarm cluster, and matches them with patterns in the alarm pattern library. If a match is successful, the predefined handling strategy associated with that pattern is automatically executed.

[0068] The linkage interface module is configured to integrate with an external security platform (such as S6000). When the pattern matching and handling module needs to execute handling policies (such as IP blocking or generating early warning notices), this module calls the application programming interface (API) provided by the external platform to automate the execution of handling actions and synchronize results.

[0069] The modules mentioned above transmit data and synchronize their status through an internal data bus or message queue, forming a closed-loop network security operation system that integrates data collection, intelligent analysis, and automated processing.

[0070] Furthermore, those skilled in the art will understand that the network security alarm processing method provided in the embodiments of the present invention can be implemented, in whole or in part, through software, hardware, firmware, or any other combination. When implemented in software, all or part of the method can be implemented in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the process or function described in the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid state disks (SSDs)).

[0071] The network security alarm processing system provided in this embodiment of the invention can be implemented in hardware or software. For example, the system can be deployed on one or more network servers, security devices, or dedicated hardware devices, and the steps described in this invention are implemented by running the software programs installed on them. The modules in the system can be integrated into a single hardware unit or each can function as an independent hardware unit, communicating and exchanging data via bus, network, or other means.

[0072] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing network security alarms, characterized in that, include: Acquire real-time alarm streams generated by network security devices; The real-time alarm stream is sliced ​​into time segments according to a preset time window to obtain multiple consecutive alarm time slices; Based on the enhanced exponentially weighted moving average (EWMA) algorithm, the predicted number of alarms and the dynamic prediction error boundary of the current alarm time slice are calculated. Based on the relationship between the actual number of alarms in the current alarm time slice and the prediction error boundary, it is determined whether an abnormal alarm situation has occurred. If an abnormal alarm situation is determined, spatial correlation analysis is performed on the alarms within the current alarm time slice to construct an alarm graph with network entities as nodes and alarm types as edges. The alarm graph is then divided into communities to obtain at least one alarm cluster, where each alarm cluster contains a group of alarms with potential correlations. The features of the alarm cluster are matched with a predefined alarm pattern library. If a match is found, the handling strategy associated with the matched alarm pattern is executed.

2. The method according to claim 1, characterized in that, The enhanced exponentially weighted moving average (EWMA) algorithm is used to calculate the predicted number of alarms and the dynamic prediction error boundary for the current alarm time slice, including: The estimated squared prediction error for the i-th time slice is calculated using the following formula. (i): (i)=max{λ2×e 2 (i)+(1 λ2)× (i 1), } The prediction error boundary LCL for the (i+1)th time slice is calculated using the following formula. e(i+1) and UCL e(i+1) : LCL e(i+1) = U α / 2 ×e p (i),UCL e(i+1) =U α / 2 ×e p (i) Among them, e(i)=x(i) z(i 1) represents the actual number of alarms in the i-th time slice, x(i) and its EWMA smoothed value z(i) from the previous time slice. 1) residual; z(i)=λ1×x(i)+(1 λ1)×z(i 1); λ1 is the smoothing coefficient, and λ2 is the prediction error control coefficient. U is the sample variance of the prediction error. α / 2 For boundary control coefficients; and, when e p (i)>limit high At that time, let e p (i)=limit high , where limit high This is the preset upper limit threshold.

3. The method according to claim 1, characterized in that, The alarm graph is divided into communities to obtain at least one alarm cluster, including: The alarm graph is clustered using a community discovery algorithm to obtain multiple initial sub-graphs; Identify and remove edge connections in the subgraph that have a frequency below a first threshold and / or whose associated alarm threat level is below a second threshold; The processed subgraph is identified as an alarm cluster.

4. The method according to claim 1, characterized in that, The predefined alarm pattern library is constructed in the following way: Obtain historical, manually verified alarm clusters; Structural and content features are extracted from the historical alarm clusters. The structural features include topological connection relationships, and the content features include at least one of the following: source IP address range, destination IP address, port number range, and attack type combination. The extracted features are associated with manually specified handling strategies to form alarm patterns, which are then stored in the alarm pattern library.

5. The method according to claim 1 or 4, characterized in that, The handling strategy includes at least one of the following: generating instructions to perform network blocking on the associated source IP address, marking the alarm cluster as high priority and pushing it to the manual review queue, generating an early warning report containing details of the alarm cluster, and adding the associated IP address to the monitoring-free whitelist.

6. The method according to claim 2, characterized in that, The smoothing coefficient λ1 and the prediction error control coefficient λ2 both have a range of (0, 1).

7. The method according to claim 4, characterized in that, Also includes: Pattern analysis steps: Record the historical records of each alarm pattern in the alarm pattern library being matched and hit; Based on the historical records, the trend of the number of hits for each alarm mode is statistically analyzed and displayed according to the time dimension.

8. A network security alarm processing system, characterized in that, include: The data access module is configured to acquire real-time alarm streams generated by network security devices; The time-series analysis module is configured to slice the real-time alarm stream into time slices according to a preset time window, and determine whether an abnormal alarm situation has occurred in the current alarm time slice based on the enhanced exponentially weighted moving average (EWMA) algorithm. The graph construction and clustering module is configured to construct an alarm graph and perform community division on the alarms within the current alarm time slice when the time series analysis module determines that an abnormal alarm situation has occurred, so as to obtain at least one alarm cluster. The pattern matching and handling module is configured to match the features of the alarm cluster with a predefined alarm pattern library and execute the handling strategy associated with the matched alarm pattern.

9. The system according to claim 8, characterized in that, It also includes a linkage interface module, configured to communicate with the full-scenario network security situation awareness platform; When the pattern matching and handling module executes the handling strategy, it specifically calls the application programming interface (API) provided by the full-scenario network security situation awareness platform through the linkage interface module to perform IP blocking, early warning notification, or event reporting operations.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the network security alarm processing method as described in any one of claims 1-7.

Images