A log-based audit method and system

Abstract

The invention discloses an auditing method and system based on logs and relates to the field of computer security. The method includes: acquiring the original logs of system log-in operations; analyzing to obtain source addresses, operation accounts, equipment IPs and operation commands; positioning operation equipment and information systems which the operation equipment belongs to, operators, operation contents and importance levels; building an auditing view using the corresponding information system as an index and using the corresponding operation equipment, operator, operating content and importance level; monitoring the importance levels to determine whether an alarming condition is satisfied or not, and if so, giving out an alarm and recording the corresponding auditing view into an auditing sensitive information set to facilitate auditing, looking up and analysis. The method has the advantages log data is analyzed and processed by computer programs, operation auditing views using the information systems as visual angles are built, the operated equipment, the specific operator, the corresponding operation content and whether the operation is an key operation or not in one information system can be automatically monitored and alarmed, manual intervention is not needed, automatic auditing is achieved, and auditing efficiency and accuracy are increased greatly.

Description

technical field [0001] The invention relates to the technical field of computer network information security, in particular to a log-based audit method and system. Background technique [0002] With the continuous development of economy and society, information, as the social basic resource for maintaining economic and social management, has become the foundation of all social fields such as politics, economy, national defense, science and technology, and culture. As the main storage and operation platform of information, information system plays an important role in various fields. With the continuous development of information systems, auditing institutions timely put forward the concept of information system auditing, and include information systems as objects in auditing. In recent years, audit institutions at all levels have continuously increased the intensity of information system audits and greatly promoted the information system audit work. [0003] Existing log a...

AI Technical Summary

Problems solved by technology

[0004] In the existing log audit scheme of information system operation behavior, if the information system is to be audited, the operation log of the information system needs to be manually retrieved frequently using the device IP in the audit database, and the operation log of the information system needs to be manually analyzed afterwards. The associated relationship, judging whether the operation is a high-risk operation, the audit work is cumbersome, and the efficiency is very low

Images