Association analysis method and system for massive logs

Abstract

The invention discloses an association analysis method and an association analysis system for massive logs to evaluate the current network security condition and describe the attack condition which is paid most attention currently according to the massive logs generated by an intrusion detecting device. The method comprises the following steps: acquiring the logs of the intrusion detecting device, and judging whether a large-scale network security event exists or not by calculating the distribution condition of source addresses and destination addresses of the logs of the intrusion detecting device; merging the logs of the intrusion detecting device according to the source addresses, the destination addresses and event types, and detecting and reporting abnormal addresses and hot events; counting and displaying a propagation process of the hot events in a specific time period through graphics; and associating output results, and giving comprehensive evaluation on the current network security condition. The system comprises an entropy module unit, a triple module unit, a hot event propagation display module unit, and a comprehensive association analysis module unit.

Description

technical field [0001] The invention relates to the field of information security, in particular to a massive log association analysis method and system. Background technique [0002] The rapid development of the Internet has brought great convenience to the dissemination and utilization of information, but at the same time, human society is facing a huge challenge of information security. In order to alleviate the increasingly serious security problems, intrusion detection equipment (IDS: Intrusion Detection System) has been deployed more and more widely. IDS is installed in the protected network segment, and its monitoring network card works in promiscuous mode, analyzes all data packets in the network segment, and performs real-time detection and response of network security events. At present, IDS generally adopts the misuse detection technology. The detection method is as follows: first, code the identification specific intrusion behavior pattern, establish a misuse pa...

AI Technical Summary

Problems solved by technology

Due to the large number of alarms and many irrelevant alarms, most of the energy of security management personnel is spent on processing useless information, and it is difficult to understand the security threat status of the system

[0005] 2. Most of the existing intrusion detection equipment detects based on a single data packet, which is reflected in the form of expression. The alarm information of the intrusion detection equipment is an isolated intrusion event

In this way, when large-scale network abnormal behavior occurs, it is difficult to intuitively obtain the characteristics of the abnormal behavior from the alarm information, and it is difficult to evaluate the current network security situation as a whole

Images