A method and system for extracting key information from network security logs

Abstract

The invention discloses a method and system for extracting key information of a network security log, and relates to the field of network monitoring. Including: step S1: obtain firewall alarm log and internal gateway login log in network security log; step S2: process firewall alarm log to obtain intranet result IP list; include several intranet IP addresses in the intranet result IP list; step S3: Retrieve in the internal gateway login log according to the intranet result IP list, and generate a list of intranet user usage records according to the retrieval results; the intranet user usage record list includes each intranet IP address and the IP address corresponding to the intranet IP address Allocating logs and user login information; Step S4: storing the intranet user usage record list in the pre-generated database to be analyzed for further analysis. Combined with firewall alarm logs and internal gateway login information, the intranet IP address is matched, which reduces the workload of analysis, and has clear goals and strong directivity.

Description

technical field [0001] The invention relates to the technical field of network monitoring, in particular to a method and system for extracting key information from network security logs. Background technique [0002] Network security is an important issue related to national security and sovereignty, social stability, and national economic development. Its importance has become more and more important with the acceleration of global informatization. At the same time, with the deepening of information technology and the rapid development of the Internet, network intrusion incidents are increasing, which has brought huge economic losses to people. Some even threaten national security. The detection and defense of network intrusion events is a key issue in network security assurance. In traditional methods, researchers analyze network intrusion behaviors from network security logs, data traffic, malicious code, system vulnerabilities and other channels. However, traditional ...

AI Technical Summary

Problems solved by technology

However, traditional analysis methods cannot meet the security protection requirements of the current network environment

[0003] At present, there are already a large number of association analysis methods, such as IP association and domain name association, etc., but most of these association analysis methods start from the macro, such as the WHOIS information base, etc., such as exploring how many IP addresses a domain name has used, and how many The IP address layer has been used by multiple domain names, etc., but the same monitoring object (one unit) has not been analyzed and integrated

Images