Electric power network security monitoring method and system based on ELK log collection and analysis

Abstract

The present application provides a power network security monitoring method and system based on ELK log collection and analysis. The method comprises the following steps: adopting a centralized log management method to collect a network security equipment log of a power monitoring system; Filtering, normalizing and storing the collected network security equipment logs of the power monitoring system; Using the distributed log retrieval method, the stored logs are retrieved and counted; displaying the log data in a summarized manner. The electric power network security monitoring method and system based on ELK log collection and analysis provided by the application adopts a cluster mode, data storage, query is efficient and fast, realizes real-time log monitoring and storage, and meets log storage requirements; and through the visualization mode for log display, friendly interface, simple and easy to use, log analysis rules can be customized to facilitate staff real-time monitoring of network security events, improve the network security monitoring level of power monitoring system.

Description

technical field [0001] The present application relates to the technical field of power system information security, in particular to a power network security monitoring method and system based on ELK log collection and analysis. Background technique [0002] The power monitoring system adopts general network and information technology, which inevitably introduces information security issues. Although the production control area of ​​the power monitoring system is separated from the management information area through network isolation technology, making the power monitoring system in a relatively closed and safe environment; The attention to system information security issues has enriched the product information acquisition channels of control systems, including power monitoring systems, and increased opportunities for attackers to learn various control system software, firmware, and communication protocols. For example, with the outbreak of ransomware, the power monitoring...

AI Technical Summary

Problems solved by technology

[0004] This application provides a power network security monitoring method and system based on ELK log collection and analysis, which solves the problem of insufficient retention time of security equipment logs such as firewalls, IDS, IPS, and security audit logs, difficulty in viewing inconsistent log formats, and complicated log information. And difficult to understand, difficult to achieve real-time monitoring of security events and other issues

Images