Security incident feature analysis method and system based on predicate deduction
A security event and feature analysis technology, applied in the field of information security, can solve the problem that security event feature analysis cannot identify new patterns, etc., to save manpower, improve overall performance, and reduce maintenance costs.
Inactive Publication Date: 2014-09-17
BEIJING JN TASS TECH
View PDF4 Cites 2 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
[0004] The technical problem to be solved by the present invention is to provide a security event feature analysis and system based on predicate inference, which is used to solve the problem that the analysis script needs to be developed separately due to the inability to recognize new patterns in the security event feature analysis
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0020] The principles and features of the present invention are described below in conjunction with the accompanying drawings, and the examples given are only used to explain the present invention, and are not intended to limit the scope of the present invention.
[0021] Such as figure 1 As shown, this embodiment provides a security event feature analysis method based on predicate inference, including:
[0022] Step 1, collecting security events;
[0023] Step 2, segment the collected security events into several words;
[0024] Step 3, analyze the part of speech of each word after segmentation, and generate a syntax tree according to the result of the part of speech analysis combined with the pre-set sentence format;
[0025] Step 4, according to the predicate or linking verb in the syntax tree, determine the type of security event;
[0026] Step 5, transmit and save the security event and its corresponding word segmentation result, part-of-speech analysis result, syntax ...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The invention relates to a security incident feature analysis method and system based on predicate deduction. The method comprises the following steps: step 1, collecting a security incident; step 2, dividing the collected security incident into a plurality of words; step 3, analyzing the word class of each divided word; meanwhile, generating a syntax tree by combining a pre-set sentence pattern format according to a word class analysis result; step 4, judging the type of the security incident according to predicates in the syntax tree. According to the security incident feature analysis method and system, the identification on common security incidents is realized by utilizing marks for the predicates; with regard to the security incidents which can not be analyzed by an internally-arranged standardized script, new scripts do not need to be developed again in most occasions, so that manpower is saved and the maintenance cost is reduced; meanwhile, word division is carried out on the security incident in advance, so that the load of a full-text search part of the system is reduced and the whole performance is improved.
Description
technical field [0001] The invention relates to the field of information security, in particular to a security event feature analysis and system based on predicate inference. Background technique [0002] In the field of information security, especially for various types of system or equipment security events, such as network attack behavior, network operation behavior, system operation behavior, database operation behavior audit, etc., all need to be collected, analyzed and monitored in a centralized manner. However, due to the large differences in the event formats of different systems or devices, the contents of the events describing various behaviors are also very different. Generally, the relevant address information, port information, protocol information, host information, user information and Behavior information is parsed and stored in corresponding fields. This process is called standardization of security events. [0003] At present, whether it is similar foreign...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More IPC IPC(8): G06F17/22
Inventor 陈虎唐开达
Owner BEIJING JN TASS TECH