Integration and conversion system for network security data

Abstract

The invention provides an integration and conversion system for network security data. The system comprises a network security detection tool, an agent module, a configuration module, a data acquisition device and a data sorting and merging processing module, wherein the number of the network security detection tool is at least one, each network security detection tool comprises at least one agent module and at least one configuration module; the configuration module comprises a configuration document, and the configuration document comprises a data format conversion rule described by a regular expression; the network security detection tool obtains the network security data of the located network; the agent module obtains the network security data from the network security detection tool according to the configuration document, extracts security event data in the network security data according to the regular expression and converts the extracted security event data into a uniform data format corresponding to the security event; and the data acquisition device collects the security event data formed by conversion of each agent module, and sends the security event data to the data sorting and merging processing module, so that the data sorting and merging processing module can sort and merge the data.

Description

technical field [0001] The invention relates to the field of network security, in particular to a system for integrating and converting network security data. Background technique [0002] With the increasing popularity of network applications, network security issues are getting more and more attention. Various current network protection facilities such as data stream collectors, intrusion detection systems, virus detection systems, vulnerability scanning systems and firewalls have obtained part of network security data from different angles. In order to obtain more complete data, it is necessary to integrate the data detected by various manufacturers' detection tools for unified analysis. Since the data formats and storage methods set by different manufacturers are different, it is necessary to extract corresponding security data from various heterogeneous detection tools, and integrate and convert these security data into unified data in a certain format , Only in this ...

AI Technical Summary

Problems solved by technology

[0026] The purpose of the present invention is to overcome the problems of complex data conversion, low performance, and not supporting the dynamic addition of network security probes to the system in the existing method for data integration and conversion of heterogeneous security data, and to provide an efficient and convenient , Accurate data integration and transformation methods

Images