CN114301758A - Alarm processing method, system, device and storage medium - Google Patents

Abstract

The invention provides an alarm processing method, a system, equipment and a storage medium, wherein the method comprises the following steps: the method comprises the steps of grouping original alarms according to IP pairs consisting of source IP addresses and destination IP addresses of network access events, wherein the IP pairs of each group are one-to-one, one-to-many or many-to-one, calculating information entropy for the original alarms in each group, and aggregating the original alarms with similarity degrees larger than a target value into super alarms according to the similarity degrees between the information entropy, wherein the information entropy comprises one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy. According to the invention, on the basis of grouping the IP pairs formed by the source IP address and the destination IP address, grouping is carried out according to the information entropy of the original alarm, and the original alarms with similar information entropy are grouped into the super alarm, so that the number of the original alarms is obviously reduced, and the user experience is improved.

Description

Alarm processing method, system, device and storage medium

technical field

The present invention relates to the field of network security, and in particular, to an alarm processing method, system, device and storage medium.

Background technique

In the telecommunication network, network attack refers to the attack on the hardware, software and the data in the network system by exploiting the loopholes and security flaws in the network. Therefore, a large number of network security protection devices are deployed in the network to deal with network attacks, and a large number of redundant alarm logs are generated.

In the telecommunication network, the management service operation and maintenance generates massive alarm data every day. The traditional alarm processing method relies on manpower, and the monitoring workload is large and the labor load is high.

It should be noted that the information disclosed in the above Background section is only for enhancing understanding of the background of the invention, and therefore may include information that does not form the prior art known to a person of ordinary skill in the art.

SUMMARY OF THE INVENTION

In view of the problems in the prior art, the purpose of the present invention is to provide an alarm processing method, system, equipment and storage medium, which overcomes the difficulties of the prior art, and can perform grouping according to the IP pair formed by the source IP address and the destination IP address. On the basis, the groups are aggregated according to the information entropy of the original alarms, and the original alarms with similar information entropy are aggregated into super-alarms, which significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel, and the aggregated super-alarms Aggregate alarms more finely and provide processing priority, which provides a predictable solution for subsequent operation and maintenance personnel to accurately respond to alarm logs. The embodiments of the present invention can improve user experience.

An embodiment of the present invention provides an alarm processing method, including the following steps:

Get raw alerts generated for network access events;

Group the original alarms according to the IP pairs composed of the source IP address and the destination IP address of the network access event to which they belong, wherein the IP pairs of each group are one-to-one, one-to-many or many-to-one;

Calculate the information entropy of the original alarms in each group, and aggregate the original alarms with a similarity greater than the target value into super alarms according to the similarity between the information entropies. The information entropy includes content entropy, source IP address entropy, destination IP entropy, One or more of time entropy and port entropy.

Optionally, the alarm processing method further includes:

Calculate the multivariate information entropy for the super alarm in each group, and configure the processing priority for the super alarm according to the multivariate information entropy.

Optionally, before calculating the information entropy for the original alarm in each group, the alarm processing method further includes:

The original alarms of each group are aggregated into multiple time clusters according to the alarm time information;

Calculate the information entropy for the original alarms in each group, and aggregate the original alarms whose similarity is greater than the target value into super-alarms according to the similarity between the information entropies, including:

The information entropy is calculated for each time cluster in each group, and the time clusters whose information entropy similarity is greater than the threshold are aggregated into super-alarms according to the information entropy similarity between the time clusters.

Optionally, information entropy is calculated for each time cluster in each group, including:

The IP pairs are one-to-one single-source single-destination attribute grouping, and content entropy, time entropy and port entropy are calculated for each time cluster.

Optionally, information entropy is calculated for each time cluster in each group, including:

The IP pairs are one-to-many single-source multi-destination attribute groups, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster.

Optionally, information entropy is calculated for each time cluster in each group, including:

The IP pairs are many-to-one multi-source single-destination attribute groups, and source IP entropy, time entropy and port entropy are calculated for each time cluster.

Optionally, the information entropy is calculated for each time cluster in each group, and according to the information entropy similarity between the time clusters, the time clusters with the information entropy similarity greater than the threshold are aggregated into super-alarms, including:

For each grouping, the mean square error between the information entropy of each time cluster is calculated, the information entropy similarity is obtained based on the mean square error, and the time clusters whose mean square error is not greater than the set threshold are aggregated into super-alarms.

Optionally, calculate the mean square error between the information entropy of each time cluster, including:

For each group, calculate the mean square error between the information entropy of each time cluster whose time difference is not greater than the time threshold.

An embodiment of the present invention further provides an alarm processing system for implementing the above-mentioned alarm processing method, and the alarm processing system includes:

The original alarm acquisition module obtains the original alarm generated by the network access event;

The grouping module groups the original alarm according to the IP pair composed of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

The super-alarm aggregation module calculates the information entropy for the original alarms in each group, and aggregates the original alarms whose similarity is greater than the target value into super-alarms according to the similarity between the information entropies. The information entropy includes content entropy and source IP address entropy. , one or more of destination IP entropy, time entropy and port entropy.

An embodiment of the present invention also provides an alarm processing device, including:

processor;

a memory in which executable instructions for the processor are stored;

Wherein, the processor is configured to execute the steps of the above-mentioned alarm processing method by executing the executable instructions.

Embodiments of the present invention further provide a computer-readable storage medium for storing a program, which implements the steps of the above-mentioned alarm processing method when the program is executed.

The purpose of the present invention is to provide an alarm processing method, system, equipment and storage medium, by grouping the original alarm according to the IP pair composed of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is a One-to-one, one-to-many, or many-to-one, calculate the information entropy for the original alarms in each group, and aggregate the original alarms whose similarity is greater than the target value into super-alarms according to the similarity between the information entropies. The information entropy includes the content One or more of entropy, source IP address entropy, destination IP entropy, time entropy, and port entropy.

In this embodiment of the present invention, on the basis of grouping the IP pairs formed by the source IP address and the destination IP address, the grouping is aggregated according to the information entropy of the original alarm, and the original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of alarms. The number of original alarms reduces the workload of operation and maintenance personnel, and the aggregated super-alarms aggregate the alarms more finely and provide processing priority, which provides a predictable solution for the accurate response of the operation and maintenance personnel to the alarm log. The embodiments of the present invention can improve user experience.

Description of drawings

Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings.

FIG. 1 is a flowchart of one of the embodiments of an alarm processing method provided by the present invention;

2 is a flowchart of Embodiment 2 of an alarm processing method provided by the present invention;

3 is a flowchart of Embodiment 3 of the alarm processing method provided by the present invention;

4 is a system analysis architecture diagram of the alarm processing method provided by the present invention;

5 is a schematic block diagram of one of the embodiments of the alarm processing system of the present invention;

FIG. 6 is a schematic block diagram of the second embodiment of the alarm processing system of the present invention;

7 is a schematic block diagram of Embodiment 3 of the alarm processing system of the present invention;

FIG. 8 is a schematic diagram of the operation of the alarm processing system of the present invention.

Detailed ways

Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art.

The drawings are merely schematic illustrations of the invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repeated descriptions will be omitted. Some of the block diagrams shown in the figures are functional entities that do not necessarily necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, or in one or more hardware forwarding modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices .

In addition, the flow shown in the drawings is only an exemplary illustration, and does not necessarily include all steps. For example, some steps can be decomposed, and some steps can be combined or partially combined, and the actual execution order may be changed according to the actual situation. "First", "second" and similar words used in the detailed description do not denote any order, quantity or importance, but are only used to distinguish different components. It should be noted that the embodiments of the present invention and features in different embodiments may be combined with each other under the condition of no conflict.

FIG. 1 is a flowchart of an embodiment of an alarm processing method of the present invention. As shown in FIG. 1, an embodiment of the present invention provides an alarm processing method, including the following steps:

Step 110: Obtain the original alarm generated for the network access event;

Step 120: Group the original alarm according to the IP pair composed of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

Step 130: Calculate the information entropy for the original alarms in each group, and aggregate the original alarms whose similarity is greater than the target value into super-alarms according to the similarity between the information entropies. The information entropy includes content entropy, source IP address entropy, destination One or more of IP entropy, time entropy, and port entropy.

In this embodiment of the present invention, on the basis of grouping the IP pairs formed by the source IP address and the destination IP address, the grouping is aggregated according to the information entropy of the original alarm, and the original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of alarms. The number of original alarms reduces the workload of operation and maintenance personnel, and the aggregated super-alarms aggregate the alarms more finely and provide processing priority, which provides a predictable solution for the accurate response of the operation and maintenance personnel to the alarm log. The embodiments of the present invention can improve user experience.

In this embodiment of the present invention, original alarms collected within a certain time interval may be acquired from a database. The original alarm is generated when the network security device performs security detection on the network access event, and the embodiment of the present invention does not limit the type of the original alarm.

In the embodiment of the present invention, when the original alarm is aggregated and grouped according to the IP pair of the network access event to which it belongs, one or more groups can be obtained. For example, it is roughly divided into three groups, namely single-source single-destination grouping based on one-to-one IP pair, single-source multi-purpose grouping based on one-to-many IP pair, and multi-source single-destination grouping based on many-to-one IP pair. .

In a single-source single-destination grouping, one source IP address points to one destination IP address in the network access event to which each original alarm belongs.

In a single-source multi-destination grouping, in the network access event to which each original alarm belongs, one source IP address points to multiple destination IP addresses.

In a multi-source single-destination grouping, in the network access event to which each original alarm belongs, multiple source IP addresses point to the same destination IP address.

The original alarm is aggregated into groups based on IP, which is the first aggregation group.

FIG. 2 is a flowchart of an alarm processing method provided by an optional embodiment of the present invention. Referring to FIG. 2, the method specifically includes the following steps:

Step 210: Obtain the original alarm generated for the network access event;

Step 220: Group the original alarm according to the IP pair composed of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

Step 230: Calculate the information entropy for the original alarms in each group, and aggregate the original alarms whose similarity is greater than the target value into super-alarms according to the similarity between the information entropies. The information entropy includes content entropy, source IP address entropy, destination One or more of IP entropy, time entropy, and port entropy

Step 240: Calculate the multivariate information entropy for the super-alarms in each group, and calculate the multivariate information entropy according to the multivariate information entropy.

In this embodiment, multivariate information entropy is calculated for the super-alarms in each group to obtain a joint probability distribution of various information entropies, and the priority of each group of super-alarms is sorted by using the joint probability distribution. The embodiment of the present invention can determine the processing priority according to the multivariate information entropy of the super-alarm, realizes the preferential treatment of high-risk super-alarms, and improves the alarm processing efficiency.

In an optional embodiment, referring to FIG. 3 , FIG. 3 is a flowchart of an alarm processing method according to another embodiment of the present invention. The method specifically includes the following steps:

Step 310: Obtain the original alarm generated for the network access event;

Step 320: Group the original alarm according to the IP pair composed of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

Step 330: Aggregate the original alarms of each group into multiple time clusters according to the alarm time information;

Step 340: Calculate the information entropy for each time cluster in each group, and aggregate the time clusters whose information entropy similarity is greater than the threshold into a super-alarm according to the information entropy similarity between the time clusters. The information entropy includes content entropy, source One or more of IP address entropy, destination IP entropy, time entropy and port entropy;

Step 350: Calculate the multivariate information entropy for the super alarm in each group, and configure the processing priority for the super alarm according to the multivariate information entropy.

In this embodiment, each group is aggregated for the first time to obtain time clusters, and each time cluster is aggregated for the second time according to the similarity of the information entropy. The two aggregations further improve the aggregation degree and accuracy of the original alarm. This reduces the difficulty of handling alarms by subsequent operation and maintenance personnel.

Here, in information theory, entropy is the average amount of information contained in each message, also known as information entropy, source entropy, and average self-information. Here, "messages" represent events, samples, or features from a distribution or data stream, and entropy is understood as a measure of uncertainty rather than determinism, since the more random the source, the greater the entropy.

Classify information entropy, including content entropy, source IP address entropy, destination IP entropy, time entropy, and port entropy.

The content entropy represents the change intensity of the attack method in the time cluster, the time entropy represents the change intensity of the adjacent attack time interval in the time cluster, the port entropy represents the change intensity of the destination port in the time cluster, and the source IP/destination IP entropy represents the change intensity in the time cluster. Change strength of source IP/destination IP.

In an optional embodiment, the information entropy is calculated for each time cluster in each group, including:

The IP pairs are one-to-one single-source single-destination attribute grouping, and content entropy, time entropy and port entropy are calculated for each time cluster.

In the single-source single-destination attribute grouping, the source IP address and the destination IP address have a small change intensity, while the content entropy, time entropy and port entropy are more discriminative.

In an optional embodiment, the information entropy is calculated for each time cluster in each group, including:

The IP pairs are one-to-many single-source multi-destination attribute groups, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster.

In the single-source multi-destination attribute grouping, the destination IP address is changeable, so choose to calculate the destination IP entropy, time entropy and port entropy.

In an optional embodiment, the information entropy is calculated for each time cluster in each group, including:

The IP pairs are many-to-one multi-source single-destination attribute groups, and source IP entropy, time entropy and port entropy are calculated for each time cluster.

In the multi-source single-destination attribute grouping, the source IP address is changeable, so choose to calculate the source IP entropy, time entropy and port entropy.

In an optional embodiment, the information entropy is calculated for each time cluster in each group, and according to the information entropy similarity between the time clusters, the time clusters whose information entropy similarity is greater than a threshold are aggregated into super-alarms, including:

For each grouping, the mean square error between the information entropy of each time cluster is calculated, the information entropy similarity is obtained based on the mean square error, and the time clusters whose mean square error is not greater than the set threshold are aggregated into super-alarms.

In this embodiment, the mean square error is used to represent the information entropy similarity, and time clusters with high information entropy similarity are considered to have similar characteristics, and can be aggregated into super-alarms for unified processing.

In an optional embodiment, calculating the mean square error between the information entropy of each time cluster includes:

For each group, calculate the mean square error between the information entropy of each time cluster whose time difference is not greater than the time threshold.

4 is a schematic diagram of the principle structure of an alarm processing method according to a specific embodiment of the present invention. The method summarizes three attribute groups of the original alarm by comprehensively analyzing the alarm type, source IP address, destination IP address, and time interval. Two-level aggregation and priority processing are performed for the three attribute groups respectively.

Among them, attribute group 1 is an attack from a single source IP address to a single destination IP address;

Attribute group 2 is an attack from multiple source IP addresses to single destination IP addresses;

Attribute group 3 is an attack from a single source IP address to multiple destination IP addresses.

Perform first-level aggregation, and aggregate the consecutive attacks of these three attribute groups within the aggregation window (such as 4 hours or other time intervals) into time clusters, and the time interval between adjacent time clusters is greater than the density window (such as 10 minutes) .

Specifically, multiple attack methods within the aggregation window for attribute group 1 are aggregated into time clusters, and single attack methods for attribute group 2 and attribute group 3 within the aggregation window are aggregated into time clusters.

Next, the mean square error is calculated for the time clusters whose respective times are close to each other in the three attribute groups, and the time clusters with the mean square error smaller than the preset threshold are aggregated into a super-alarm (second-level aggregation).

Content entropy, time entropy and port entropy are respectively calculated for all IP pairs in attribute group 1 for multiple time clusters within the aggregation window, and time clusters A ¹ whose mean square error is lower than the threshold are aggregated to generate over-alarm B ¹ .

Among them, the content entropy calculation formula is:

The time entropy calculation formula is:

The formula for calculating port entropy is:

The formula for calculating the mean square error is:

Aggregate time clusters with MSE _k < δ as superalarm B ^k .

The time clusters A ¹ , A ² and A ³ respectively represent the data sets of the three attribute groups 1, 2 and 3 within the density window;

m _i , s _i , d _i , t _i , and p _i respectively represent the content, source IP address, destination IP address, time and port of different attack methods in the time cluster;

The super-alarms B ¹ , B ² , and B ³ respectively represent the super-alarm sets aggregated by the time clusters in the three attribute groups;

k refers to an attribute group. For attribute group 1, the above-mentioned mean square error formula MSE _k is used to calculate the mean square error. The mean square error reflects the degree of difference or similarity of information entropy between time clusters.

Source IP entropy, time entropy, and port entropy are calculated for all IP pairs in attribute group 2 for multiple time clusters within the aggregation window, and time clusters A ² with mean square error lower than the threshold are aggregated to generate over-alarm B ² .

The formula for calculating source IP entropy is:

Calculate destination IP entropy, time entropy, and port entropy for all IP pairs in attribute group 3 for multiple time clusters within the aggregation window, and aggregate time clusters A ³ whose mean square error is lower than the threshold to generate over-alarm B ³ .

The content entropy represents the change intensity of the attack method in the time cluster, the time entropy represents the change intensity of the adjacent attack time interval in the time cluster, the port entropy represents the change intensity of the destination port in the time cluster, and the source IP/destination IP entropy represents the source IP/destination IP entropy in the time cluster. Change strength of IP/destination IP.

In the three attribute groups, the multivariate information entropy of all super-alarms in each group is calculated respectively, and the values of the multivariate information entropy are sorted in the respective groups for the priority treatment of operation and maintenance personnel.

In an optional embodiment of the present invention, when the processing priority is set, the processing priority is attribute group 1 > attribute group 2 > attribute group 3, and the multivariate information entropy is calculated for the respective super-alarms in the three attribute groups, respectively. Prioritize within groups.

Among them, the formula for calculating multivariate information entropy is:

Among them, H _i represents (X _i,k ,Y _i,k ,Z _i,k ) discrete joint distribution counts, k=1, 2, 3.

In the embodiment of the present invention, information entropy is used for secondary aggregation, similar time clusters are aggregated into super-alarms, and multivariate information entropy is used for priority sorting.

FIG. 5 is a schematic block diagram of an embodiment of an alarm processing system of the present invention. The alarm processing system of the present invention, as shown in Figure 5, includes but is not limited to:

The original alarm obtaining module 510 obtains the original alarm generated for the network access event;

The grouping module 520 groups the original alarm according to the IP pair composed of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

The super-alarm aggregation module 530 calculates information entropy for the original alarms in each group, and aggregates the original alarms whose similarity is greater than the target value into super-alarms according to the similarity between the information entropies, where the information entropy includes content entropy, source IP address One or more of entropy, destination IP entropy, time entropy, and port entropy.

For the implementation principle of the above modules, please refer to the related introduction in the alarm processing method, which will not be repeated here.

The alarm processing system of the present invention, on the basis of grouping according to the IP pair formed by the source IP address and the destination IP address, aggregates the grouping according to the information entropy of the original alarm, and the original alarms with similar information entropy are aggregated into super alarms. Significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel, and the aggregated super-alarms aggregate the alarms more finely and provide processing priority, which provides predictability for the accurate response of the operation and maintenance personnel to the alarm log. Program. The embodiments of the present invention can improve user experience.

Optionally, compared with FIG. 5 , the alarm processing system shown in FIG. 6 may further include:

The priority configuration module 610 calculates the multivariate information entropy for the super alarm in each group, and configures the processing priority for the super alarm according to the multivariate information entropy.

Optionally, compared with FIG. 5 , the alarm processing system shown in FIG. 7 may further include:

The time cluster aggregation module 710, before calculating the information entropy for the original alarms in each group, aggregates the original alarms of each group into a plurality of time clusters according to the alarm time information;

The super-alarm aggregation module 720 is specifically used for:

The information entropy is calculated for each time cluster in each group, and the time clusters whose information entropy similarity is greater than the threshold are aggregated into super-alarms according to the information entropy similarity between the time clusters.

Optionally, the super-alarm aggregation module 720 is further configured to:

The IP pairs are one-to-one single-source single-destination attribute grouping, and content entropy, time entropy and port entropy are calculated for each time cluster.

Optionally, the super-alarm aggregation module 720 is further configured to:

The IP pairs are one-to-many single-source multi-destination attribute groups, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster.

Optionally, the super-alarm aggregation module 720 is further configured to:

The IP pairs are many-to-one multi-source single-destination attribute groups, and source IP entropy, time entropy and port entropy are calculated for each time cluster.

Optionally, the super-alarm aggregation module 720 is further configured to:

For each grouping, the mean square error between the information entropy of each time cluster is calculated, the information entropy similarity is obtained based on the mean square error, and the time clusters whose mean square error is not greater than the set threshold are aggregated into super-alarms.

Optionally, the super-alarm aggregation module 720 is further configured to:

For each group, calculate the mean square error between the information entropy of each time cluster whose time difference is not greater than the time threshold.

An embodiment of the present invention further provides an alarm processing device, including a processor. A memory in which executable instructions for the processor are stored. Wherein, the processor is configured to execute the steps of the alarm processing method by executing the executable instructions.

As will be appreciated by one skilled in the art, various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention can be embodied in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, which may be collectively referred to herein as implementations "Circuit", "Module" or "Platform".

FIG. 8 is a schematic structural diagram of an alarm processing device of the present invention. An electronic device 800 according to this embodiment of the present invention is described below with reference to FIG. 8 . The electronic device 800 shown in FIG. 8 is only an example, and should not impose any limitation on the function and scope of use of the embodiments of the present invention.

As shown in FIG. 8, electronic device 800 takes the form of a general-purpose computing device. Components of the electronic device 800 may include, but are not limited to, at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different platform components (including the storage unit 820 and the processing unit 810), a display unit 840, and the like.

The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 executes the steps according to various exemplary embodiments of the present invention described in the above-mentioned alarm processing method section of this specification. For example, the processing unit 810 may perform the steps shown in Figures 1-3.

The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 821 and/or a cache storage unit 822 , and may further include a read only storage unit (ROM) 823 .

The storage unit 820 may also include a program/utility 824 having a set (at least one) of program modules 825 including, but not limited to, a processing system, one or more application programs, other program modules, and program data, An implementation of a network environment may be included in each or some combination of these examples.

The bus 830 may be representative of one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any of a variety of bus structures bus.

The electronic device 800 may also communicate with one or more external devices 870 (eg, keyboards, pointing devices, Bluetooth devices, etc.), with one or more devices that enable a user to interact with the electronic device 800, and/or with Any device (eg, router, modem, etc.) that enables the electronic device 800 to communicate with one or more other computing devices. Such communication may take place through input/output (I/O) interface 850 .

Also, the electronic device 800 may communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network such as the Internet) through a network adapter 860 . Network adapter 860 may communicate with other modules of electronic device 800 through bus 830 . It should be understood that, although not shown, other hardware and/or software modules may be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage platform, etc.

Embodiments of the present invention further provide a computer-readable storage medium for storing a program, and the steps of an alarm processing method implemented when the program is executed. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes program code, when the program product runs on a terminal device, the program code is used to cause the terminal device to execute the above-mentioned description in this specification. The steps according to various exemplary embodiments of the present invention are described in the section on the alarm handling method.

A program product for implementing the above method according to an embodiment of the present invention may adopt a portable compact disc read only memory (CD-ROM) and include program codes, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

A computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave with readable program code embodied thereon. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable storage medium can also be any readable medium other than a readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. Program code embodied on a readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out the processes of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming Language - such as the "C" language or similar programming language. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server execute on. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (eg, using an Internet service provider business via an Internet connection).

To sum up, the purpose of the present invention is to provide an alarm processing method, system, device and storage medium, which can aggregate the packets according to the information entropy of the original alarm on the basis of grouping the IP pairs formed by the source IP address and the destination IP address. , the original alarms with similar information entropy are aggregated into super-alarms, which significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel, and the aggregated super-alarms aggregate the alarms more finely and provide processing priorities. Provides a predictable solution for the subsequent operation and maintenance personnel to accurately respond to the alarm log. The embodiments of the present invention can improve user experience.

The above content is a further detailed description of the present invention in combination with specific preferred embodiments, and it cannot be considered that the specific implementation of the present invention is limited to these descriptions. For those of ordinary skill in the technical field of the present invention, without departing from the concept of the present invention, some simple deductions or substitutions can be made, which should be regarded as belonging to the protection scope of the present invention.

Claims (11)

1. An alarm processing method, comprising:

acquiring an original alarm generated for a network access event;

grouping the original alarm according to an IP pair consisting of a source IP address and a destination IP address of the network access event, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

and calculating information entropy for the original alarms in each group, and aggregating the original alarms with the similarity larger than a target value into the super alarm according to the similarity between the information entropy, wherein the information entropy comprises one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

2. The alarm processing method according to claim 1, wherein the alarm processing method further comprises:

and calculating multivariate information entropy for the super alarm in each group, and configuring the processing priority for the super alarm according to the multivariate information entropy.

3. The alarm processing method of claim 1, wherein prior to computing the entropy for the original alarms in each packet, the alarm processing method further comprises:

aggregating the original alarms of each group into a plurality of time clusters according to the alarm time information;

the method for calculating the information entropy of the original alarms in each group and aggregating the original alarms with the similarity larger than the target value into the super alarm according to the similarity between the information entropies comprises the following steps:

and calculating the information entropy of each time cluster in each group, and aggregating the time clusters with the information entropy similarity larger than a threshold value into a super alarm according to the information entropy similarity between the time clusters.

4. The alarm processing method of claim 3, wherein the calculating an information entropy for each time cluster in each packet comprises:

and calculating the content entropy, the time entropy and the port entropy for each time cluster for the attribute groups of the single-source single-object with the IP pairs in a one-to-one mode.

5. The alarm processing method of claim 3, wherein the calculating an information entropy for each time cluster in each packet comprises:

and for the attribute grouping of the IP pair which is one-to-many single source and multiple destinations, calculating the destination IP entropy, the time entropy and the port entropy for each time cluster.

6. The alarm processing method of claim 3, wherein the calculating an information entropy for each time cluster in each packet comprises:

and for the attribute grouping of the multi-source single-purpose with the IP pairs being many-to-one, calculating the source IP entropy, the time entropy and the port entropy for each time cluster.

7. The alarm processing method according to claim 3, wherein the calculating information entropy for each time cluster in each group and aggregating the time clusters with information entropy similarity greater than a threshold value into the super alarm according to the information entropy similarity between the time clusters comprises:

and calculating the mean square error between the information entropies of the time clusters for each group, obtaining the information entropy similarity based on the mean square error, and aggregating the time clusters with the mean square error not greater than a set threshold value into a super alarm.

8. The alarm processing method according to claim 3, wherein the calculating a mean square error between information entropies of the time clusters comprises:

and calculating the mean square error between the information entropies of the time clusters with the time difference not larger than the time threshold value for each group.

9. An alarm processing system, comprising:

the original alarm acquisition module is used for acquiring an original alarm generated for the network access event;

the grouping module is used for grouping the original alarm according to an IP pair consisting of a source IP address and a destination IP address of the network access event, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

and the super alarm aggregation module is used for calculating information entropy of the original alarms in each group and aggregating the original alarms with the similarity larger than a target value into the super alarms according to the similarity between the information entropy, wherein the information entropy comprises one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

10. An alarm processing device, comprising:

a processor;

a memory having stored therein executable instructions of the processor;

wherein the processor is configured to perform the steps of the alert processing method of any of claims 1 to 8 via execution of the executable instructions.

11. A computer-readable storage medium storing a program, wherein the program when executed by a processor implements the steps of the alert processing method of any one of claims 1 to 8.

Images