Network situational awareness method and system based on information collection of various network devices

Abstract

The invention discloses a network situation awareness method and system based on information collection of various network devices, including: collecting log data based on various network devices, and performing log information filtering, normalization and merging processing; atomic event flow formed based on log data Perform complex event query tasks and complex event monitoring and alarm tasks. The complex event query tasks are used to query and detect the occurrence of complex scene events. Prediction and alarm of events; perform secondary statistical analysis on data processed by complex event query tasks and complex event monitoring and alarm tasks. The present invention collects multi-dimensional information from various network resources and performs association of multiple events through complex event processing technology Analyze and detect threats and abnormal behaviors in the network in time to achieve network situation awareness, remind users of possible abnormalities, and proactively troubleshoot.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network situational awareness method and system based on the collection of various network device information. Background technique [0002] With the development of informatization construction, the number of network devices used as informatization bearers continues to increase, and the management of network devices has gradually attracted attention. From the initial manual management and decentralized management, the status of the entire network and the status of each part cannot be grasped in a timely manner, and the network equipment software cannot be managed effectively; it has developed to the unified centralized management and control of software to timely detect equipment and network status abnormalities, so that The overall network management transitions from passive disorder to active observation, which can comprehensively and accurately grasp the running sta...

AI Technical Summary

Problems solved by technology

From the initial manual management and decentralized management, it is impossible to grasp the status of the whole network and the status of each part in a timely manner, and it cannot effectively manage the software of network equipment; it has developed to the way of unified and centralized management and control of software to detect abnormal equipment and network status in time, so that The overall network management transitions from passive and disorderly to active observation, and can comprehensively and accurately grasp the operation status of the entire network in a timely manner

Images