Network situation awareness method and network situation awareness system based on information acquisition of various network devices

Abstract

The invention discloses a network situation awareness method and system based on information collection of multiple network devices, and the method comprises the steps: collecting log data based on the multiple network devices, and carrying out the filtering, paradigm and merging of log information; performing a complex event query task and a complex event monitoring alarm task based on the atomicevent flow formed by the log data, wherein the complex event query task is used for querying and detecting an occurrence situation of a complex scene event, and the complex event monitoring task is used for fusing various associated events in a complex event scene and predicting and alarming causal associated events; and performing secondary statistical analysis on data processed by complex eventquery task and complex event monitoring alarm task; according to the invention, multi-dimensional information acquisition of a plurality of network resources is carried out and multi-event association analysis is carried out by using a complex event processing technology, threats and abnormal behaviors in the network are discovered in time, so that network situation awareness is achieved, and a user is reminded of possible abnormal active troubleshooting.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network situation awareness method and system based on information collection of various network devices. Background technique [0002] With the development of informatization construction, the number of network devices serving as informatization bearers continues to increase, and the management of network devices has gradually attracted attention. From the initial manual management and decentralized management, it is impossible to grasp the status of the whole network and the status of each part in a timely manner, and it cannot effectively manage the software of network equipment; it has developed to the way of unified and centralized management and control of software to detect abnormal equipment and network status in time, so that The overall network management transitions from passive disorder to active observation, and can grasp the operation status of the entire...

AI Technical Summary

Problems solved by technology

From the initial manual management and decentralized management, it is impossible to grasp the status of the whole network and the status of each part in a timely manner, and it cannot effectively manage the software of network equipment; it has developed to the way of unified and centralized management and control of software to detect abnormal equipment and network status in time, so that The overall network management transitions from passive and disorderly to active observation, and can comprehensively and accurately grasp the operation status of the entire network in a timely manner

Images