Log correlation analysis system and method

Abstract

The invention provides a log event correlation analysis system and a method, which comprises the steps of: collecting log data, extracting characteristic data of the log data through a preset regular expression, constructing log events with uniform format according to the extracted characteristic data, querying treatment strategies of the log events, implementing cross correlation analysis and event flow logic correlation analysis to the events according to the instruction of strategies, as well as implementing risk evaluation on the log events and automatically responding. The method effectively reduces false-alarm, improves the objectivity of risk evaluation and the warning thereof has higher actual direction on users. The invention also provides a log event correlation analysis system corresponding to the method.

Description

technical field [0001] The invention relates to a network security management system and method, in particular to a log association analysis system and method. Background technique [0002] With the rapid popularization of the network, network security management has gradually become a focus, and obtaining network system conditions through logs is an important branch of network security management. A complex network system consists of a wide variety of security devices, network devices, host systems and their applications, and generates a large amount of log information every day. How to manage them in a unified way, understand the system status in a timely manner by analyzing them, discover potential threats and attacks, and respond quickly to abnormal events in the first time, is an urgent problem to be solved in network and system management, and it is also a problem to improve network systematization. Key to overall safety performance. The log-based security event mana...

AI Technical Summary

Problems solved by technology

[0003] (1) The source of log information is different, and there are many differences in format, such as firewall logs, IDS logs, and security audit systems cannot be compared with each other

[0004] (2) The amount of log data information is huge, and the real security time exists in a large number of redundant logs. It will take time and effort to establish log time correlation only by manual analysis. Therefore, it is necessary to use security event correlation analysis technology to quickly and effectively mine useful information from it. , find out the correlation of events, respond to and respond to security issues in a timely manner

[0005] (3) The operating environments of each component in the network system are different, and there is no set of unified protocol rules to coordinate, and it is impossible to realize the overall response of all components to security incidents

[0010] The disadvantage of this method is that it is processed in a statistical way, and the results often lack clear practical significance

Images