Rule adaption based network event collection method

Abstract

Embodiments of the invention disclose a rule adaption based network event collection method. The method includes determining a to-be-collected object; selecting an interface communication protocol; loading corresponding interface communication parameters; filling in corresponding parameter values; calling a corresponding interface communication module; presetting logic for realizing a preset interface communication protocol; associating with the to-be-collected object, analyzing identity authentication rules, and loading basic parameters; filling in correlative parameter values; initiating a connection test, and verifying whether collecting rule configuration information is correct; and loading corresponding collecting task scheduling strategies if the connection is correct, executing datacollecting and storing obtained original data into an original database. Through the configuration of the collecting rules and strategies, a collecting communication interface module can be automatically adapted, and the original information of the object can be collected into the database; and through the configuration of standardized event mapping rules, format processing can be performed on the collected original data, and data with unified formats can be provided for analysis and management.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a method for collecting network events based on rule adaptation. Background technique [0002] With the rapid development of network technology and mobile Internet, the wide application of cloud computing and big data technology, the construction speed of various computer servers, network equipment, security equipment, monitoring equipment, etc. Security threats are becoming more and more serious, and major security incidents continue to occur. In order to actively respond to network security threats, block attacks in a timely manner or audit evidence after the event, network event collection systems are usually used to collect business logs such as network element devices, information systems, and network behaviors in the network environment. Standardized processing and centralized monitoring and auditing of information events. The acquisition systems under...

AI Technical Summary

Problems solved by technology

[0003] Due to the huge number of equipment in the computer room, IDC, and cloud computing center, various business systems, complex network environment, etc., coupled with the large number of equipment and information system manufacturers, various network protocols, logs, and information formats are used, and one-to-one information collection The amount of custom development that needs to be invested is large, inefficient and requires multi-vendor coordination. It is difficult to standardize information formats and is not suitable for large-scale equipment and system information logs and security event collection and monitoring.

Images