CN116702133A - Alarm information noise reduction strategy determination method and device and storage medium - Google Patents

Abstract

The present disclosure provides a method, device, and storage medium for determining a noise reduction strategy for alarm information, which relate to the field of communication technology, and solve the technical problem that the noise reduction strategy cannot be efficiently determined for accurate noise reduction in related technologies. The method includes: determining first warning information from at least one security device; the first warning information includes at least one of the following: noise warning information and non-noise warning information; inputting the first warning information into a noise warning information detection model, Determine the noise warning information in the first warning information; the detection model includes at least one judgment rule for the first noise warning information; and determine at least one noise reduction strategy for the security device based on the noise warning information. The present disclosure is used in the scenario of alarm information noise reduction.

Description

Alarm information noise reduction strategy determination method, device and storage medium

technical field

The present disclosure relates to the field of communication technologies, and in particular, to a method, device and storage medium for determining an alarm information noise reduction strategy.

Background technique

At present, Internet enterprises deploy various security devices, which monitor the enterprise network in real time to ensure enterprise network security, block network attacks and record attack alarm logs. However, due to the frequent occurrence of attack alarm false alarms, which have a certain impact on the normal use of security equipment, how to accurately reduce the noise of security equipment alarm logs has become a technical problem that needs to be solved urgently.

The current common noise reduction method is mainly to manually log in to each security device, check the alarm information, manually analyze to determine whether it is a false alarm, and manually modify the monitoring strategy and disposal strategy. The workload of noise reduction for safety equipment alarms by this method is too large and many people are involved, and it is impossible to efficiently determine a noise reduction strategy to reduce noise alarm information.

Contents of the invention

The present disclosure provides a method, device and storage medium for determining an alarm information noise reduction strategy. The technical problem in the related art that the noise reduction strategy cannot be efficiently determined to reduce the noise warning information is solved.

In order to achieve the above purpose, the present disclosure adopts the following technical solutions:

In the first aspect, a method for determining a warning information noise reduction strategy is provided, including: determining first warning information from at least one security device; the first warning information includes at least one of the following: noise warning information, non-noise warning information; The first warning information is input into the noise warning information detection model, and the noise warning information in the first warning information is determined; the detection model contains at least one judgment rule for the first noise warning information; and the noise reduction of at least one safety device is determined based on the noise warning information Strategy.

With reference to the first aspect above, in a possible implementation manner, the method specifically includes: determining target data of each piece of second alarm information; wherein, the second alarm information is alarm information acquired from at least one security device; the target The data includes: attacking Internet protocol IP address, attack behavior type, attack method, and attacked IP address; obtain the attribution information of each second alarm information; the attribution information is the attribution information of the attacking IP address in the target data; determine the attribution information of the second alarm information; An alarm message includes target data and attribution information of each second alarm message.

In combination with the first aspect above, in a possible implementation manner, the method further includes: receiving third warning information from at least one security device; deleting the warning information of the determined noise reduction strategy in the third warning information, and determining the third warning information 2. Warning information.

In combination with the first aspect above, in a possible implementation manner, the noise warning information detection model is used to judge whether the target data of the target first warning information is required according to the target data and/or attribution information in the target first warning information. The target data of the alarm; if the target data of the target first alarm information is not the target data to be alarmed, it is determined that the target first alarm information is the noise alarm information.

In combination with the first aspect above, in a possible implementation manner, at least one first noise warning information judgment rule includes at least one of the following: a virus-like noise warning judgment rule; a website attack method-like noise warning judgment rule; a network attack behavior-like judgment rule. Judgment rules for noise alarms; judgment rules for abnormal behavior noise warnings. Virus-like noise alarm judgment rules include: based on the attacking IP address in the first alarm information and the attribution information of the attacking IP address, determine whether the attacking IP address has anti-virus and protection functions, and if the attacking IP address already has anti-virus and protection functions Next, it is judged that the first warning information is noise warning information; the website attack method noise warning judgment rule includes: based on the attack method in the first warning information, it is determined whether the attack method is a preset attack method, and if the attack method is a preset attack method In this case, it is judged that the first warning information is noise warning information; the network attack behavior type noise warning judgment rule includes: based on the attack behavior type in the first warning information, it is determined whether the attack behavior type is a preset non-attack behavior, and in the attack behavior type In the case of a preset non-aggressive behavior, it is judged that the first warning information is noise warning information; the rules for judging abnormal behavior noise warnings include: determining the first warning information based on the attacking IP address and the attacked IP address in the first warning information Whether the data transmission in is traffic data transmission between security devices, if the data transmission in the first warning information is traffic data transmission between security devices, it is judged that the first warning information is noise warning information.

With reference to the first aspect above, in a possible implementation manner, the method further includes: determining the noise warning information and the non-noise warning information in the first warning information; based on the target data and/or attribution information of the noise warning information, generating A second noise warning information judgment rule for judging noise data; based on the target data and/or attribution information of non-noise warning information, generate a third noise warning information judgment rule for judging noise data; judge based on the second noise warning information The rule, and the third noise warning information judgment rule update the noise warning information detection model.

With reference to the first aspect above, in a possible implementation manner, the method further includes: sending a noise reduction strategy to any security device in at least one security device, so that any security device determines any Noise warning information in the warning information of safety equipment.

In a second aspect, an apparatus for determining a noise reduction strategy for alarm information is provided. The apparatus for determining a noise reduction strategy for alarm information includes: a processing unit; a processing unit configured to determine first alarm information from at least one security device; the first alarm information Including at least one of the following: noise warning information, non-noise warning information; the processing unit is also used to input the first warning information into the noise warning information detection model, and determine the noise warning information in the first warning information; in the detection model Contains at least one first noise warning information judging rule; the processing unit is further configured to determine at least one noise reduction strategy of the security device based on the noise warning information.

With reference to the second aspect above, in a possible implementation manner, the device for determining a noise reduction strategy for alarm information further includes: a communication unit; a processing unit, specifically configured to: determine the target data of each piece of second alarm information; wherein, the second The alarm information is alarm information obtained from at least one security device; the target data includes: IP address of the attacking Internet Protocol, attack behavior type, attack method, and IP address of the attacked; instructs the communication unit to obtain the attribution information of each second alarm information ; The attribution information is the attribution information of the attacking IP address in the target data; determining the target data and the attribution information of each piece of the second warning information in the first warning information.

With reference to the second aspect above, in a possible implementation manner, the communication unit is further configured to receive third warning information from at least one safety device; the processing unit is specifically configured to delete the determined noise reduction in the third warning information The alert information of the policy is used to determine the second alert information.

In combination with the second aspect above, in a possible implementation manner, the noise warning information detection model is used to determine whether the target data of the target first warning information is The target data that needs to be warned: the processing unit determines that the target first warning information is noise warning information when the target data of the target first warning information is not the target data that needs to be warned.

In combination with the second aspect above, in a possible implementation manner, at least one first noise warning information judgment rule includes at least one of the following: a virus-like noise warning judgment rule; a website attack method-like noise warning judgment rule; a network attack behavior-like judgment rule. Judgment rules for noise alarms; judgment rules for abnormal behavior noise warnings; judgment rules for virus noise alarms include: based on the attacking IP address in the first alarm information and the attribution information of the attacking IP address, determine whether the attacking IP address has antivirus and protection functions , in the case that the attacking IP address already has antivirus and protection functions, it is judged that the first warning information is noise warning information; the website attack method noise-like warning judgment rule includes: based on the attack method in the first warning information, determine whether the attack method is a warning Assuming an attack mode, when the attack mode is a preset attack mode, it is judged that the first warning information is noise warning information; the network attack behavior type noise warning judgment rule includes: based on the attack behavior type in the first warning information, determine the attack behavior type Whether it is a preset non-aggressive behavior, if the type of offensive behavior is a preset non-aggressive behavior, it is judged that the first warning information is noise warning information; the rules for judging abnormal behavior noise warnings include: based on the attack in the first warning information The IP address and the attacked IP address determine whether the data transmission in the first warning information is traffic data transmission between security devices, and if the data transmission in the first warning information is traffic data transmission between security devices, It is judged that the first warning information is noise warning information.

With reference to the second aspect above, in a possible implementation manner, the processing unit is further configured to: determine noise warning information and non-noise warning information in the first warning information; target data and/or attribution information based on the noise warning information , generate a second noise warning information judgment rule for judging noise data; generate a third noise warning information judgment rule for judging noise data based on target data and/or attribution information of non-noise warning information; generate a third noise warning information judgment rule for judging noise data; The information judgment rule and the third noise warning information judgment rule update the noise warning information detection model.

With reference to the second aspect above, in a possible implementation manner, the communication unit is further configured to: send a noise reduction strategy to any security device in at least one security device, so that any security device determines based on the noise reduction strategy Noise warning information in the warning information of any security device.

In a third aspect, there is provided an alarm information noise reduction strategy determination device, including: a processor and a memory; wherein the memory is used to store computer-executable instructions, and when the alarm information noise reduction strategy determination device is running, the processor executes the computer stored in the memory Execute the instruction, so that the device for determining an alarm information noise reduction strategy executes the method for determining an alarm information noise reduction strategy as described in the above first aspect and any possible implementation manner thereof.

In a fourth aspect, a computer-readable storage medium is provided. Instructions are stored in the computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by the processor of the alarm information noise reduction strategy determination device, the alarm information The device for determining a noise reduction strategy executes the method for determining a noise reduction strategy for alarm information as described in the above first aspect and any possible implementation thereof.

In the fifth aspect, there is provided a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run computer programs or instructions, so as to implement the above-mentioned first aspect and any possible implementation thereof. The method for determining the noise reduction strategy for the recorded alarm information.

In the present disclosure, the name of the apparatus for determining the noise reduction strategy for alarm information does not limit the device or functional module itself, and in actual implementation, these devices or functional modules may appear with other names. As long as the function of each device or functional module is similar to the present disclosure, it belongs to the scope of the present disclosure and its equivalent technologies.

These or other aspects of the present disclosure will be more clearly understood in the following description.

The technical solution provided by the present disclosure brings at least the following beneficial effects: the alarm information noise reduction policy determination device in the present disclosure obtains the first alarm information from at least one security device; the first alarm information includes at least one of the following: noise alarm information, Non-noise warning information; the first warning information is input into the noise warning information detection model, and the noise warning information in the first warning information is determined; the detection model contains at least one judgment rule for the first noise warning information; in this way, the warning information is denoised The strategy determining means can filter through the detection model, and determine the noise warning information in the first warning information from the security equipment; determine the noise reduction strategy of at least one security equipment based on the noise warning information. In this way, the alarm information noise reduction strategy determination device provided by the present application can use the model to directly identify the noise alarm information in the alarm information, and generate a corresponding noise reduction strategy, which solves the problem of excessive workload and involved in manual noise reduction in the prior art. There are too many people, and it is impossible to efficiently determine the noise reduction strategy to reduce the noise alarm information.

Description of drawings

In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings that need to be used in the description of the embodiments or the prior art.

FIG. 1 is a schematic structural diagram of a system for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure;

FIG. 2 is a schematic structural diagram of another alarm information noise reduction strategy determination system provided by an embodiment of the present disclosure;

FIG. 3 is a schematic diagram of a hardware structure of an apparatus for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure;

FIG. 4 is a schematic flowchart of a method for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure;

FIG. 5 is a schematic flowchart of another method for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure;

FIG. 6 is a schematic flowchart of another method for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure;

FIG. 7 is a schematic flowchart of another method for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure;

FIG. 8 is a schematic flowchart of another method for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of another apparatus for determining a noise reduction strategy for alarm information provided by an embodiment of the present disclosure.

Detailed ways

A method, device, and storage medium for determining an alarm information noise reduction strategy provided by embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

The term "and/or" in this article is just an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B can mean: A exists alone, A and B exist simultaneously, and there exists alone B these three situations.

The terms “first” and “second” in the specification and drawings of the present disclosure are used to distinguish different objects, or to distinguish different processes for the same object, rather than to describe a specific order of objects.

In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present disclosure are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes other unlisted steps or units, or optionally also includes Other steps or elements inherent to the process, method, product or apparatus are included. It should be noted that, in the embodiments of the present disclosure, words such as "exemplary" or "for example" are used as examples, illustrations or illustrations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present disclosure shall not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present related concepts in a concrete manner.

In the description of the present disclosure, unless otherwise specified, the meaning of "plurality" refers to two or more.

At present, in order to protect the company's network information security, Internet companies have deployed various security devices to protect the company's network information security. Exemplarily, the security devices include: a web application firewall (WAF), an intrusion detection system ( intrusion detection system (IDS), intrusion prevention system (IPS), endpoint protection center (endpoint detection and response, EDR), situational awareness platform, dynamic network application firewall, etc. The security device monitors network security in real time. When network attacks such as vulnerability scanning, system command injection, and password blasting are discovered, the network attacks are blocked and the attack alarm logs are recorded.

However, there are many types of security devices, and the functions, detection methods, monitoring methods, and monitoring policy configurations of various security devices are also different. During the use of security devices, when the network environment, network application deployment, network session protocol, and network data packet content change, it may be that the monitoring policy configuration of the security device has not been updated in time, resulting in frequent alarm information false alarms , affecting the normal use of safety equipment, these false alarm information is the noise alarm information.

Noise alarm information will hinder the judgment of network security monitoring personnel, and network security monitoring personnel need to spend a lot of time and energy to judge the alarm information and determine whether the alarm information is noise alarm information. The security device needs to save the alarm information, and the noise alarm information will seriously waste the computing and storage resources of the security device. Therefore, how to efficiently determine a noise reduction strategy to reduce noise alarm information has become a technical problem to be solved urgently.

At present, the common noise reduction strategy is to analyze each alarm information in the alarm log of each security device one by one by technicians to determine the noise alarm information. After the noise alarm information is determined, according to the noise alarm information in each security Equipment layout noise reduction strategy. The workload is huge and many technicians are involved, so it is impossible to efficiently determine the noise reduction strategy to reduce the noise alarm information.

In order to solve the technical problems existing in related technologies, the present disclosure provides a method for determining an alarm information noise reduction strategy: the device for determining an alarm information noise reduction strategy acquires first alarm information from at least one security device; the first alarm information includes at least One of the following: noise warning information, non-noise warning information; input the first warning information into the noise warning information detection model, and determine the noise warning information in the first warning information; the detection model includes at least one first noise warning information judgment Rules; in this way, the device for determining the noise reduction strategy for the warning information can filter through the detection model, and determine the noise warning information in the first warning information from the safety device; determine the noise reduction strategy for at least one safety device based on the noise warning information. In this way, the alarm information noise reduction strategy determination device provided by the present application can use the model to directly identify the noise alarm information in the alarm information, and generate a corresponding noise reduction strategy, which solves the problem of excessive workload and involved in manual noise reduction in the prior art. There are too many people, and it is impossible to efficiently determine the noise reduction strategy to reduce the noise alarm information.

The method for determining an alarm information noise reduction strategy can be applied to the system 100 for determining an alarm information noise reduction strategy. Hereinafter, a system 100 for determining an alarm information noise reduction strategy provided by an embodiment of the present application will be described in detail with reference to FIG. 1 . As shown in FIG. 1 , FIG. 1 is a system 100 for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure. The system includes: an apparatus 101 for determining an alarm information noise reduction strategy, at least one security device 102 and an Internet device 103 .

Wherein, the alarm information noise reduction strategy determination unit 101 is used to filter noise alarm information from all alarm information of at least one security device 102 and determine a noise reduction strategy for the noise alarm information. After the noise reduction strategy is determined, the noise reduction strategy is sent to at least one safety device, so that the safety device determines the noise warning information in the safety device warning information based on the noise reduction strategy. In this way, the purpose of efficiently determining the noise reduction strategy to reduce the noise alarm information is achieved.

Optionally, the apparatus 101 for determining an alarm information noise reduction strategy includes a storage module 101a, a noise alarm information detection module 101b, and a policy generation module 101c. The alarm information target data in 101a acquires attribution information of an Internet Protocol (internet protocol, IP) address from the Internet device 103 in the target data of the alarm information. The noise warning information detection module 101b is used to obtain the target data and the attribution information in the sub-storage module 101a, and determines the noise warning information by the noise warning information detection model in the noise warning information detection module; The alarm information, target data, and attribution information of the target data are sent to the policy generation module 101c; the policy generation module 101c determines a noise reduction policy for at least one security device based on the noise alarm information, target data, and attribution information of the target data.

In a possible implementation manner, referring to FIG. 1 , as shown in FIG. 2 , the alarm information noise reduction strategy determination device 101 in the alarm information noise reduction strategy determination system 100 may specifically include: an alarm data collection module 201, a data preprocessing module 202 , a storage module 203 , a processing module 204 , a policy generation module 205 , and a policy deployment module 206 .

Specifically, the security device 102 may include: a network application protection system 207 , a situation awareness system 208 , a dynamic security defense system 209 , a network firewall 210 , and a terminal protection center 211 .

Wherein, the alarm data acquisition module 201 is used to acquire the alarm information of the above-mentioned multiple security devices, and transmit the alarm information to the data preprocessing module 202 .

The data preprocessing module 202 preprocesses the alarm information from the alarm data collector, determines the target data, and obtains the attribution information of the attacking IP address in the target data from the Internet device 212 according to the target data, and assigns the target data and the attribution of the target data The information is sent to the storage module 203 for storage.

The processing module 204 is divided into a model layer, an algorithm layer, a platform framework layer and a base layer, wherein the base layer includes a central processing unit (central processing unit, CPU), a graphics processing unit (graphics processing unit, GPU), field programmable The logic gate array (field programmable gate array, FPGA) is used to calculate and process the data; the platform framework layer includes the engine framework used to form the platform; the algorithm layer includes machine learning, deep learning, neural network management and other algorithms; the model layer includes the model Arranging and model training, used to determine the noise warning information based on the target data and the attribution information of the target data stored in the storage module 203 and the noise warning information detection model; and the target data and attribution information according to the warning information within a preset time period Carry out model training, update the noise warning information detection model; send to the policy generation module 205 after the noise warning information is determined.

The strategy generation module 205 processes and arranges the noise alarm information, determines the noise reduction strategies of the network application protection system 207, the situation awareness system 208, the dynamic security defense system 209, the network firewall 210, and the terminal protection center 211, and sends them to the strategy deployment module 206.

The policy deployment module 206 deploys the noise reduction strategy to the network application protection system 207, the situational awareness system 208, the dynamic security defense system 209, the network firewall 210, and the terminal protection center 211, so that the above-mentioned security devices determine the above-mentioned security Noise alarm information in the alarm information of the device.

Exemplarily, Table 1 shows a statistical table of quantities of different alarm information obtained from security devices.

Table 1

Among them, the proportions of different alarm information are: botnet 13%, system command injection 6%, Socks traffic abnormality 17%, Trojan horse virus 16%, infectious virus 19%, information stealing program 5%, SNMP weak password 15%, remote Controlling behavior 2%, rogue software 1%, mining virus 5%, other 1%. The attack types of the above alarm information mainly include Trojan horse virus, network attack, abnormal behavior and weak SNMP password. In a possible implementation manner, for the above four types of attack types, different noise alarm information judging rules may be preset for alarm information belonging to different attack types.

The basic hardware structure of the alarm information noise reduction strategy determination device 101 in the above alarm information noise reduction strategy determination system includes the elements included in the alarm information noise reduction strategy determination device 300 shown in FIG. 3 , and the alarm information shown in FIG. The device 300 for determining a noise reduction strategy is used as an example to introduce the hardware structure of the device 101 for determining a noise reduction strategy for alarm information. As shown in FIG. 3 , the apparatus 300 for determining an alarm information noise reduction strategy includes at least one processor 301 , a communication line 302 , and at least one communication interface 304 , and may also include a memory 303 . Wherein, the processor 301 , the memory 303 and the communication interface 304 may be connected through a communication line 302 .

The processor 301 may be a central processing unit (central processing unit, CPU), or a specific integrated circuit (application specific integrated circuit, ASIC), or one or more integrated circuits configured to implement the embodiments of the present disclosure, For example: one or more digital signal processors (digital signal processor, DSP), or one or more field programmable gate arrays (field programmable gate array, FPGA).

Communication line 302 may include a path for communicating information between the aforementioned components.

The communication interface 304 is used to communicate with other devices or communication networks, and any device such as a transceiver can be used, such as Ethernet, radio access network (radio access network, RAN), wireless local area network (wireless local area networks, WLAN), etc. .

The memory 303 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, and a random access memory (random access memory, RAM) or other types that can store information and instructions The dynamic storage device can also be an electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage ( including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to include or store desired program code in the form of instructions or data structures and can be stored by a computer Any other medium, but not limited to.

In a possible design, the memory 303 may exist independently of the processor 301, that is, the memory 303 may be a memory outside the processor 301. At this time, the memory 303 may be connected to the processor 301 through the communication line 302 for storing and executing Instructions or application program codes are controlled and executed by the processor 301 to implement the method for determining an alarm information noise reduction strategy provided in the following embodiments of the present disclosure. In yet another possible design, the memory 303 can also be integrated with the processor 301, that is, the memory 303 can be an internal memory of the processor 301, for example, the memory 303 is a cache, which can be used to temporarily store some data and instructions information etc.

As an implementable manner, the processor 301 may include one or more CPUs, for example, CPU0 and CPU1 in FIG. 3 . As another implementable manner, the apparatus 300 for determining an alarm information noise reduction strategy may include multiple processors, for example, the processor 301 and the processor 307 in FIG. 3 . As yet another implementable manner, the apparatus 300 for determining an alarm information noise reduction strategy may further include an output device 305 and an input device 306 .

Hereinafter, the method for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure will be described in detail.

As shown in FIG. 4, FIG. 4 is a method for determining an alarm information noise reduction strategy provided by the present disclosure. The method includes the following S401-S403, which will be described in detail below.

S401. The device for determining an alarm information noise reduction strategy determines first alarm information from at least one security device.

Wherein, the first warning information includes at least one of the following: noise warning information and non-noise warning information.

It can be understood that the noise alarm information is due to the failure to update the monitoring policy configuration of the security device in time when the network environment, network application deployment, network session protocol, and network data packet content change during the use of the security device. Alarm information that causes false alarms from security devices.

S402. The device for determining a noise reduction strategy for warning information inputs the first warning information into a noise warning information detection model, and determines noise warning information in the first warning information.

Wherein, the detection model includes at least one first noise warning information judgment rule.

In a possible implementation manner, the noise warning information detection model includes at least one first noise warning information judging rule, and the device for determining the noise reduction strategy for the warning information can determine the noise in the first noise warning information according to the first noise warning information judging rule. Warning message.

Exemplarily, the first warning information from the security device includes: the attack IP address is a virus IP address.

The alarm information noise reduction strategy determination device inputs the first alarm information into the noise alarm information detection model, determines that the virus IP address is an IP address with virus protection function, and the first alarm information belongs to false alarm information. At this time, the device for determining a noise reduction strategy for warning information determines that the first warning information is noise warning information.

S403. The device for determining a noise reduction strategy for alarm information determines a noise reduction strategy for at least one security device based on the noise alarm information.

With reference to the example in S402 above, the device for determining the noise reduction strategy for alarm information generates a noise reduction strategy for the IP address with virus protection function, and sends the noise reduction strategy to at least one security device, so that the security device can use the noise reduction strategy according to the noise reduction strategy. Noise policy to filter out the alarm information that identifies the IP address with virus protection function as a virus IP address.

The technical solutions provided by the above embodiments can at least bring about the following beneficial effects: the alarm information noise reduction policy determination device acquires the first alarm information from at least one security device; the first alarm information includes at least one of the following: noise alarm information, Noise alarm information; input the first alarm information into the noise alarm information detection model, and determine the noise alarm information in the first alarm information; the detection model includes at least one judgment rule for the first noise alarm information; thereby screening through the detection model, The noise warning information from the first warning information of the security equipment is determined; the noise reduction strategy of at least one security equipment is determined based on the noise warning information; that is, the first warning information from the security equipment is uniformly screened through the detection model, and the The noise warning information and the noise reduction strategy corresponding to the noise warning information, so as to achieve the purpose of efficiently determining the noise reduction strategy to reduce the noise warning information.

In a possible implementation manner, referring to FIG. 4, as shown in FIG. 5, the process of determining the first alarm information from at least one security device in the above S401, the alarm information noise reduction strategy determination device can be specifically implemented through the following S501-S503 , which will be described in detail below.

S501. The device for determining a noise reduction strategy for alarm information determines target data for each piece of second alarm information.

Wherein, the second alarm information is alarm information obtained from at least one security device; the target data includes: attacking Internet protocol IP address, attack behavior type, attack method, and attacked IP address.

It should be understood that the target data includes all attacking end data, all attacked end data, and attack occurrence time, etc., and is not limited to the above-mentioned attacking Internet protocol IP address, attack behavior type, attack method, and attacked IP address information. In the method, the target data also includes at least one of the following: port number of the attacked end, request protocol of the attacking end, request method of the attacking end, Host header information, uniform resource locator (uniform resource locator, URL), attacking end parameters, attacked end The returned status code, the byte requested by the attacking end, the byte returned by the attacked end, and the date and time of the attack.

S502. The device for determining an alarm information noise reduction strategy acquires attribution information of each piece of second alarm information.

Wherein, the attribution information is the attribution information of the attacking IP address in the target data.

In a possible implementation manner, the device for determining an alarm information noise reduction strategy may obtain attribution information of an attacking IP address from an Internet device.

Exemplarily, the attribution information includes at least one of the following: the region to which the attacking IP address belongs, the network service provider to which the attacking IP address belongs, the autonomous system (AS) to which the attacking IP address belongs, and recent attack activity information of the attacking IP address.

S503. The device for determining a noise reduction strategy for alarm information determines that the first alarm information includes target data and attribution information of each piece of second alarm information.

It can be understood that the alarm information noise reduction strategy determination device can obtain the attribution information of the attack IP address based on the attack IP address in the target data of each second alarm information, and the attribution information of the attack IP address can be used to improve the alarm information reduction. The noise strategy determining device determines the accuracy of the noise warning information and updates the noise warning information detection model.

It should be pointed out that the device for determining the alarm information noise reduction strategy may not necessarily obtain the attribution information of all attacking IP addresses. For target data for which no attribution information has been obtained, the device for determining a noise reduction strategy for warning information may also determine whether the first warning information is noise warning information according to relevant information in the target data.

The technical solutions provided by the above embodiments can at least bring about the following beneficial effects: the device for determining the noise reduction strategy for alarm information determines the target data of each piece of second alarm information. The second alarm information is alarm information obtained from at least one security device; the target data includes: attacking Internet protocol IP address, attack behavior type, attack method, and attacked IP address. And the attribution information of the attacking IP address is obtained based on the attacking IP address in the target data. That is, the second alarm information from at least one security device is preprocessed, so as to determine the target data and the attribution information of the target data for inputting into the noise alarm information detection model in the first alarm information.

In a possible implementation manner, referring to FIG. 5, as shown in FIG. 6, before the above S501, the alarm information noise reduction strategy determination device determines the target data of each second alarm information, the method further includes the following S601-S602, The details will be described below.

S601. The apparatus for determining an alarm information noise reduction strategy receives third alarm information from at least one security device.

It can be understood that the third alarm information is all alarm information obtained directly from at least one security device without screening and processing, and the third alarm information includes alarm information for which the noise reduction strategy has been determined and alarm information for which the noise reduction strategy has not been determined information.

S602. The device for determining the noise reduction strategy for the warning information deletes the warning information of the determined noise reduction strategy in the third warning information, and determines the second warning information.

In a possible implementation manner, after receiving all the third warning information from at least one security device, the device for determining the noise reduction strategy for the warning information screens the third warning information, and based on the warning information for which the noise reduction strategy has been determined, It is determined that the alarm information for which the noise reduction strategy is not determined among the three alarm information is the second alarm information.

The technical solutions provided by the above embodiments can at least bring about the following beneficial effects: after receiving the third alarm information from at least one security device, the device for determining the noise reduction strategy for alarm information determines to perform screening processing on the third alarm information, based on the determined For the alarm information of the noise reduction strategy, it is determined that the alarm information for which the noise reduction strategy is not determined among the three alarm information is the second alarm information. In this way, the purpose of filtering out the alarm information for which the noise reduction strategy has not been determined from all the third alarm information from at least one security device is achieved.

In a possible implementation manner, the noise warning information detection model is used to judge whether the target data in the target first warning information is the target data that needs to be warned according to the target data and/or attribution information in the target first warning information; If the target data of the first warning information is not the target data to be warned, it is determined that the target first warning information is noise warning information.

In a possible implementation manner, the above-mentioned first noise alarm information judgment rule includes at least one of the following: a virus-like noise alarm judgment rule; a website attack method-like noise warning judgment rule; a network attack behavior-type noise alarm judgment rule; Judgment rules for noise warnings.

Among them, the virus noise alarm judgment rules include: based on the attacking IP address in the first alarm information and the attribution information of the attacking IP address, determine whether the attacking IP address has anti-virus and protection functions, and the attacking IP address already has anti-virus and protection functions In the case of judging that the first warning information is noise warning information;

Among them, the website attack method noise warning judgment rule includes: based on the attack method in the first warning information, determine whether the attack method is a preset attack method, and judge that the first warning information is noise if the attack method is a preset attack method. warning information;

Wherein, the network attack behavior type noise alarm judgment rule includes: based on the attack behavior type in the first alarm information, determine whether the attack behavior type is a preset non-attack behavior, and in the attack behavior type judging that the first warning information is the noise warning information when it is a preset non-aggressive behavior;

Wherein, the abnormal behavior noise warning judgment rule includes: based on the attacking IP address and the attacked IP address in the first warning information, determine whether the data transmission in the first warning information is traffic data transmission between security devices, in the first When the data transmission in the warning information is traffic data transmission between security devices, it is determined that the first warning information is noise warning information.

In a possible implementation manner, the noise warning information detection device determines that the first warning information belongs to one of the above four types of attack types according to the target data and/or attribution information in the target first warning information, and according to The noise warning judging rule of the corresponding type judges whether the first warning information is noise warning information.

Exemplarily, the device for detecting noise alarm information determines that the first alarm information belongs to the network management protocol SNMP weak password in the network attack behavior type according to the target data and/or attribution information in the target first alarm information, and further determines that the SNMP weak password Whether the password is a network printer or a computer network peripheral, and if the attack behavior type is a network printer or a computer network peripheral, it is determined that the first warning information is the noise warning information.

It can be understood that the above first noise warning information judgment rule is only an example, and the first noise warning information judgment rule in the present disclosure is not limited to the above judgment rule. The alarm information noise reduction strategy determination device can generate a new noise alarm information judgment rule for judging noise data based on the target data and attribution information of the alarm information, and update the first noise alarm information judgment rule in the noise alarm information detection model .

In a possible implementation manner, referring to FIG. 4 , as shown in FIG. 7 , in the above S402, the alarm information noise reduction strategy determination device inputs the first alarm information into the noise alarm information detection model, and determines the noise alarm information in the first alarm information. After the noise warning information, the method also includes the following S701-S704, which will be described in detail below.

S701. The device for determining a noise reduction strategy for alarm information determines the noise alarm information and the non-noise alarm information in the first alarm information.

In a possible implementation manner, after the alarm information noise reduction strategy determination device inputs the first alarm information into the noise alarm information detection model, it can determine the first alarm information according to the first noise alarm information judgment rule in the noise alarm information detection model Noise warning information and non-noise warning information in the information.

S702. The device for determining an alarm information noise reduction strategy generates a second noise alarm information judgment rule for judging the noise data based on the target data and/or attribution information of the noise alarm information.

Exemplarily, if the target data of the noise warning information includes the attacking IP address as a poisoned IP address, the device for determining the noise reduction strategy for the warning information based on the noise warning information determines that the second judgment rule for the noise warning information includes: if the noise reduction of the warning information If the first warning information received by the policy determining device includes that the attacking IP address is a poisoned IP address, the first warning information is determined to be noise warning information.

S703. The device for determining a noise reduction strategy for alarm information generates a third noise alarm information judgment rule for judging noise data based on target data and/or attribution information of non-noise alarm information.

Exemplarily, if the target data of the non-noise warning information includes the attack type as an information theft program, and the attacking IP address belongs to region A, the device for determining the noise reduction strategy for the warning information determines the third noise warning information based on the non-noise warning information. The rules include: if the first alarm information received by the alarm information noise reduction strategy determination device includes the attack type as information stealing program and the attack IP address belongs to region A, then determine that the first alarm information is non-noise alarm information.

S704. The device for determining an alarm information noise reduction strategy updates the noise alarm information detection model based on the second noise alarm information judgment rule and the third noise alarm information judgment rule.

In a possible implementation, the device for determining the noise reduction strategy for the alarm information will save the target data, the attribution information and the corresponding judgment results to the storage module of the device for determining the noise reduction strategy for the alarm information after each judgment of the noise alarm information. During the preset period of time, the alarm information noise reduction strategy determination device will determine a plurality of second noise alarm information judgment rules and a plurality of third noise alarm information judgment rules according to the data in the storage module, when the noise alarm information detection model does not include When the above multiple second noise warning information judgment rules and multiple third noise warning information judgment rules are used, the multiple second noise warning information judgment rules and the multiple third noise warning information judgment rules are updated to the noise warning information detection Model.

The technical solutions provided by the above embodiments can bring at least the following beneficial effects: after the alarm information noise reduction strategy determination device determines the noise alarm information in the first alarm information and the non-noise alarm information, based on the target data of the noise alarm information and and/or attributable information to generate a second noise warning information judging rule for judging noise data. Based on the target data and/or attribution information of the non-noise warning information, a third noise warning information judging rule for judging noise data is generated. The combining device updates the noise warning information detection model based on the second noise warning information judging rule and the third noise warning information judging rule. Therefore, the device for determining the noise reduction strategy for the alarm information can update the noise alarm information detection model based on the data and determination results of each noise alarm information determination.

In a possible implementation manner, referring to FIG. 4, as shown in FIG. 8, after the above S403, the alarm information noise reduction strategy determination device determines the noise reduction strategy of at least one security device based on the noise alarm information, the method further includes the following S801 , which will be described in detail below.

S801. The apparatus for determining an alarm information noise reduction strategy sends a noise reduction strategy to any security device in at least one security device, so that any security device determines noise alarm information in alarm information of any security device based on the noise reduction strategy.

In a possible implementation manner, the device for determining the noise reduction strategy for alarm information sends the generated noise reduction strategy to any of the above-mentioned security devices, so that the security device adds the characteristics of the noise alarm information included in the noise reduction strategy to the white list of the device , so that the security device can determine the noise warning information in its warning information based on the characteristics of the noise warning information.

The technical solutions provided by the above embodiments can bring at least the following beneficial effects: the device for determining the noise reduction strategy for alarm information sends the noise reduction strategy to any security device in at least one security device, so that any security device determines based on the noise reduction strategy Noise warning information in the warning information of any security device. Therefore, the purpose of reducing the noise warning information of the safety equipment is achieved.

Above, the method for determining the alarm information noise reduction strategy involved in the embodiments of the present disclosure has been described in detail.

It can be seen that the foregoing mainly introduces the technical solutions provided by the embodiments of the present disclosure from the perspective of methods. In order to realize the above functions, it includes corresponding hardware structures and/or software modules for performing various functions. Those skilled in the art should easily realize that, in combination with the modules and algorithm steps of the examples described in the embodiments disclosed herein, the embodiments of the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software drives hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementation should not be considered beyond the scope of the present disclosure.

The embodiments of the present disclosure can divide the function modules of the alarm information noise reduction strategy determination device according to the above method example, for example, each function module can be divided corresponding to each function, or two or more functions can be integrated into one processing module middle. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. Optionally, the division of modules in the embodiments of the present disclosure is schematic, and is only a logical function division, and there may be another division manner in actual implementation.

As shown in FIG. 9 , FIG. 9 is a schematic structural diagram of an apparatus 900 for determining an alarm information noise reduction strategy provided by an embodiment of the present disclosure.

The apparatus 900 for determining a noise reduction strategy for warning information includes: a processing unit 902; the processing unit 902 is configured to determine first warning information from at least one security device; the first warning information includes at least one of the following: noise warning information, Noise warning information; the processing unit 902 is further configured to input the first warning information into the noise warning information detection model, and determine the noise warning information in the first warning information; the detection model includes at least one judgment rule for the first noise warning information; The processing unit 902 is further configured to determine a noise reduction policy of at least one security device based on the noise warning information.

In a possible implementation manner, the apparatus 900 for determining an alarm information noise reduction strategy further includes: a communication unit 901; a processing unit 902, specifically configured to determine target data for each piece of second alarm information; wherein, the second alarm information is from at least The alarm information obtained by a security device; the target data includes: attacking Internet protocol IP address, attack behavior type, attack mode, and attacked IP address; instructing the communication unit 901 to obtain the attribution information of each second alarm information; attribution The information is the attribution information of the attacking IP address in the target data; the processing unit 902 is specifically configured to determine the target data and the attribution information of each piece of second warning information in the first warning information.

In a possible implementation manner, the communication unit 901 is further configured to receive third alarm information from at least one security device; the processing unit 902 is specifically configured to delete the alarm information of the determined noise reduction strategy in the third alarm information, Determine the second alarm information.

In a possible implementation manner, the noise warning information detection model is used to determine whether the target data in the target first warning information is the target data that needs to be warned according to the target data and/or attribution information in the target first warning information; processing Unit 902 determines that the target first warning information is noise warning information when the target data of the target first warning information is not the target data to be warned.

In a possible implementation manner, at least one first noise warning information judgment rule includes at least one of the following: a virus-like noise warning judgment rule; a website attack method noise-like warning judgment rule; a network attack behavior-like noise warning judgment rule; an abnormal behavior Noise-like warning judgment rules;

The virus-like noise alarm judgment rule includes: based on the attack IP address in the first alarm information and the attribution information of the attack IP address, determine whether the attack IP address has anti-virus and protection functions. In the case where the attacking IP address has antivirus and protection functions, it is judged that the first warning information is the noise warning information;

The website attack method noise-like warning judgment rule includes: based on the attack method in the first warning information, determine whether the attack method is a preset attack method, and if the attack method is the preset attack method In the case of judging that the first warning information is the noise warning information;

The network attack behavior type noise alarm judgment rule includes: based on the attack behavior type in the first alarm information, determine whether the attack behavior type is a preset non-attack behavior, and if the attack behavior type is a preset Judging that the first warning information is the noise warning information under the assumed non-aggressive behavior;

The abnormal behavior noise warning judgment rule includes: based on the attacking IP address and the attacked IP address in the first warning information, determine whether the data transmission in the first warning information is between security devices If the data transmission in the first warning information is traffic data transmission between security devices, it is determined that the first warning information is the noise warning information.

In a possible implementation manner, the processing unit 902 is further configured to: determine the noise warning information and the non-noise warning information in the first warning information; based on the target data and/or attribution information of the noise warning information, generate The second noise warning information judging rule of the data; based on the target data and/or attribution information of the non-noise warning information, generating a third noise warning information judging rule for judging the noise data; based on the second noise warning information judging rule, and the first Three noise alarm information judgment rules, update the noise alarm information detection model.

In a possible implementation manner, the communication unit 901 is further configured to: send a noise reduction policy to any security device in at least one security device, so that any security device determines an alarm of any security device based on the noise reduction policy Noise warning message in message.

An embodiment of the present disclosure also provides a device for determining a noise reduction strategy for alarm information. The device for determining a noise reduction strategy for alarm information includes a processor and a memory; wherein the memory is used to store computer-executable instructions. When the device for determining a noise reduction strategy for alarm information is running The processor executes the computer-executable instructions stored in the memory, so that the apparatus for determining an alarm information noise reduction strategy executes the method for determining an alarm information noise reduction strategy described in the embodiments of the present disclosure.

Embodiments of the present disclosure provide a computer program product containing instructions, and when the instructions are run on a computer, the computer is made to execute the method for determining an alarm information noise reduction strategy in the above method embodiments.

An embodiment of the present disclosure provides a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run computer programs or instructions, so as to implement the method for determining the alarm information noise reduction strategy in the above method embodiments .

Wherein, the computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples (non-exhaustive list) of computer readable storage media include: electrical connection having one or more wires, portable computer disk, hard disk. Random Access Memory (Random Access Memory, RAM), Read-Only Memory (Read-Only Memory, ROM), Erasable Programmable Read-Only Memory (Erasable Programmable Read Only Memory, EPROM), registers, hard disk, optical fiber, portable compact Disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any other form of computer-readable storage medium in a suitable combination of the above, or values in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may be located in an application specific integrated circuit (Application Specific Integrated Circuit, ASIC). In the embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, and the program may be used by or in combination with an instruction execution system, apparatus, or device.

Since the devices, equipment, computer-readable storage media, and computer program products in the embodiments of the present disclosure can be applied to the above-mentioned methods, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present disclosure are hereby No longer.

The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto, and any changes or replacements within the technical scope disclosed in the present disclosure shall be covered within the protection scope of the present disclosure . Therefore, the protection scope of the present disclosure should be determined by the protection scope of the claims.

Claims (16)

1. A method for determining an alarm information noise reduction strategy, comprising: Determine first warning information from at least one security device; the first warning information includes at least one of the following: noise warning information, non-noise warning information; Inputting the first warning information into a noise warning information detection model to determine the noise warning information in the first warning information; the detection model includes at least one first noise warning information judgment rule; A noise reduction strategy for the at least one security device is determined based on the noise warning information. 2. The method according to claim 1, wherein said determining the first warning information from at least one security device comprises: Determine the target data of each piece of second warning information; wherein, the second warning information is warning information obtained from the at least one security device; the target data includes: attack Internet Protocol IP address, attack behavior type , attack method, attacked IP address; Obtain the attribution information of each piece of second warning information; the attribution information is the attribution information of the attacking IP address in the target data; It is determined that the first alarm information includes the target data of each piece of second alarm information and the attribution information. 3. The method according to claim 2, characterized in that, before said determining the target data of each piece of second warning information, said method further comprises: receiving a third alert message from the at least one security device; Deleting the alarm information of the determined noise reduction strategy in the third alarm information, and determining the second alarm information. 4. The method according to claim 2 or 3, wherein the noise warning information detection model is used to judge the target first warning information according to the target data and/or attribution information in the target first warning information Whether the target data of the target is the target data that needs to be warned; if the target data of the target first warning information is not the target data that needs to be warned, it is determined that the target first warning information is the noise warning information. 5. The method according to claim 2 or 3, wherein the at least one first noise warning information judging rule comprises at least one of the following: a virus-like noise warning judging rule; a website attack mode-like noise warning judging rule; Judgment rules for network attack behavior noise warnings; judgment rules for abnormal behavior noise warnings; The virus-like noise alarm judgment rule includes: based on the attack IP address in the first alarm information and the attribution information of the attack IP address, determine whether the attack IP address has anti-virus and protection functions. In the case that the attacking IP address already has antivirus and protection functions, it is judged that the first warning information is the noise warning information; The website attack method noise-like warning judgment rule includes: based on the attack method in the first warning information, determine whether the attack method is a preset attack method, and if the attack method is the preset attack method In the case of , judging that the first warning information is the noise warning information; The network attack behavior type noise alarm judgment rule includes: based on the attack behavior type in the first alarm information, determine whether the attack behavior type is a preset non-attack behavior, and if the attack behavior type is a preset In the case of the assumed non-aggressive behavior, it is judged that the first warning information is the noise warning information; The abnormal behavior noise warning judgment rule includes: based on the attacking IP address and the attacked IP address in the first warning information, determine whether the data transmission in the first warning information is between security devices If the data transmission in the first warning information is traffic data transmission between security devices, it is determined that the first warning information is the noise warning information. 6. The method according to any one of claims 1-3, characterized in that, in said inputting said first warning information into a noise warning information detection model, determining the noise warning in said first warning information After the information, the method also includes: determining the noise warning information and the non-noise warning information in the first warning information; generating a second noise warning information judging rule for judging noise data based on the target data and/or attribution information of the noise warning information; generating a third noise warning information judging rule for judging noise data based on the target data and/or attribution information of the non-noise warning information; The noise warning information detection model is updated based on the second noise warning information judging rule and the third noise warning information judging rule. 7. The method according to any one of claims 1-3, wherein after determining the noise reduction strategy of the at least one security device based on the noise warning information, the method further comprises: sending the noise reduction policy to any security device in the at least one security device, so that the any security device determines the noise warning information in the warning information of the any security device based on the noise reduction policy . 8. A device for determining an alarm information noise reduction strategy, comprising: a processing unit; The processing unit is configured to determine first warning information from at least one safety device; the first warning information includes at least one of the following: noise warning information, non-noise warning information; The processing unit is further configured to input the first warning information into a noise warning information detection model, and determine the noise warning information in the first warning information; the detection model includes at least one first noise warning information Judgment rules; The processing unit is further configured to determine a noise reduction policy of the at least one security device based on the noise warning information. 9. The device according to claim 8, wherein the device further comprises: a communication unit; the processing unit is specifically used for: Determining the target data of each piece of second warning information; wherein, the second warning information is the warning information obtained from the at least one security device; the target data includes: attack Internet protocol IP address, attack behavior type, Attack method, attacked IP address; Instructing the communication unit to acquire the attribution information of each piece of second alarm information; the attribution information is the attribution information of the attacking IP address in the target data; Determine the target data of each piece of second warning information in the first warning information, and the attribution information. 10. The device according to claim 9, wherein the communication unit is further configured to receive third warning information from the at least one security device; The processing unit is specifically configured to delete the alarm information of the determined noise reduction strategy in the third alarm information, and determine the second alarm information. 11. The device according to claim 9 or 10, wherein the noise warning information detection model is used to judge the target first warning according to the target data and/or attribution information in the target first warning information Whether the target data of the information is the target data that needs to be warned; the processing unit determines that the target first warning information is the noise warning when the target data of the target first warning information is not the target data that needs to be warned information. 12. The device according to claim 9 or 10, wherein the at least one first noise warning information judgment rule includes at least one of the following: a virus-like noise warning judgment rule; a website attack method noise-like warning judgment rule; Judgment rules for network attack behavior noise warnings; judgment rules for abnormal behavior noise warnings; The virus-like noise alarm judgment rule includes: based on the attack IP address in the first alarm information and the attribution information of the attack IP address, determine whether the attack IP address has anti-virus and protection functions. In the case where the attacking IP address has antivirus and protection functions, it is judged that the first warning information is the noise warning information; The website attack method noise-like warning judgment rule includes: based on the attack method in the first warning information, determine whether the attack method is a preset attack method, and if the attack method is the preset attack method In the case of judging that the first warning information is the noise warning information; The network attack behavior type noise alarm judgment rule includes: based on the attack behavior type in the first alarm information, determine whether the attack behavior type is a preset non-attack behavior, and if the attack behavior type is a preset Judging that the first warning information is the noise warning information under the assumed non-aggressive behavior; The abnormal behavior noise warning judgment rule includes: based on the attacking IP address and the attacked IP address in the first warning information, determine whether the data transmission in the first warning information is between security devices If the data transmission in the first warning information is traffic data transmission between security devices, it is determined that the first warning information is the noise warning information. 13. The device according to any one of claims 8-10, wherein the processing unit is further configured to: determining the noise warning information and the non-noise warning information in the first warning information; generating a second noise warning information judging rule for judging noise data based on the target data and/or attribution information of the noise warning information; generating a third noise warning information judging rule for judging noise data based on the target data and/or attribution information of the non-noise warning information; The noise warning information detection model is updated based on the second noise warning information judging rule and the third noise warning information judging rule. 14. The device according to any one of claims 8-10, wherein the communication unit is further used for: sending the noise reduction policy to any security device in the at least one security device, so that the any security device determines the noise warning information in the warning information of the any security device based on the noise reduction policy . 15. A device for determining a noise reduction strategy for alarm information, characterized by comprising: a processor and a memory; wherein the memory is used to store computer-executable instructions, and when the device for determining a noise reduction strategy for alarm information is running, the The processor executes the computer-executable instructions stored in the memory, so that the device for determining an alarm information noise reduction strategy executes the method for determining an alarm information noise reduction strategy according to any one of claims 1-7. 16. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the instructions in the computer-readable storage medium are executed by the processor of the alarm information noise reduction strategy determination device, the The device for determining a noise reduction strategy for alarm information executes the method for determining a noise reduction strategy for alarm information according to any one of claims 1-7.