A method and system for correlation analysis of massive logs

Abstract

The invention discloses a massive log association analysis method and system, which realizes evaluating the current network security status and describing the current attack situation that should be paid most attention to based on the massive logs generated by the intrusion detection equipment. The method includes: obtaining the log of the intrusion detection device, and judging whether there is a large-scale network security event by calculating the distribution status of the source address and the destination address of the log of the intrusion detection device; Intrusion detection device logs are merged to detect and report abnormal addresses and hotspot events; statistics and graphics display the propagation process of hotspot events within a specified time period; correlate the above output results to give a comprehensive evaluation of the current network security status. The system includes an entropy module unit, a triple module unit, a hot event propagation display module unit, and a comprehensive correlation analysis module unit.

Description

technical field [0001] The invention relates to the field of information security, in particular to a massive log association analysis method and system. Background technique [0002] The rapid development of the Internet has brought great convenience to the dissemination and utilization of information, but at the same time, human society is facing a huge challenge of information security. In order to alleviate the increasingly serious security problems, intrusion detection equipment (IDS: Intrusion Detection System) has been deployed more and more widely. IDS is installed in the protected network segment, and its monitoring network card works in promiscuous mode, analyzes all data packets in the network segment, and performs real-time detection and response of network security events. At present, IDS generally adopts the misuse detection technology. The detection method is as follows: first, code the identification specific intrusion behavior pattern, establish a misuse pa...

AI Technical Summary

Problems solved by technology

Due to the large number of alarms and many irrelevant alarms, most of the energy of security management personnel is spent on processing useless information, and it is difficult to understand the security threat status of the system

[0005] 2. Most of the existing intrusion detection equipment detects based on a single data packet, which is reflected in the form of expression. The alarm information of the intrusion detection equipment is an isolated intrusion event

In this way, when large-scale network abnormal behavior occurs, it is difficult to intuitively obtain the characteristics of the abnormal behavior from the alarm information, and it is difficult to evaluate the current network security situation as a whole

Images