System based on industrial network security event log monitoring

Abstract

A system based on industrial network security event log monitoring comprises an industrial network security event log acquisition module which is used for being connected with an industrial network and collecting log data generated during operation of the industrial network; an industrial network security event log temporary storage module which is in communication connection with the industrial network security event log acquisition module and is used for temporarily storing the log data acquired by the industrial network security event log acquisition module; a space occupation analysis module which is in communication connection with the industrial network security event log temporary storage module and is used for analyzing the space occupied by the log data; an analyzing and deploying module which is used for deploying computing power for analyzing the log data according to the space occupied by the log data; an analysis module; a dangerous event threshold alarm determining module; and an alarm module. According to the invention, an alarm can be given in time when it is monitored that a dangerous event endangers the industrial network, so that maintenance personnel can timely eliminate the dangerous event, and normal operation of the industrial network is guaranteed.

Description

technical field [0001] The invention relates to the technical field of information monitoring, in particular to a monitoring system based on industrial network security event logs. Background technique [0002] Industrial network refers to the installation in industrial [0003] It is an all-digital, two-way, multi-station communication system in the production environment, which is mainly divided into dedicated closed industrial network, open industrial network and standard industrial network. During the operation of the industrial network, a log that can indicate whether a security event has been encountered is generated. The log generally records the description of related operations such as date, time, user, and action. [0004] At present, in the field of industrial network security, there is a lack of a monitoring system for security event logs. After encountering a dangerous event that threatens security, the alarm cannot be issued in a timely and effective manner, w...

AI Technical Summary

Problems solved by technology

[0004] At present, in the field of industrial network security, there is a lack of a monitoring system for security event logs. After encountering a dangerous event that threatens security, the alarm cannot be issued in a timely and effective manner, which may easily lead to paralysis of the industrial network.

Images