Alarm method and device thereof

Abstract

The invention discloses an alarm method and a device thereof, which are used for solving the problem that an alarm cannot be given in time when a server is subjected to security threat in the prior art. The warning method comprises the following steps: obtaining access logs of a plurality of servers and monitoring logs of a plurality of monitoring devices from a log database, using the plurality of monitoring devices for monitoring whether the plurality of servers are threatened by security, wherein the access log comprises access IPs and access timestamps of access devices accessing a plurality of servers, the monitoring log comprises monitored alarm IPs and alarm timestamps of the access devices generating security threats to the plurality of servers, and the access log and the monitoring log are logs after unified formatting; performing association analysis on the access log and the monitoring log, determining whether a target IP exists or not, wherein the access timestamp corresponding to the target IP in the access log is the same as the alarm timestamp corresponding to the target IP in the monitoring log; and if the target IP exists, performing threat alarm based on the target IP. Therefore, timely alarming can be realized and alarming accuracy is high.

Description

technical field [0001] The present application relates to the field of computer technology, in particular to an alarm method and device. Background technique [0002] During the process of the server providing external services, a monitoring device can be used to monitor whether the server is threatened by security. Usually, multiple monitoring devices (such as firewalls and threat intelligence devices) can be used to monitor the server, and when it is determined that the server is under security threats according to the monitoring results, a security alarm is given to the server. [0003] However, in practical applications, the monitoring results of different monitoring devices may be inconsistent, resulting in inaccurate monitoring results for the server. In order to improve the accuracy, at present, the staff usually analyze the logs of the server and monitoring equipment, so as to determine whether the server is threatened by security according to the analysis results. ...

AI Technical Summary

Problems solved by technology

[0004] The embodiment of the present application provides an alarm method to solve the problem in the prior art that the server cannot be alarmed in time when the server is threatened by security

[0005] The embodiment of the present application also provides an alarm device to solve the problem in the prior art that the server cannot be alarmed in time when the server is threatened by security

Images