Website security monitoring and alarming system based on log analysis and firewall security matrixes

Abstract

The invention relates to a website security monitoring and alarming system based on log analysis and firewall security matrixes. The website security monitoring and alarming system aims at finding and stopping various security attacks on the website in time and is based on two work items which a website security administrator mostly depends on during actual security operation and maintenance. Log monitoring is characterized in that the known and unknown attacks are automatically found by conducting keyword / regular expression filtering on access of Apache / Tomcat / IIS or error logs or other environment logs, and meanwhile service processing errors caused by the hacker attacks in the early period are found in time through log customization in website service codes. The website security monitoring and alarming system is characterized in that the firewall security matrixes are defined, then the effectiveness of the firewall security matrixes is verified with the direct or indirect network connectivity detecting technology, and alarming is triggered once the firewall security matrixes are damaged. The website security monitoring and alarming system provides a simple and effective customization mode for the administrator, and sensing capacity for any attack or any suspicious action can be continuously improved.

Description

technical field [0001] The technical field of the present invention is the website security protection and monitoring and alarm system in the information security field. Background technique [0002] With the high-speed development of Internet applications, various Web sites are growing at a geometric progression rate, but the endless hacker attacks pose a huge threat to the usability and security of Web sites. The current mainstream security protection includes various types of systems: intrusion detection system, web application firewall, remote security scanning, etc. However, the above-mentioned types of security products are not enough to guarantee the security of the website for the following reasons: [0003] Intrusion detection system: The relying mechanism is the inspection of network packets. Because it does not understand the business logic of the user's website application, it can only perform matching inspections on known typical exploit methods and attack ch...

AI Technical Summary

Problems solved by technology

Most of the compromised websites are hackers who obtain the outer host / server authority, then remotely log in / automatically download to carry out further content tampering and destruction. This process will inevitably destroy the security matrix defined by the original system.

Images