A network attack event analysis method and device associated with alarm logs

Abstract

The present invention relates to a method for analyzing network attack events associated with alarm logs, comprising: S1, obtaining the original file of the log and preprocessing the original file; S2, performing abnormal judgment analysis on the preprocessed original file; according to the judgment analysis result, Build an attack rule fingerprint library, and then gradually improve the attack rule fingerprint library; S3, associate the attack rule fingerprint library with the events in the alarm log; then summarize and merge the linked events to form an alarm event library; S4, The event library is used for event response and processing, and the invention also discloses a network attack event analysis device associated with alarm logs. The invention can build an attack rule fingerprint database, and at the same time continuously improve the attack rule fingerprint database through the systematization of feature attributes, probability statistics method, dynamic tracking method, etc., so as to ensure timely response to different network attack events.

Description

Technical field [0001] The present invention relates to the field of network security event analysis, and more particularly to a network attack event analysis method and apparatus associated with alarm log. Background technique [0002] As the company's information construction continues to improve, a huge information network is formed inside the company. A variety of malicious code (zombie network, Trojan, lessif software, etc.) is also constantly threatening the information network, various hosts and terminal equipment, and if it is not solved in time, These malicious code issues will bring adverse consequences to the company's information construction, such as the company's information disclosure, the company's internal confidential document leaks, etc. [0003] Due to the number of all-network hosts and terminal devices, the distribution range is wide, the user security consciousness is uniform, the seemingly calm information network is full of high-risk hosts and high-risk t...

AI Technical Summary

Problems solved by technology

A variety of malicious codes (botnets, Trojan horses, ransomware, etc.) that are more harmful on the Internet are also constantly threatening the information network. There may also be various malicious codes lurking in various hosts and terminal devices. If not resolved in time, These malicious code problems will bring adverse consequences to the company's informatization construction, such as leakage of company personnel information, leakage of company internal confidential documents, etc.

Images