Data association analysis method, system and device and readable storage medium

Abstract

The invention discloses a data association analysis method, which comprises the steps of receiving a data association analysis request, and determining to-be-analyzed data and an association analysisrule according to the data association analysis request; loading the association analysis rule into a preset analysis engine, and calling the preset analysis engine to perform association analysis onthe to-be-analyzed data to obtain associated event data. According to the invention, the association analysis rule is loaded into the preset analysis engine and then a preset analysis engine is calledto perform association analysis on the to-be-analyzed data so that the user can configure the association analysis rule by himself / herself according to the service requirements, the expansibility ofthe association analysis system is improved, complex services are extracted, the architecture design of the association analysis system is not affected by service development and maintenance, and thedevelopment and test period of the association analysis process is shortened. The invention furthermore provides a data association analysis system and device, and a readable storage medium, which have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of correlation analysis, in particular to a method, system, device and readable storage medium for data correlation analysis. Background technique [0002] With the continuous expansion of network scale, network attacks and sabotage behaviors are becoming more and more frequent, and the network security situation is becoming increasingly severe. Although there are layers of protection from hardware to software in the network, in general, these measures alone still cannot accurately and timely discover various attacks launched by attack targets. Especially in a complex network environment, if an attacker has already obtained some information, it is easy to obtain more important information by forging or using a small amount of information to test. Many security events related to this behavior often have intricate logical relationships, but this kind of abnormal behavior is not easy to be detected by existing...

AI Technical Summary

Problems solved by technology

[0003] In the existing technology, the correlation analysis of security events is implemented by hard coding, resulting in serious interdependence between the underlying architecture and business logic, and the problems of long development and testing cycles and poor scalability

Images