A log-based threat intelligence detection method and device

Abstract

The embodiment of the present invention discloses a log-based threat intelligence detection method and device. The method includes: obtaining log files of different file types, parsing the log files, matching different threat indicator IOC types, and comparing the different IOC type of analysis file is added to the detection engine queue; the target analysis file is obtained from the detection engine queue, and the corresponding target query method is determined according to the IOC type of the target analysis file; if the target is found according to the target query method If there is threat intelligence in the parsed file, threat warning information will be generated, such as containing a compromised host or malicious files. By parsing log files of different file types, and using the corresponding query method of loss detection to query the target parsing file, it can process large batches of data at the same time, and greatly improve the detection efficiency of network security detection for massive data.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of network security, and in particular, to a log-based threat intelligence detection method and device. Background technique [0002] With the rapid development of computer technology and network applications, the amount of network information data is increasing, and the data security of massive data has become more and more important. Today's data generated by various applications such as social networks, mobile communications, network video and audio, e-commerce, sensor networks, and scientific experiments can often generate massive data of tens of millions, billions, or even billions and tens of billions. The security of the network requires the detection of these massive data to ensure the safe operation of the network. [0003] The prior art mainly adopts a conventional single-type log detection method, which can cope with a network with a small amount of data. However, for a mass...

AI Technical Summary

Problems solved by technology

[0003] The existing technology mainly adopts the conventional detection method for a single type of log, which can cope with a network with a small amount of data, but for a massive data network, the efficiency of the detection method obviously cannot meet the requirements, resulting in a significant reduction in network operation speed. At the same time, the coverage of data security detection is small

[0004] In the process of realizing the embodiment of the present invention, the inventor found that the detection efficiency of the existing method for network security detection of massive data is too low

Images