Log-based threat intelligence detection method and device

Abstract

Embodiments of the invention disclose a log-based threat intelligence detection method and device. The method comprises the steps of obtaining log files of different file types, analyzing the log files, matching different IOC types, and adding analysis files of the different IOC types to a detection engine queue; obtaining a target analysis file from the detection engine queue, and determining a corresponding target query mode according to the IOC type of the target analysis file; and if it is queried that threat intelligence exists in the target analysis file according to the target query mode, generating threat alert information, which, for example, includes an attacked host or a malicious file. The log files of the different file types are analyzed, and the target analysis file is queried in the corresponding attack detection query mode, so that large-batch data can be processed at the same time, and the network security detection efficiency of massive data is greatly improved.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of network security, and in particular to a log-based threat intelligence detection method and device. Background technique [0002] With the rapid development of computer technology and network applications, the amount of network information data is increasing, and the data security of massive data is becoming more and more important. Data generated by various applications such as social networks, mobile communications, network video and audio, e-commerce, sensor networks, and scientific experiments can often generate tens of millions, billions, or even billions or tens of billions of massive data. The security of the network needs to detect these massive data to ensure the safe operation of the network. [0003] The existing technology mainly adopts the conventional detection method for a single type of log, which can cope with a network with a small amount of data, but for a mas...

AI Technical Summary

Problems solved by technology

[0003] The existing technology mainly adopts the conventional detection method for a single type of log, which can cope with a network with a small amount of data, but for a massive data network, the efficiency of the detection method obviously cannot meet the requirements, resulting in a significant reduction in network operation speed. At the same time, the coverage of data security detection is small

[0004] In the process of realizing the embodiment of the present invention, the inventor found that the detection efficiency of the existing method for network security detection of massive data is too low

Images