A method of processing security information, comprising: standardizing (S210) a security alarm information for a target device to obtain standardization data; determining (S220) a similarity between the standardization data and attack data in an attack behavior knowledge base; and updating (S230) a security information of the target device according to the similarity; wherein the determining a similarity between the standardization data and attack data in an attack behavior knowledge base comprises: determining (S321) at least one first keyword in the standardization data; and for each attack data in the attack behavior knowledge base, determining (S322) at least one second keyword in the attack data, and determining (S323) the similarity between the standardization data and the attack data according to the at least one first keyword and the at least one second keyword; wherein the determining the similarity between the standardization data and the attack data according to the at least one first keyword and the at least one second keyword comprises: combining the at least one first keyword with the at least one second keyword to obtain a keyword set; determining a word frequency of each keyword of the keyword set in the standardization data to obtain a first word frequency feature vector; determining a word frequency of each keyword of the keyword set in the attack data to obtain a second word frequency feature vector; and calculating a cosine similarity between the first word frequency feature vector and the second word frequency feature vector as the similarity between the standardization data and the attack data. standardizing (S210) a security alarm information for a target device to obtain standardization data; determining (S220) a similarity between the standardization data and attack data in an attack behavior knowledge base; and updating (S230) a security information of the target device according to the similarity; wherein the determining a similarity between the standardization data and attack data in an attack behavior knowledge base comprises: determining (S321) at least one first keyword in the standardization data; and for each attack data in the attack behavior knowledge base, determining (S322) at least one second keyword in the attack data, and determining (S323) the similarity between the standardization data and the attack data according to the at least one first keyword and the at least one second keyword; wherein the determining the similarity between the standardization data and the attack data according to the at least one first keyword and the at least one second keyword comprises: combining the at least one first keyword with the at least one second keyword to obtain a keyword set; determining a word frequency of each keyword of the keyword set in the standardization data to obtain a first word frequency feature vector; determining a word frequency of each keyword of the keyword set in the attack data to obtain a second word frequency feature vector; and calculating a cosine similarity between the first word frequency feature vector and the second word frequency feature vector as the similarity between the standardization data and the attack data. <EOS>