Method and system for realizing automatic association of security events based on unsupervised learning

The invention discloses a method and a system for realizing automatic association of security events based on unsupervised learning, and belongs to the field of network security and deep learning. In the method, firstly, each security event is combined with a context thereof through a sequence extractor to form a context event sequence; the event prediction module then takes each context sequence as an input and predicts the current event, where an encoder, an attention decoder, and an event decoder are employed to integrate context information from the bidirectional sequence. According to the method, the relevance between the current event and the context event can be obtained, so that possible attacks can be found; the unsupervised characteristic allows the model to be quickly updated by using a new security event sequence, can adapt to a quickly changing attack mode, can automatically associate related events, does not need manual association by a security operator, and greatly reduces manual labor. 本发明公开了