High-performance log and behavior auditing system

Abstract

The invention discloses a high performance log and a behaviour audit system, main body of the system uses the three-layer structure composed by a data collecting layer, a data analyzing layer and a data storing and searching layer; the three layers uses TCP encryption transmission, each of them can be independently expanded, which enhances the performance of one layer. The invention is completelybased on an embedded system, and performs pertinent optimization to software and hardware in terms of collection; the invention uses special software and hardware interface and arithmetic in storing and searching the log and behavioural data, keeps independence in designing the modules for the purpose of expansion, therefore the bottleneck will not happen to the single module.

Description

technical field [0001] The invention belongs to the field of log and behavior auditing, in particular to a high-performance log and behavior auditing system. Background technique [0002] The current log and behavior audit system mainly uses linux / unix or Windows servers to build a system platform by using a general-purpose relational database when collecting, analyzing and storing data, and further develops data collection, analysis and storage on this platform. Applications. However, for an environment with a large amount of data such as logs and behaviors, the application of such a platform often cannot meet the performance requirements in terms of collection, analysis, and retrieval. The reasons are: 1. For the server, in order to meet the needs of business and stability, many services and daemons are running, but most of these services and daemons are unnecessary for audit applications; 2. For general As far as the relational database is concerned, in addition to prov...

AI Technical Summary

Problems solved by technology

However, for environments with large amounts of data such as logs and behaviors, the application of such a platform often cannot meet the performance requirements in terms of collection, analysis, and retrieval.

The reasons are: 1. For the server, in order to meet the needs of business and stability, many services and daemons are running, but most of these services and daemons are unnecessary for audit applications; 2. For general As far as the relational database is concerned, in addition to providing data storage and query, it also needs to provide a lot of data correlation functions, so it cannot satisfy the fast retrieval of a single data relationship but a huge amount of data in the audit; 3. Often developed applications, Acquisition, analysis, and storage cannot be completely independent, making it difficult to apply once a bottleneck occurs on a certain module

Images