Network attack event analysis method and device associated with alarm log

Abstract

The invention relates to a network attack event analysis method associated with an alarm log, which comprises the following steps: S1, acquiring an original file of the log and preprocessing the original file; S2, performing abnormity judgment and analysis on the preprocessed original file; establishing an attack rule fingerprint database according to a judgment and analysis result, and graduallyperfecting the attack rule fingerprint database; S3, associating the attack rule fingerprint database with an event of the alarm log; summarizing and combining the linked events, and establishing an alarm event library; and S4, carrying out event response and processing according to the alarm event library. The invention also discloses a network attack event analysis device associated with the alarm log. According to the method and the device, the attack rule fingerprint database can be established, and meanwhile, the attack rule fingerprint database is continuously perfected through a characteristic attribute systematization method, a probability statistics method, a dynamic tracking method and the like, so that different network attack events can be timely handled.

Description

technical field [0001] The invention relates to the field of network security event analysis, and more particularly relates to a network attack event analysis method and device associated with alarm logs. Background technique [0002] With the continuous improvement of the company's informatization construction, a huge information network has been formed within the company. A variety of malicious codes (botnets, Trojan horses, ransomware, etc.) that are more harmful on the Internet are also constantly threatening the information network. There may also be various malicious codes lurking in various hosts and terminal devices. If not resolved in time, These malicious code problems will bring adverse consequences to the company's informatization construction, such as leakage of company personnel information, leakage of company internal confidential documents, and so on. [0003] Due to the large number of hosts and terminal devices in the entire network, the wide distribution ...

AI Technical Summary

Problems solved by technology

A variety of malicious codes (botnets, Trojan horses, ransomware, etc.) that are more harmful on the Internet are also constantly threatening the information network. There may also be various malicious codes lurking in various hosts and terminal devices. If not resolved in time, These malicious code problems will bring adverse consequences to the company's informatization construction, such as leakage of company personnel information, leakage of company internal confidential documents, etc.

Images