Network information log audit system

Abstract

The invention discloses a network information log audit system. The system comprises a data acquisition subsystem, a data center subsystem, a storage subsystem and a user interface subsystem. The data acquisition subsystem comprises a plurality of hosts equipped with audit probes and the hosts are used for collecting and recombining logs. The data center subsystem is used for analyzing and processing audit logs and sending a result to the storage subsystem so as to carry out storage. The user interface subsystem provides an interface used for accessing the storage subsystem by a user and is used for checking specific log data and examining report forms. The system of the invention is taken as front end data acquisition equipment of a network user behavior audit and responsibility management system, takes network-data-flow high-speed acquisition, data packet recombination and protocol restoration as a core technology, is used for acquiring network information of the user and carries out network behavior log evidence obtaining and revealing.

Description

technical field [0001] The invention relates to a network information log auditing system. Background technique [0002] The network user behavior audit and responsibility management system is a set of security management business systems to make up for the shortcomings of traditional network information audit methods and help users improve their behavior compliance monitoring and management. [0003] Based on network monitoring and terminal forensics technology; with the technical transformation of business systems as the core; the network behavior compliance situation, the recurrence of security incident behavior chains, and the implementation of the responsibility of actors as outputs. [0004] Help users control the overall behavior compliance situation of the target information network from a macro perspective; from the micro perspective, deeply analyze the details of specific events and behaviors, and identify the responsibilities of the actors. [0005] Through the u...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to overcome the deficiencies of the prior art, to provide a network information log audit system, as a front-end data acquisition device of the network user behavior audit and responsibility management system, to solve the problem that the prior art collects fewer types of logs and does not restore the logs steps, leading to the difficulty of determining responsibility in the later stage

Images