Network system event tracing method and system based on log and flow collection

Abstract

The invention relates to an information security technology. A network system event traceability method and system based on log and flow collection can be provided, and the method comprises the steps:obtaining network access and network exit flow data of all network safety equipment in a flow mirroring mode at a core switch through a distributed log collection method, and storing the network access and network exit flow data in a flow database of each collection instance; adopting a centralized log collection method to collect logs generated by each network security device; filtering and processing the collected logs, and storing the logs in a log database; extracting an IP and occurrence time of the log identifier, and retrieving all flow data of the IP at an event occurrence time pointand within a period of time after the event occurrence time point in a flow database; aggregating presentation data. According to the embodiment of the invention, the problems that the source is difficult to trace and the attack means cannot be analyzed after the attack event occurs are solved, and a specific attack path and an attack target can be displayed according to the corresponding event.

Description

[0001] This application relates to the technical field of network and information security, and in particular to a method and system for network system event traceability based on log and traffic collection [0002] technical background [0003] The development of the Internet allows any individual or organization to connect to the network anywhere, and ensuring network security and service continuity has always been the primary goal of service providers. However, it is inevitable that systems that are connected to the outside world will be affected. The possibility of an attack. When a network security incident occurs, in addition to relying on security equipment to defend against the attack, we also want to know how malicious attacks affect the server, what are the specific malicious attack methods, and where should we start to prevent this in the future The recurrence of a similar event. Relying on the logs of network security devices, we can understand the classification of mal...

AI Technical Summary

Problems solved by technology

[0006] Based on this situation, the purpose of the present invention is to provide a network system event source tracing method and system based on log and traffic collection, so as to alleviate the technical problem that manual analysis is inefficient in processing network security events and cannot restore the attack path

Images