Event auditing method and device, terminal equipment and storage medium

Abstract

The invention discloses an event auditing method and device, terminal equipment and a storage medium, and the method comprises the steps: obtaining preset sample data which comprises a training set and a test set formed by various types of event logs; constructing a fusion classification model through a TF-IDF model created in advance based on a training set and a test set in the sample data and in combination with multiple machine learning algorithms; and performing risk level evaluation on the event logs in the test set according to the fusion classification model. According to the scheme ofthe invention, a TF-IDF model is combined with a plurality of machine learning algorithms to carry out risk level evaluation on the event logs, high-risk events in massive security event logs are intelligently identified, the identification accuracy of the event logs is greatly improved, the false alarm number of the high-risk events is reduced, the workload of auditors is reduced, the auditing efficiency is improved, and meanwhile, the auditing accuracy is also improved.

Description

technical field [0001] The present invention relates to the technical field of information processing, in particular to an event auditing method, device, terminal equipment and storage medium. Background technique [0002] Information security audit methods are usually based on specific rules to identify sensitive event logs, and cooperate with the naive Bayesian classification model to filter alarm events, filter out low suspicious alarm events, and display them to auditors through the security early warning platform for manual auditing . [0003] The prior art solution classifies and screens the alarm events through the naive Bayesian classification model. Since the model is single, the shortcomings of the naive Bayesian model will also be magnified. In theory, Naive Bayesian models have the smallest error rate compared to other classification methods. But this is not always the case in practice. In the case of a given output category of the Naive Bayesian model, it is a...

AI Technical Summary

Problems solved by technology

But this is not always the case in practice. In the case of a given output category of the Naive Bayesian model, it is assumed that the attributes are independent of each other. This assumption is often not true in practical applications. When the number of attributes is large or the attributes When the correlation is large, the classification effect is not good

Therefore, after screening using the Naive Bayesian classification model, auditors still need to manually audit the alarm events, which increases the workload of the auditors and reduces work efficiency

Images