Security event log processing method and device and storage medium

Abstract

The invention discloses a security event log processing method and device and a storage medium, and belongs to the technical field of network security. The method comprises the following steps: extracting a plurality of entity identifiers and entity description information related to a security event from a security event log, wherein the plurality of entity identifiers comprise internet protocolIP addresses; determining an association relationship among the plurality of entity identifiers according to the entity description information; and taking each entity identifier in the plurality of entity identifiers as a node in a network relationship graph, and constructing an edge in the network relationship graph according to an association relationship among the plurality of entity identifiers to obtain the network relationship graph. In this way, the incidence relation between the nodes corresponding to the entity identifiers can be visually displayed in the obtained network relation graph, that is, comprehensive analysis is conducted on the basis of global information, so that technicians can conveniently and rapidly find entities needing to be highly concerned, and the safety operation efficiency can be improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a security event log processing method, device and storage medium. Background technique [0002] With the development of network security technology, enterprises will deploy security devices to protect their assets and data. Security devices can detect security threats, security problems, etc., and send them to SOC (SecurityOperation Center, Security Operation Center) in the form of security event logs. In this way, a large number of security event logs will be stored in the SOC, and the information is messy and huge. Therefore, it is necessary to process the security event logs so that technicians can find the most noteworthy security events and ensure safe operation. [0003] In the related technology, when processing the security event log, information such as domain names and IP (Internet Protocol, Internet Protocol) addresses that appear in all stored sec...

AI Technical Summary

Problems solved by technology

[0005] This application provides a security event log processing method, device and storage medium, which can solve the problem that the analysis of related technologies is not comprehensive, which may lead to ignoring some information that requires high attention

Images