Audit data duplicate removal system of distributed deployment

Abstract

The invention discloses an audit data duplicate removal system of distributed deployment, and belongs to the field of network security audit equipment. The audit data duplicate removal system comprises audit units used for collecting audit records, performing first time judgment on the collected audit records at the same time, not reporting the audit records to an audit center if the audit records are duplicate, and reporting the audit records to the audit center if the audit records are not duplicate; and the audit center used for receiving and storing the information of the audit records reported by the audit units, performing second time judgment on the received audit records according to the stored information of the audit records, storing the audit records if the audit records are not contained, and updating the audit records if the audit records are contained. According to the audit data duplicate removal system disclosed by the invention, the main duplicate removal work of audit data is accomplished by the scattered audit units, and the centralized management and coordination work is accomplished by a management host of the audit center. Therefore, the network load is reduced, the duplicate removal processing of the audit records by the audit center is simplified, and the processing speed of the audit records is improved on the whole.

Description

technical field [0001] The invention belongs to the field of network security audit equipment, and relates to an audit data deduplication system for a distributed deployment audit platform. Background technique [0002] The network security audit system is a special product for information security that records and analyzes the protocols, data and behaviors in the network, and makes certain response measures. It generally adopts a bypass access method. The distributed deployment audit platform is to deploy multiple audit devices in a distributed manner in the network, and one audit center management host (hereinafter referred to as the audit center) is responsible for the audit equipment units (hereinafter referred to as audit units or audit devices) that are deployed in a distributed manner. Manage to meet users' requirements for network behavior audit and filing, provide complete network behavior records, and facilitate information tracking, system security management and ...

AI Technical Summary

Problems solved by technology

[0005] However, the patent has the following problem: if the same network flow passes through some different audit units, when these audit units summarize the audit data to the audit center management host, the audit data of the above network flow will have multiple duplicate records, not only Occupies too much storage space, increases the amount of data processed, and reduces processing speed

[0007] However, the problem with the audit data deduplication method of the distributed deployment audit platform disclosed in the application document is that the audit center stores the audit record information reported by each audit unit, and the audit data deduplication work is mainly completed by the audit center. A completely centralized management method still has a lot of audit records that need to be reported to the audit center, which will cause serious network load, and the workload of the audit center will be heavy, which will affect the speed of audit processing

Images