Event analyzing method and system

Abstract

The embodiment of the invention discloses an event analyzing method and an event analyzing system. The event analyzing method comprises the following steps of: determining a trigger event of an analysis rule; and if the trigger event happens, outputting an analysis conclusion of the analysis rule established in the corresponding analysis rule set of the trigger event. According to the technical scheme, the trigger event is determined for the analysis rule in an input event group of the analysis rule; only when the trigger event happens, a rule analysis module can be called to work and deduces a conclusion by analyzing a related rule of the trigger event. As the technical scheme only needs to analyze the trigger event among threatening events, the calling of the analysis module, the workload of the analysis module and the occupation of system resource are reduced, the system performance is improved, simultaneously the real-time analysis of the threatening events is realized, and the timeliness of the analyzed result is improved.

Description

technical field [0001] The invention relates to the field of business system security, in particular to an event analysis method and system. Background technique [0002] In order to improve the security of business systems, users often install and deploy various detection and protection facilities against various threats from outside and inside the system. When the business system is threatened, the detection and protection facilities will report the corresponding threat events. However, various security facilities usually only defend against one aspect of security threats. There is a lack of communication and cooperation between the facilities, and the management personnel receive a large amount of mutual information. Isolated threat events cannot extract effective information that users really care about. Therefore, the industry hopes to find a technology that can comprehensively analyze threat events reported by various security protection facilities and extract meaning...

AI Technical Summary

Problems solved by technology

[0004] Through the research on the existing technology, the inventor found that: the user has many security facilities, and the business system is often subject to various threats from inside or outside the system, so various detection and protection facilities will learn and report a large number of threat events in real time, The analysis of all threat events will occupy a large amount of system resources, resulting in a decrease in system performance. At the same time, this one-by-one analysis method will prevent new threat events from being analyzed in real time, resulting in analysis results that are not time-sensitive.

Images