Network security situation awareness analysis method based on log and SNMP information fusion

Abstract

The invention belongs to the field of network security situation awareness, and particularly relates to a network security situation awareness analysis method based on log and SNMP information fusion. The method includes the steps of performing data collection based on log and SNMP data fusion, performing preprocessing based on log and SNMP data fusion, performing log data analysis and SNMP data analysis, performing log and SNMP data fusion and performing visualization on log and SNMP data fusion. Compared with a method for analyzing log data or SNMP data sources singly, through combination of the two kinds of data, the overall operation trend of the network situation can be well analyzed, and analysis is more comprehensive and more accurate. According to a system, data with a high important degree is selected to be processed according to user requirements, and the burden of processing a large number of data is relieved. An automatic threshold value correction method is used, therefore, threshold value parameters defined by a user are more accurate, and the accuracy of data fusion is improved.

Description

technical field [0001] The invention belongs to the field of network security situational awareness, and in particular relates to a network security situational awareness analysis method based on log and SNMP information fusion. technical background [0002] With the development of computer and network technology, attack methods are becoming more and more specialized, and network security incidents emerge in endlessly. Passive defense technologies such as a single firewall and intrusion detection system can no longer ensure network security. Therefore, improving the active defense capability of the network is the current network security research. The main direction of the field, and the research in the field of network security situational awareness is particularly prominent. [0003] The data sources of the network security situation awareness system are very rich, among which log and SNMP data occupy an important position. However, there are certain defects in independen...

AI Technical Summary

Problems solved by technology

However, there are certain defects in SNMP analysis or log analysis alone.

(1) The SNMP agent cannot provide the management station with historical data of a certain target set, but can only provide the current status of the device or data within a short period of time, which hinders the analysis of the overall operation trend of the network

(2) The detection granularity of SNMP protocol is rough, the data data is simple and cannot provide information above the network layer

[0006] (2) SNMP detection has rough granularity, simple data and cannot provide information above the network layer

However, the establishment of its knowledge base has a strong dependence on expert knowledge, and the false negative rate is high; and the threshold is fixed, and the detection accuracy is reduced

Images