WO2023039973A1

WO2023039973A1 - Abnormal false alarm processing method and apparatus, and storage medium and terminal

Info

Publication number: WO2023039973A1
Application number: PCT/CN2021/124046
Authority: WO
Inventors: 殷钱安; 梁淑云; 余贤喆; 王启凡; 陶景龙; 刘胜; 马影; 周晓勇; 魏国富; 夏玉明
Original assignee: 上海观安信息技术股份有限公司
Priority date: 2021-09-17
Filing date: 2021-10-15
Publication date: 2023-03-23
Also published as: CN113535458B; CN113535458A

Abstract

An abnormal false alarm processing method, comprising: acquiring service demand information, and operation information of an operation object, about which an alarm is to be sounded (101); determining, on the basis of a demand operation subject mapping relationship, an operation subject classification corresponding to a demand subject classification keyword of the service demand information (102), wherein the demand operation subject mapping relationship is used for representing a subject classification relationship between different demand subject classification keywords and different operation subject classifications; and if a first similarity between the operation information and an operation subject classification keyword of the operation subject classification is greater than a first similarity threshold, determining alarm information, which is generated on the basis of the operation information, as a false alarm event, and deleting the alarm information (103). Further disclosed are an abnormal false alarm processing apparatus, and a storage medium and a terminal, which solve the problem in the prior art of it not being possible to effectively and accurately process abnormal information.

Description

Abnormal false positive processing method and device, storage medium, terminal

technical field

The present invention relates to the technical field of the Internet, in particular to a processing method and device, a storage medium, and a terminal for abnormal false alarms.

Background technique

With the rapid development of Internet technology, the problem of data security has become more and more prominent. In order to avoid data leakage of the system or terminal equipment and cause loss of user property, data security protection has become more and more important. In practical applications, security detection of system or equipment behavior is usually performed based on the behavioral security monitoring system, so as to realize security protection. During this process, when the work content changes, such as business changes that cause data processing personnel to perform a large number of operations during non-working hours, there may be false alarms in behavior security detection. In order to ensure the protection effect of the security monitoring system and reduce protection errors Generally, it is necessary to make false positive judgments on the abnormal information detected by security to reduce false positives.

At present, manual or whitelist rule matching is usually used to judge false positives for abnormalities detected by security. However, due to the large number of abnormal information and the number of targets that generate abnormal information, the business requirements are more complicated, and the data change work type is not Single, whether it is whitelist matching or manual, it needs to be constantly changed in real time according to the business type and demand content for manual maintenance, which consumes a lot of labor costs and is prone to human judgment errors, resulting in false positives and slow judgment speed. Slow and inaccurate processing, which makes it impossible to effectively and accurately handle abnormal false positives.

Contents of the invention

In view of this, the present invention provides a method and device, a storage medium, and a terminal for processing abnormality and false alarms, the main purpose of which is to solve the existing problem that the abnormality information cannot be processed effectively and accurately.

According to one aspect of the present invention, a method for processing abnormal false positives is provided, including:

Obtain business requirement information and operation information of operation objects to be alerted;

Determine the operation theme classification corresponding to the demand theme classification keyword of the business demand information based on the demand operation theme mapping relationship, the demand operation theme mapping relationship is used to represent the theme between different demand theme classification keywords and different operation theme categories Classification relationship, the topic classification relationship is based on the combination relationship between different demand topic classifications, different demand topic classification keywords, different operation topic classifications, and different operation topic classification keywords respectively. matching determined;

If the first similarity between the operation information and the operation theme classification keywords of the operation theme classification is greater than a first similarity threshold, then determine that the alarm information generated based on the operation information is a false alarm event, and delete the alarm information .

Further, before acquiring the business requirement information and the operation information of the operation object to be alerted, the method further includes:

The subject classification keywords of historical business demand information and historical operation information are analyzed respectively, and the demand operation subject mapping relationship is constructed based on the parsed demand subject classification keywords and operation subject classification keywords.

Further, the analysis of theme classification keywords for historical business demand information and historical operation information respectively, and constructing a demand operation theme mapping relationship based on the parsed demand theme classification keywords and operation theme classification keywords includes:

Segment the historical business demand information and historical operation information respectively to obtain the sequence of word segmentation for demand and the sequence of word segmentation for operation;

According to the subject classification model, subject classification and subject classification keyword extraction are performed on the demand word segmentation sequence and the operation word segmentation sequence to obtain demand subject classification keywords and operation theme classification keywords, and the subject classification includes demand subject classification, operation theme Classification, the number of subject classifications of the demand subject classification keywords is the same as that of the operation subject classification keywords;

Based on the demand operation matching database, establish the demand operation theme mapping relationship between the demand theme classification, the demand theme classification keywords, the operation theme classification, and the operation theme classification keywords, in the demand operation matching database Combination relations between different demand topic classifications and keywords of different demand topic classifications received and updated at preset time intervals and different operation topic classifications and keywords of different operation topic classifications are stored.

Further, the determination of the operation theme classification corresponding to the demand theme classification keywords of the business demand information based on the demand operation theme mapping relationship includes:

Calculating the second similarity between the requirement word segmentation sequence of the business requirement information and each requirement topic classification keyword in the requirement operation topic mapping relationship;

Selecting the demand topic classification matched by the demand topic classification keyword corresponding to the largest second similarity in the second similarity;

An operation subject category corresponding to the requirement subject category is searched based on the requirement operation subject mapping relationship.

Further, before determining the operation theme classification corresponding to the demand theme classification keywords of the business demand information based on the demand operation theme mapping relationship, the method further includes:

performing text segmentation on the business requirement information by using a text segmentation algorithm, and performing text segmentation on the operation information based on a preset delimiter, to obtain a requirement segmentation sequence and an operation segmentation sequence respectively;

Combining the subject classification model and the information measurement index, subject the demand segment sequence and the operation segment sequence to obtain demand subject classification keywords matching the demand subject classification and operation subject classification keywords matching the operation subject classification.

If the number of differences between the business requirement information and the requirement subject classification keywords in the historical service requirement information exceeds a preset difference threshold, the requirement operation subject mapping relationship is updated based on the business requirement information.

Further, the determining that generating alarm information based on the operation information is a false positive event, and after deleting the alarm information, the method further includes:

Count the identity information, false positive time, false positive times, and business requirement information corresponding to the false positive event of the operation object to be alarmed as the false positive event, and generate and output abnormal false positive warning information.

According to another aspect of the present invention, a device for processing abnormal false alarms is provided, including:

An acquisition module, configured to acquire business requirement information and operation information of operation objects to be alerted;

A determining module, configured to determine an operation topic classification corresponding to a demand topic classification keyword of the business requirement information based on a demand operation topic mapping relationship, where the demand operation topic mapping relationship is used to represent different demand topic classification keywords and different operation topics The theme classification relationship between categories, the theme classification relationship is based on the combined relationship between different demand theme classifications, different demand theme classification keywords and different operation theme classifications, different operation theme classification keywords. Determined by matching with the classification of the subject of the operation;

A deletion module, configured to determine that generating alarm information based on the operation information is a false alarm event if the first similarity between the operation information and the operation topic classification keywords of the operation topic classification is greater than a first similarity threshold, Delete the warning information.

Further, the device also includes:

The construction module is used to analyze the subject classification keywords of the historical business demand information and the historical operation information respectively, and construct the demand operation theme mapping relationship based on the parsed demand theme classification keywords and operation theme classification keywords.

Further, the building blocks include:

The word segmentation unit is used to segment the historical business demand information and the historical operation information respectively to obtain the demand word segmentation sequence and the operation word segmentation sequence;

The extraction unit is used to perform theme classification and theme classification keyword extraction on the demand word segmentation sequence and the operation word segmentation sequence according to the theme classification model, to obtain demand theme classification keywords and operation theme classification keywords, and the theme classification includes demand Subject classification, operation theme classification, the number of theme categories of the demand theme classification keywords and the operation theme classification keywords is the same;

An establishment unit, configured to establish a demand operation theme mapping relationship between the demand theme classification, the demand theme classification keywords, the operation theme classification, and the operation theme classification keywords based on the demand operation matching library, the The demand operation matching database stores the combined relationship between different demand theme categories and keywords of different demand theme categories received and updated at preset time intervals, and different operation theme categories and different operation theme category keywords.

Further, the determination module includes:

A calculation unit, configured to calculate the second similarity between the demand word segmentation sequence of the business demand information and each demand topic classification keyword in the demand operation topic mapping relationship;

A selecting unit, configured to select a demand subject classification matched by a demand subject classification keyword corresponding to the largest second similarity among the second similarities;

A searching unit, configured to search for an operation topic category corresponding to the requirement topic category based on the requirement operation topic mapping relationship.

Further, the device also includes:

A word segmentation module, configured to use a text segmentation algorithm to perform text segmentation on the business requirement information, and perform text segmentation on the operation information based on a preset delimiter, to obtain a demand segmentation sequence and an operation segmentation sequence respectively;

A division module, configured to perform theme division on the demand word segmentation sequence and the operation word segmentation sequence in combination with the theme classification model and information measurement indicators, and obtain demand theme classification keywords matching the demand theme classification and operations matching the operation theme classification Subject classification keywords.

Further, the device also includes:

An update module, configured to update the demand operation topic mapping relationship based on the business demand information if the number of differences between the demand subject classification keywords in the business demand information and the historical business demand information exceeds a preset difference threshold.

Further, the device also includes:

The statistical module is used for counting the identity information, false positive time, false positive times, and business demand information corresponding to the false positive event of the operation object to be alarmed as the false positive event, and generating and outputting abnormal false positive warning information.

According to yet another aspect of the present invention, a storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction causes a processor to perform operations corresponding to the above-mentioned method for handling abnormal false alarms.

According to another aspect of the present invention, a terminal is provided, including: a processor, a memory, a communication interface, and a communication bus, and the processor, the memory, and the communication interface complete mutual communication through the communication bus ;

The memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the above-mentioned method for handling abnormality and false alarms.

With the above technical solutions, the technical solutions provided by the embodiments of the present invention have at least the following advantages:

The present invention provides a processing method and device, a storage medium, and a terminal for abnormal false alarms. Compared with the prior art, the embodiment of the present invention acquires business demand information and operation information of operation objects to be alerted; operates topic mapping based on demand The relationship determines the operation theme classification corresponding to the demand theme classification keyword of the business demand information, and the demand operation theme mapping relationship is used to represent the theme classification relationship between different demand theme classification keywords and different operation theme categories; If the first similarity between the operation information and the operation topic classification keywords of the operation topic classification is greater than the first similarity threshold, it is determined that the alarm information generated based on the operation information is a false alarm event, and the alarm information is deleted, greatly The labor cost is reduced, the misjudgment and misjudgment of abnormality caused by human judgment are avoided, and the recognition accuracy of false positives of abnormalities is greatly increased, thereby improving the processing efficiency of false positives of abnormalities.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

FIG. 1 shows a flow chart of a method for processing abnormal false alarms provided by an embodiment of the present invention;

FIG. 2 shows a flow chart of another method for processing abnormal false alarms provided by an embodiment of the present invention;

FIG. 3 shows a flow chart of another method for processing abnormal false alarms provided by an embodiment of the present invention;

Fig. 4 shows a composition block diagram of a device for processing abnormal false positives provided by an embodiment of the present invention;

FIG. 5 shows a schematic structural diagram of a terminal provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure, and to fully convey the scope of the present disclosure to those skilled in the art.

The embodiment of the present invention provides a method for processing abnormal false alarms, as shown in Figure 1, the method includes:

101. Acquire service requirement information and operation information of an operation object to be alerted.

In the embodiment of the present invention, aiming at the real-time detection of network security, alarm information will be generated for the abnormal situation information according to different security detection methods, so that the abnormal situation can be cleared. Among them, the business requirement information is the requirement content for detecting network security in network security, including but not limited to behavior, file object, specified program code, etc., and the obtained business requirement information exists in the form of a business requirement document, which is not included in the embodiment of the present invention. Specific limits. The operation object to be alerted is the operation subject that has been determined to be abnormal, including but not limited to the operator id, ip address, device number, etc., so that the operation object to be alerted is the target of the abnormal alarm, and the operation information is the operation information to be alerted The operation object is determined as the operation content of the abnormal alarm target, including but not limited to operation behavior, operation content, etc., and the obtained operation information exists in the form of operation log, which is not specifically limited in the embodiment of the present invention.

It should be noted that the business requirement information in step 101 is the recent business requirement information, that is, the business requirement information whose time interval is shortened relative to the historical business information and is close to the current time. The information is compared, and the same business requirement information is determined as the business requirement information in step 101.

102. Determine an operation theme classification corresponding to a demand theme classification keyword of the business demand information based on a demand operation theme mapping relationship.

In the embodiment of the present invention, the demand subject classification keywords are keywords classified into the words representing each demand content in the business demand information, wherein, the business demand information can be classified according to different demand subjects to obtain different demand subject classifications, including But not limited to system file classification, behavior classification, etc., so that each classification is represented by key words. Similarly, the operation information can be classified according to the operation theme to obtain different operation theme categories, including but not limited to ip category, id category, etc., which are not specifically limited in this embodiment of the present invention. Since the demand operation theme mapping relationship is used to represent the theme classification relationship between different demand theme classification keywords and different operation theme categories, the matching operation can be found from the demand operation theme mapping relationship according to the demand theme classification keywords Subject categories.

It should be noted that since a category can be represented by multiple keywords, correspondingly, a requirement theme category can correspond to multiple requirement theme category keywords, and an operation theme category can correspond to multiple operation theme category keywords. The operation theme mapping relationship not only includes the corresponding relationship between demand theme classification keywords and demand theme classification, operation theme classification keywords and operation theme classification, but also includes demand theme classification and operation theme classification, demand theme classification keywords and operation The corresponding relationship between topic classification, operation topic classification keywords and demand topic classification. Therefore, after determining the demand topic classification keywords, you can find the corresponding operation topic classification based on the demand operation topic mapping relationship, and then demand topic classification keywords It can correspond to multiple operation theme classification keywords under one operation theme classification.

103. If the first similarity between the operation information and the operation topic classification keywords of the operation topic classification is greater than a first similarity threshold, determine that the alarm information generated based on the operation information is a false alarm event, and delete the Warning message.

In the embodiment of the present invention, after determining the operation theme category that matches the keyword of the demand theme category, since one operation theme category contains at least one operation theme category keyword, by calculating the difference between the operation information and the operation theme category keyword The first similarity between the two is compared with the first similarity threshold to determine whether it is a false positive event. Wherein, since the operation information exists in the form of an operation log, when calculating the first similarity with the keywords of the operation topic classification, the operation information can be word-segmented, so as to complete the similarity calculation. If the calculated first similarity with multiple operation topic classification keywords is greater than the first similarity threshold, it means that the operation information is similar to the operation topic classification keywords, and the abnormal alarm information generated for this operation information is a false positive. , therefore, the alarm information generated by the operation information is determined as a false positive event, and the alarm information is deleted.

In the embodiment of the present invention, for further illustration and limitation, before the acquisition of the business demand information and the operation information of the operation object to be alerted, the method further includes: performing subject classification keywords on the historical business demand information and historical operation information respectively Analyze, and build a demand operation theme mapping relationship based on the parsed demand theme classification keywords and operation theme classification keywords.

In order to realize the judgment of false positives, combined with historical business requirements and historical operation information, subject classification keyword analysis is carried out, that is, topic classification is determined according to historical business requirements and historical operation information, including demand topic classification and operation topic classification, so as to obtain each topic The subject classification keywords corresponding to the classification, and construct the demand operation subject mapping relationship. Among them, the requirement theme classification is used to represent the theme classification of different requirements in the business demand information, and the operation theme classification is used to represent the theme classification of different operations summarized in the operation information. Furthermore, each theme classification can be determined by keywords, so that based on Requirement theme classification keywords, demand theme classification, operation theme classification keywords, and operation theme classification establish a demand operation theme mapping relationship.

In the embodiment of the present invention, for further illustration and limitation, as shown in Figure 2, the historical business demand information and historical operation information are respectively analyzed by subject classification keywords, and based on the analyzed demand subject classification keywords and operation The topic classification keywords constructing demand operation topic mapping relationship includes: 201. Segmenting historical business demand information and historical operation information respectively to obtain a demand segmentation sequence and an operation segmentation sequence; 202. Segmenting the demand segmentation sequence, Subject classification and subject classification keyword extraction are performed on the operation word segmentation sequence to obtain demand subject classification keywords and operation theme classification keywords; 203. Based on the demand operation matching database, establish the demand subject classification and the demand subject classification keywords The mapping relationship between the required operation theme and the operation theme category and the operation theme category keyword.

Specifically, word segmentation is performed according to the extracted historical business requirement information and historical operation information, and the sequence of requirement word segmentation and the sequence of operation word segmentation are respectively obtained. Since the information in the business requirement document is text content, and the information in the operation document is various strings, Therefore, the business requirement information in the business requirement document is segmented according to the text, and the operation information in the operation document is segmented according to the space delimiter, so as to obtain list1 and the operation segment sequence list2 in step 201 as the sequence of segmented segments of the requirement, the present invention Examples are not specifically limited. In addition, in step 202, in order to accurately determine the topic classification and the keywords of different topic classifications, the subject classification is performed on the demand word segmentation sequence and the operation word segmentation sequence based on the topic classification model, and the keywords of different subject classifications are extracted. The categories include demand theme categories and operation theme categories, and the number of theme categories of the demand theme category keywords is the same as that of the operation theme category keywords. Among them, the topic classification model is an unsupervised Bayesian model LDA (Latent Dirichlet Allocation). Through the completed training of the LDA model, the demand segmentation sequence and the operation segmentation sequence are divided into topics, and each topic classification is obtained, and each topic classification corresponds to keywords, based on topic classification including requirement topic classification and operation topic classification, respectively obtain demand topic classification keyword topword1 and operation topic classification keyword topword2, which are not specifically limited in this embodiment of the present invention.

It should be noted that, in the embodiment of the present invention, since the demand operation matching database stores different demand subject classifications received and updated according to preset time intervals, keywords of different demand subject classifications are respectively associated with different operation subject categories and different operation subject categories The combination relationship between keywords, therefore, after determining the keywords of demand topic classification, operation topic classification keywords, demand topic classification, and operation topic classification, based on the demand operation matching database, different demand topic classifications and different demand topic classification keywords Establish demand operation theme mapping relationships with different operation theme categories and combination relationships between different operation theme category keywords. Among them, the combination relationship stored in the demand operation matching library is the combination relationship entered or updated by technicians according to the preset time interval, and the combination relationship covered in the demand operation matching library is far larger than that in the historical business demand information and historical operation information. The scope of the demand operation topic mapping relationship is established between the extracted topic classification and topic classification keywords. Therefore, when the business requirement information changes, the demand operation topic mapping relationship can be reconstructed based on the original demand operation matching, without To update the requirement operation matching database, the requirement operation matching database is only updated after the technician enters a new combination relationship, which is not specifically limited in the embodiment of the present invention.

In the embodiment of the present invention, for further illustration and limitation, the determination of the operation subject classification corresponding to the demand subject classification keywords of the business demand information based on the demand operation theme mapping relationship includes: calculating the demand word segmentation of the business demand information The second similarity between each demand theme classification keyword in the mapping relationship between the sequence and the demand operation theme; select the demand theme classification matched by the demand theme classification keyword corresponding to the largest second similarity in the second similarity ; Searching for an operation theme category corresponding to the requirement theme category based on the requirement operation theme mapping relationship.

In order to improve the recognition accuracy of abnormal false positives, first calculate the similarity between the demand word segmentation sequence of business demand information and the demand subject classification keywords in the demand operation theme mapping relationship, that is, the second similarity, because it is related to multiple requirements Therefore, the obtained second similarity is multiple similarity values, so as to determine the demand theme classification keyword corresponding to the largest similarity value, and select the demand theme classification key here Matching requirements topic taxonomy. Since the demand operation theme mapping relationship includes the relationship between different demand theme classifications and different operation theme classifications, after determining the demand theme classification based on the maximum similarity value, find the corresponding demand theme classification from the demand operation theme mapping relationship The operation theme classification is used to calculate the similarity between each operation theme classification keyword in the operation theme classification and the operation information, so as to determine whether it is a false alarm event.

It should be noted that the calculation of the similarity in the embodiment of the present invention is calculated by numerical data. Therefore, before calculating the similarity between the required word segmentation sequence and the required subject classification keywords, the words need to be converted into word vectors, such as through word2vec The model converts word vectors to calculate the similarity based on numerical values, which is not specifically limited in this embodiment of the present invention.

In the embodiment of the present invention, for further illustration and limitation, as shown in FIG. 3 , before determining the operation theme classification corresponding to the demand theme classification keywords of the business demand information based on the demand operation theme mapping relationship, the method It also includes: 301. Using a text segmentation algorithm to perform text segmentation on the business requirement information, and performing text segmentation on the operation information based on a preset delimiter to obtain a demand segmentation sequence and an operation segmentation sequence respectively; 302. Combining with the topic classification model And the information measurement index performs theme division on the demand word segmentation sequence and the operation word segmentation sequence to obtain demand theme classification keywords matching the demand theme classification and operation theme classification keywords matching the operation theme classification.

In order to efficiently match based on the demand operation topic mapping relationship, specifically, since the business requirement information in the business requirement document is text content, that is, the text segmentation algorithm is used to perform text segmentation on the business requirement information, and the text segmentation algorithm can be a natural language processing technology The jieba (C++) tool in , so as to obtain the required word segmentation sequence. Moreover, since the operation information in the operation document is in the form of a character string, that is, the text segmentation of the operation information is performed through a preset delimiter, so as to obtain an operation segmentation sequence. In addition, after the text segmentation, it is necessary to classify the subject of the required word segmentation sequence and the operation word segmentation sequence. Therefore, on the basis of the topic classification model for topic classification, combined with information measurement indicators, the optimal number of topic categories is selected to obtain N demand topic categories, M operation topic categories, and corresponding topic category keywords for each topic category, such as demand topic category keyword topword1 and operation topic category keyword topword2. Among them, the information measurement index is the measurement index determined by the perplexity method, which is used to measure the quality of a probability distribution or probability model prediction sample, that is, the classification quality of the topic classification model in the embodiment of the present invention, based on a setting It is determined by the index, which is not specifically limited in this embodiment of the present invention.

In the embodiment of the present invention, for further illustration and limitation, before acquiring the business requirement information and the operation information of the operation object to be alerted, the method further includes: If the number of keyword differences exceeds the preset difference threshold, the mapping relationship of the demand operation topic is updated based on the business demand information.

In order to better identify abnormal false positives, thereby improving the accuracy of false negative identification, count the number of differences between business demand information and historical business demand information, and the number of demand topic classification keywords in the business demand information will be the demand topic classification key in business demand information Words are compared one by one with the demand topic classification keywords in the historical business demand information. If the number of differences exceeds the preset difference threshold, it means that the current business demand information is quite different from the historical business information. The demand operation topic constructed according to the historical business information The mapping relationship is no longer suitable for the identification of abnormal false positives corresponding to the current business requirement information. Therefore, based on the business requirement information, the mapping relationship of the requirement operation topic is updated. Specifically, it prompts the demand topic classification and demand topic classification keywords in the business demand information, and combines the combination relationship in the demand operation matching database to construct the demand operation between the operation topic classification and the operation main classification keywords of the historical operation information The subject mapping relationship is not specifically limited in this embodiment of the present invention.

In the embodiment of the present invention, for further description and limitation, it is characterized in that the determining that the alarm information generated based on the operation information is a false alarm event, and after deleting the alarm information, the method further includes: statistically determining that the alarm information is a false alarm event The identity information of the operation object to be alerted, the time of false alarm, the number of false alarms, and the business requirement information corresponding to the false alarm event, generate and output abnormal false alarm alarm information.

In order to improve the effectiveness of false alarm processing, after determining that the alarm information generated based on the operation information is a false positive event, the identity information, false positive time, false positive times, and the relationship between the false positive event and the false positive operation object to be alarmed are counted. Events correspond to business requirement information, and generate and output abnormal false alarm warning information. Among them, since the operation object to be alerted is the operation subject that has been determined to be abnormal, the identity information is the identity information identified based on the operator id, ip address, device number and other information, such as name, etc., and the false alarm time is the generated The time of the alarm information, this time is determined by the time timer for identifying network security in the current execution terminal, and the number of false alarms is counted according to the preset time interval, such as one week, three days, etc. , which is not specifically limited in this embodiment of the present invention. Moreover, in order to realize the display effect of abnormal and false alarms, the abnormal and false alarm information is generated and output in combination with the business demand information corresponding to the false positive events. Among them, the abnormal false alarm warning information is used to represent the status of false positives, so that technicians can judge the complete detection rules of the network, so as to optimize the detection efficiency of network security.

The embodiment of the present invention provides a method for processing abnormal false alarms. Compared with the prior art, the embodiment of the present invention acquires business demand information and operation information of operation objects to be alerted; The operation topic classification corresponding to the demand topic classification keyword of the business demand information, and the demand operation topic mapping relationship is used to represent the topic classification relationship between different demand topic classification keywords and different operation topic classifications; if the operation information is related to the If the first similarity between the operation theme classification keywords of the operation theme classification is greater than the first similarity threshold, it is determined that the alarm information generated based on the operation information is a false alarm event, and the alarm information is deleted, which greatly reduces labor costs. The misjudgment and misjudgment of abnormalities caused by human judgment are avoided, and the recognition accuracy of false positives of abnormalities is greatly increased, thereby improving the processing efficiency of false positives of abnormalities.

Further, as an implementation of the method shown in FIG. 1 above, an embodiment of the present invention provides a device for processing abnormal false alarms. As shown in FIG. 4 , the device includes:

An acquisition module 41, configured to acquire business requirement information and operation information of operation objects to be alerted;

The determination module 42 is configured to determine the operation theme classification corresponding to the demand theme classification keywords of the business demand information based on the demand operation theme mapping relationship, and the demand operation theme mapping relationship is used to represent different demand theme classification keywords and different operations Subject taxonomy relationships between subject categories;

A deletion module 43, configured to determine that generating alarm information based on the operation information is a false alarm event if the first similarity between the operation information and the operation topic classification keywords of the operation topic classification is greater than a first similarity threshold , to delete the alarm information.

Further, the device also includes:

Further, the building blocks include:

The extraction unit is used to perform theme classification and theme classification keyword extraction on the demand word segmentation sequence and the operation word segmentation sequence according to the theme classification model, to obtain demand theme classification keywords and operation theme classification keywords, and the theme classification includes demand Subject classification, operation theme classification, the number of theme classifications of the demand theme classification keywords and the operation theme classification keywords is the same;

Further, the determination module includes:

Further, the device also includes:

The embodiment of the present invention provides a device for processing abnormal and false alarms. Compared with the prior art, the embodiment of the present invention obtains business demand information and operation information of operation objects to be alerted; The operation topic classification corresponding to the demand topic classification keyword of the business demand information, and the demand operation topic mapping relationship is used to represent the topic classification relationship between different demand topic classification keywords and different operation topic classifications; if the operation information is related to the If the first similarity between the operation theme classification keywords of the operation theme classification is greater than the first similarity threshold, it is determined that the alarm information generated based on the operation information is a false alarm event, and the alarm information is deleted, which greatly reduces labor costs. The misjudgment and misjudgment of abnormalities caused by human judgment are avoided, and the recognition accuracy of false positives of abnormalities is greatly increased, thereby improving the processing efficiency of false positives of abnormalities.

According to one embodiment of the present invention, a storage medium is provided, and the storage medium stores at least one executable instruction, and the computer-executable instruction can execute the method for processing abnormal false alarms in any of the above method embodiments.

FIG. 5 shows a schematic structural diagram of a terminal provided according to an embodiment of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the terminal.

As shown in FIG. 5 , the terminal may include: a processor (processor) 502, a communication interface (Communications Interface) 504, a memory (memory) 506, and a communication bus 508.

Wherein: the processor 502 , the communication interface 504 , and the memory 506 communicate with each other through the communication bus 508 .

The communication interface 504 is configured to communicate with network elements of other devices such as clients or other servers.

The processor 502 is configured to execute the program 510, and may specifically execute the relevant steps in the above embodiment of the method for processing an abnormality false alarm.

Specifically, the program 510 may include program codes including computer operation instructions.

The processor 502 may be a central processing unit CPU, or an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the terminal may be of the same type, such as one or more CPUs, or may be different types of processors, such as one or more CPUs and one or more ASICs.

The memory 506 is used for storing the program 510 . The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

The program 510 can specifically be used to make the processor 502 perform the following operations:

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

A method for processing abnormal false positives, characterized in that it includes:

Obtain business requirement information and operation information of operation objects to be alerted;

Determine the operation theme classification corresponding to the demand theme classification keyword of the business demand information based on the demand operation theme mapping relationship, the demand operation theme mapping relationship is used to represent the theme between different demand theme classification keywords and different operation theme categories Classification relationship, the topic classification relationship is based on the combination relationship between different demand topic classifications, different demand topic classification keywords, different operation topic classifications, and different operation topic classification keywords respectively. matching determined;

If the first similarity between the operation information and the operation theme classification keywords of the operation theme classification is greater than a first similarity threshold, then determine that the alarm information generated based on the operation information is a false alarm event, and delete the alarm information .
The method according to claim 1, characterized in that, before acquiring the business requirement information and the operation information of the operation object to be alerted, the method further comprises:

The subject classification keywords of historical business demand information and historical operation information are analyzed respectively, and the demand operation subject mapping relationship is constructed based on the parsed demand subject classification keywords and operation subject classification keywords.
The method according to claim 2, characterized in that the historical business demand information and the historical operation information are respectively analyzed for subject classification keywords, and requirements are constructed based on the parsed demand subject classification keywords and operation topic classification keywords Operational topic mappings include:

Segment the historical business demand information and historical operation information respectively to obtain the sequence of word segmentation for demand and the sequence of word segmentation for operation;

According to the subject classification model, subject classification and subject classification keyword extraction are performed on the demand word segmentation sequence and the operation word segmentation sequence to obtain demand subject classification keywords and operation theme classification keywords, and the subject classification includes demand subject classification, operation theme Classification, the number of subject classifications of the demand theme classification keywords is the same as that of the operation theme classification keywords;

Based on the demand operation matching database, establish the demand operation theme mapping relationship between the demand theme classification, the demand theme classification keywords, the operation theme classification, and the operation theme classification keywords, in the demand operation matching database Combination relations between different demand theme classifications and keywords of different demand theme classifications received and updated according to preset time intervals and different operation theme categories and keywords of different operation theme classifications are stored.
The method according to claim 3, wherein the determination of the operation theme classification corresponding to the demand theme classification keyword of the business demand information based on the demand operation theme mapping relationship comprises:

Calculating the second similarity between the requirement word segmentation sequence of the business requirement information and each requirement topic classification keyword in the requirement operation topic mapping relationship;

Selecting the demand topic classification matched by the demand topic classification keyword corresponding to the maximum second similarity in the second similarity;

Searching for an operation subject category corresponding to the requirement subject category based on the requirement operation subject mapping relationship.
The method according to claim 3, characterized in that, before determining the operation theme classification corresponding to the demand theme classification keywords of the business demand information based on the demand operation theme mapping relationship, the method further comprises:

performing text segmentation on the business requirement information by using a text segmentation algorithm, and performing text segmentation on the operation information based on a preset delimiter, to obtain a requirement segmentation sequence and an operation segmentation sequence respectively;

Combining the subject classification model and the information measurement index, subject the demand segment sequence and the operation segment sequence to obtain demand subject classification keywords matching the demand subject classification and operation subject classification keywords matching the operation subject classification.
The method according to claim 1, characterized in that, before acquiring the business requirement information and the operation information of the operation object to be alerted, the method further comprises:

If the number of differences between the business requirement information and the requirement subject classification keywords in the historical service requirement information exceeds a preset difference threshold, the requirement operation subject mapping relationship is updated based on the business requirement information.
The method according to any one of claims 1-6, wherein the determining that generating alarm information based on the operation information is a false positive event, and after deleting the alarm information, the method further includes:

Count the identity information, false positive time, false positive times, and business requirement information corresponding to the false positive event of the operation object to be alarmed as the false positive event, and generate and output abnormal false positive warning information.
A device for processing abnormal false positives, characterized in that it includes:

An acquisition module, configured to acquire business requirement information and operation information of operation objects to be alerted;

A determining module, configured to determine an operation topic classification corresponding to a demand topic classification keyword of the business requirement information based on a demand operation topic mapping relationship, where the demand operation topic mapping relationship is used to represent different demand topic classification keywords and different operation topics The theme classification relationship between categories, the theme classification relationship is based on the combined relationship between different demand theme classifications, different demand theme classification keywords and different operation theme classifications, different operation theme classification keywords. Determined by matching with the classification of the subject of the operation;

A deletion module, configured to determine that generating alarm information based on the operation information is a false alarm event if the first similarity between the operation information and the operation topic classification keywords of the operation topic classification is greater than a first similarity threshold, Delete the warning information.
A storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction causes a processor to perform operations corresponding to the method for processing abnormal false alarms according to any one of claims 1-7.
A terminal, including: a processor, a memory, a communication interface, and a communication bus, and the processor, the memory, and the communication interface complete mutual communication through the communication bus;

The memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the method for handling abnormal false alarms according to any one of claims 1-7.