An analysis method for an analysis engine with node-thread-level non-redundant calculations

Abstract

The invention discloses an analysis method of an analysis engine with no redundant calculation at the node thread level, and belongs to the technical field of information network security analysis. The working principle of the analysis engine of the present invention is that the policy analysis part parses and loads policies with different external perspectives and different external filtering characteristic conditions, and the loaded policies are distributed to each concurrent statistical analysis module through the policy distribution module, and in a single node , the engine perspective classification processing logic algorithm will perform independent logical processing according to different perspective fields in the custom policy, and then logically process the feature filter conditions in the policy, and the analysis engine will assign the node to all groups and individual statistical algorithms of the policy and Filter conditions and research and judgment conditions are deduplicated to ensure that the filter conditions, feature statistics, and research and judgment conditions in a single node are only processed once, and the calculated eigenvalues ​​are stored in the calculated eigenvalue set.

Description

technical field [0001] The invention belongs to the technical field of information network security analysis, and in particular relates to an analysis method with an analysis engine with node thread level non-redundant calculation. Background technique [0002] The logs generated by the business and system under the jurisdiction of the enterprise are very important to the enterprise. It can not only analyze the business requirements of the business system, but also use these log data to analyze the possible security problems of the business system. The analyzed business requirements can improve the relevant functions of the system, enhance the stability and reliability of the system; through the analysis of business system security issues, the security level of the business system can be strengthened, that is, the security of user information data and assets can be guaranteed while ensuring a good user experience reliable. [0003] At present, there are many log analysis pr...

AI Technical Summary

Problems solved by technology

[0010] The purpose of the present invention is to provide an analysis method with an analysis engine with no redundant calculation at the node thread level. This patent adopts multi-view, self-defined filter features, merged group statistics module and individual analysis module to carry out multi-node concurrent statistical analysis design and implementation methods, which solve the defects that the existing rule analysis engine can only analyze a single perspective, and the statistical analysis features are simple and cannot be applied to complex business application scenarios

Images