A method and system for identifying hotspot security events

Abstract

The invention discloses a method and system for identifying hotspot security events, comprising: collecting SYSLOG security log data in different formats of various types of network assets in real time through the system log SYSLOG protocol, and standardizing the SYSLOG security log data into security record. According to the IP address of the network asset and the asset type of the network asset, the security event records are mapped to the pre-built network hotspot center. Calculate the hotspot index of the security event records in the network hotspot center. When the hotspot index exceeds the predetermined threshold, it is determined that the network hotspot center is abnormal, and the network asset with the greatest influence in the network hotspot center is regarded as a hotspot asset, and the security event record related to the hotspot asset is identified as a hotspot event. Through the solution of the invention, hot events can be comprehensively analyzed and key network information can be accurately reflected.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method and system for identifying hotspot security events. Background technique [0002] With the increasing scale of the enterprise's internal information network, the number of various devices in the network has increased sharply, and various security and attacks from outside and inside have also increased sharply, threatening network information security. In order to continuously cope with new security challenges, the enterprise network has deployed anti-virus systems, firewalls, intrusion detection systems, vulnerability scanning systems, UTM, etc. The logs of various devices record the operating status of the devices, the operations performed by various users, etc. information, which are referred to as security events. In the current network environment, the security event data of various devices is very large, and the growth rate of this information is also getting fa...

AI Technical Summary

Problems solved by technology

[0007] However, the current research on hot event analysis often focuses on the Internet field, and only focuses on the event information itself. In fact, it is only the analysis of hot "topics", and the accuracy of reflecting key network information is low. In the enterprise network environment, enterprise assets The scale is relatively stable, and the value of assets, the severity of security incidents, and the network level to which security incidents belong have a major impact on the analysis of hotspot events, which are not involved in general hotspot analysis

Images