Safety detection system and method based on log analysis

Abstract

The invention discloses a security detection system and method based on log analysis, and the system comprises a log collection module which is used for collecting log data of a network server; a logsending module which is used for carrying out real-time distribution and distributed offline storage and distribution on the log data; a real-time calculation module which is used for analyzing and calculating the log data distributed in real time according to a preset threat rule and storing a calculation result into a relational database; a threat rule base which is used for storing and managingthreat rules; an offline calculation module which is used for performing calculation processing on the distributed offline storage and distribution log data by utilizing machine learning to obtain anew threat rule, and updating the new threat rule into a threat rule base; and a result display module which is used for reading the calculation result from the relational database and displaying thecalculation result. The system and method have the advantages that the website threats are processed in time, the newly obtained threat rules are updated into the threat rule base, and the protectioncapacity for the network intrusion behaviors is further improved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a security detection system and method based on log analysis. Background technique [0002] At present, with the rapid development of the Internet, the complexity and importance of network security have become increasingly prominent. With the continuous occurrence of network attacks, the issue of network security has attracted more and more attention. [0003] In order to ensure the security of a network server, etc., it is generally necessary to perform network attack detection. For example, network attack detection for web servers can be mainly divided into pre-detection and post-event detection. Pre-detection is to identify network access behaviors with malicious behavior characteristics through preset security policies, so as to realize early warning of network intrusion behaviors. and blocking. Pre-testing mainly includes software testing and hardware testing...

AI Technical Summary

Problems solved by technology

[0004] However, neither the pre-event detection nor the post-event detection can meet the real-time detection and analysis of website threats, and there are defects of low processing efficiency and lack of timeliness; Continuously increasing, there is still the defect that the timeliness is getting worse

Images