Periodic Alarm Extraction Based on Time-Frequency Domain Feature Fusion

With the advent of big data and cloud computing, the security of cyber networks has become complicated. With the exponential increase in the number of alarms and the enhancement of attack methods, the situation of network security analysis is becoming more and more severe, and comprehensive network security situation analysis is important for network security protection. At present, industrial control networks face many challenges in cyber security defense, such as difficult analysis of massive information, difficult mining of alarm correlation, difficult detection of high-risk alarms, etc., which makes it difficult to meet the security requirements of the power system. Periodic study of alarm logs from the perspective of the time-frequency domain can extract periodic alarm logs from large quantities of alarm data, filter out most false alarms generated by machines, reduce the interference of massive false alarms on the security situation analysis process, and help staff to accurately locate the time or object where periodic traffic is located. This paper proposes a method for extracting periodic alarms based on the time-frequency domain characteristics of the alarms. Extensive experiments on anonymized real alarm data in different network environments show that the proposed method can aid network security analysts in comprehending the overall network security situation before making corresponding strategies, thus reducing the negative impact of network attacks.