Security attack alarm positioning system based on Spark big data platform of Tachyou

Abstract

The invention discloses a security attack alarm positioning system based on a Spark big data platform of Tachyou and belongs to the field of big data and information security. The system comprises an acquisition module, a security attack alarm positioning module and a view module. The acquisition module gathers log information in an enterprise information system, preprocesses and pushes the log information to the security attack alarm positioning module in real time, the security attack alarm positioning module performs real-time analysis to generate alarm information, and sends the alarm information to a view front end page. Compared with the prior art, the security attack alarm positioning system can solve the problem that a large number of logs are difficult to analyze in real time and has excellent practicality and value of popularization and application.

Description

technical field [0001] The invention relates to the technical fields of information security, Spark big data platform, Flume log collection, kafka data exchange platform, HDFS and Tachyou distributed memory file system, and in particular relates to a security attack alarm positioning system. Background technique [0002] The English abbreviation included in the present invention is as follows: [0003] SOC: SecurityOperationCenter Security Management Center [0004] IDS: IntrusionDetectionSystems intrusion detection system [0005] DDOS: DDoS: DistributedDenialofService distributed denial of service attack [0006] MIS: Management Information System Management Information System [0007] DMZ: demilitarizedzone isolation area, or demilitarized area [0008] JMS: JavaMessageServiceJava Message Service [0009] APP: Application application [0010] SNMP: SimpleNetworkManagementProtocol Simple Network Management Protocol [0011] HDFS: HadoopDistributeFileSystemHadoop Dis...

AI Technical Summary

Problems solved by technology

[0019] 1. There are many types of information security products and network equipment, widely distributed, and lack of unified data analysis and management;

[0020] 2. The knowledge base of information security products and network equipment is not unified, and there is a lack of unified solutions;

[0021] 3. Safety responsibilities are unclear, and specific responsibilities have not been implemented;

[0022] 4. Information security operation and maintenance management assessment is not detailed, lacking some necessary and key indicators;

[0023] 5. There is a lack of more advanced intelligent analysis and aggregation correlation between different security device events and even the same security device events, resulting in a huge amou

Images