Method for automatically extracting and analyzing firewall logs based on XML rule model

Abstract

The invention relates to a method for automatically extracting and analyzing firewall logs based on an XML rule model. The method includes the following steps of defining XML log analysis templates, automatically extracting the firewall logs and analyzing the firewall logs. According to the method, quintuple information of time, a source IP address, a source port, a destination IP address and a destination port contained in each log is extracted. The XML templates are formulated according to the structural features of each type of firewall log files, record type defined feature identification contained in the firewall log files is contained in the XML template, according to the identification, the firewall log files are extracted, the quintuple information in the firewall logs is automatically identified, and whether the operating state of a destination device is normal or not is automatically judged according to predefined safety rules. By the adoption of the method, a large amount of firewall log information can be automatically rapidly extracted, abnormal network access behaviors are analyzed, and a basis is provided for network safety analysis and management.

Description

Technical field [0001] The invention relates to a method for automatically extracting firewall security logs based on an XML rule model in the field of information security. According to the structural characteristics of firewall security log files, XML language is used to define rule templates, and the template-based log analysis system enters the automatic extraction of firewall log information During the process, the extracted log information is matched with the corresponding XML security rules, so as to effectively determine whether the extracted firewall log information reflects the abnormal operation and usage of the target device or system, which is in the field of information technology. Background technique [0002] Firewalls have been widely used in computer network security. The firewall has a log recording function, which can record all access to the internal network and external network through the firewall. The content of the log mainly includes time, source IP add...

AI Technical Summary

Problems solved by technology

[0003] Now there are some tools for managing firewall logs, but these tools usually only manage logs of a specific firewall, such as the log management system of Tianrongxin, which mainly manages logs of Log collection, storage, display and query, but without the analysis function of abnormal logs, it is impossible to analyze abnormal behavior information from a large number of logs

Since the log information of various firewalls does not adopt a unified format and is unstructured data, it brings great inconvenience to the unified analysis of firewalls

Images