Security event merging processing method and device, electronic equipment and storage medium

Abstract

The invention relates to a security event merging processing method and device, electronic equipment and a storage medium. The method comprises the steps: obtaining security event data which includesan attack IP, an attacked IP and an event type; constructing an attack relation graph by taking the attack IP and the attacked IP as nodes; determining all connected sub-graphs included in the attackrelation graph; determining priorities of the connected sub-graphs, wherein the more important the connected sub-graphs are, the higher the priorities of the connected sub-graphs are; and outputting the security event data corresponding to each connected sub-graph based on the priority of each connected sub-graph. The essence of the technical scheme of the embodiment of the invention is that the most concerned event is extracted from massive security events to be aggregated, and an aggregation event is subjected to enhanced analysis and priority arrangement on the basis so that security operators can carry out associated disposal on a plurality of events, and can preferentially dispose the events with greater threats at present.

Description

technical field [0001] The present disclosure relates to the technical field of network security, and in particular to a method, device, electronic equipment and storage medium for merging and processing security events. Background technique [0002] Security operations personnel are faced with a large number of attack event alarm information that needs to be processed every day. These alerts are often caused by the accumulation of false positives from excessive event detection, resulting in a high number of security incidents per day. However, in practice, due to the limited energy of security operators, many security incidents are not handled quickly. If these unaddressed security incidents include alarms on critical assets, this can cause a certain amount of damage. Contents of the invention [0003] In order to solve the above technical problems or at least partly solve the above technical problems, the present disclosure provides a method, device, electronic device ...

AI Technical Summary

Problems solved by technology

These alerts are often caused by the accumulation of false positives from excessive event detections, resulting in a higher number of security incidents per day

However, in reality, due to the limited energy of security operators, many security incidents are not handled quickly

If these unaddressed security incidents include alarms on critical assets, this will cause a certain degree of damage

Images