Method for collecting and synchronizing multi-source network security events

Abstract

The invention discloses a method for collecting and synchronizing multi-source network security events. In an existing collection process of the multi-source network security events, the local times of the devices are not synchronous. The method comprises the following steps: 1) collecting the multi-source network security events: an event collection terminal collects the events generated by network security devices in real time and stores the events in an ehaache cache framework; 2) synchronous check of event source times: each event source is synchronized with the time of a server as the reference; 3) calling a RMI mechanism by a node in the ehaache cache framework in a remote method to perform event synchronization with the other nodes in the ehaache cache framework; and 4) reading event information from the ehaache cache framework by the server in real time, and processing the event information. According to the method disclosed by the invention, the time differences of the devices and the server are obtained accurately in real time by sending synchronous data packets, and calculating the network delay and a local time difference, and thus the method has the advantages of easy implementation and accurate synchronization.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for collecting and synchronizing multi-source network security events. Background technique [0002] With the rapid development of the network, network security issues are facing great challenges. With the continuous advancement of information technology, the means of attack and the timeliness of attack are also continuously improved. A large number of system vulnerabilities have been discovered and exploited, network security issues have become very vulnerable, and network security defense is even more important. [0003] In order to cope with the security threats faced by the network, many enterprises have deployed firewalls, behavior management equipment, anti-virus software, intrusion detection systems and other security infrastructure in the process of informatization. These security infrastructures will generate some log data related to security protectio...

AI Technical Summary

Problems solved by technology

The security event collection methods mentioned in these documents did not take into account the time asynchronous problems between collection agents and between collection agents and the central server, which caused the central server to appear out of order after receiving multi-source events. In the case of a large difference in the time of each Agent and a large network delay, it will seriously affect the analysis results of the event analysis terminal

Images