Method and system for detecting website threat based on real-time log

Abstract

The invention provides a method for detecting website threat based on a real-time log. The method comprises the steps of acquiring log data of a website log server on real time; transforming the log data and distributing on real time; processing and detecting the log data on real time; displaying the website threat detection result on real time; early warning the severity of the detection result on real time. The invention further provides a system for detecting the website threat based on the real-time log. The system comprises a log data real-time acquiring unit, a log data real-time transformation and distribution unit, a log data real-time processing and detecting unit and a log data real-time monitoring unit. With the adoption of the method and system, the processing capacity and timeliness of the log data can be improved; the timeliness of website threat detection and reaction can be improved; the website operation risk can be reduced; the information security of the website can be greatly ensured.

Description

technical field [0001] The invention relates to the technical field of computer information security, in particular to a method and system for detecting website threats based on real-time logs. Background technique [0002] With the rapid development of Internet technology, the issue of network security is particularly important, and the security issue of network space has also risen to the national strategy. Some governments, school agencies and small and medium-sized enterprises have established their own network sites. Due to the lack of professional and technical personnel in information security, the system cannot be discovered in time after being attacked, resulting in adverse effects. There are various means of network attack, such as distributed denial of service (Distributed Denial of Service, referred to as DDoS) attack, 0day vulnerability attack, etc., the earlier the abnormality and threat of the system or network are discovered, and the preventive and countermea...

AI Technical Summary

Problems solved by technology

[0003] Most of the existing log-based website threat analysis and detection methods and systems adopt the method of normalizing log data into structured data and storing them in database tables. In this processing method, the reading and writing of log data is more complicated and the performance is lower. Real-time detection and analysis of website threats cannot be satisfied, and most of them adopt database-based post-event detection methods with low processing efficiency and lack of timeliness, and effective measures cannot be taken immediately when an attack occurs

At the same time, the traditional log analysis architecture cannot achieve linear expansion of storage performance. When the stored log data reaches a certain amount, the read and write performance of the data is seriously affected, and it takes a long time to store and analyze massive log data. , with the rapid growth of website log data, the timeliness is getting worse and the cost is getting higher and higher, making it more difficult to quickly detect threats to the website in multiple dimensions and take effective measures in a timely manner

Images