Network security log alarm processing method based on big data analysis technology

Abstract

The invention provides a network security log alarm processing method based on a big data analysis technology, and the method comprises the steps: obtaining standardized log data with a uniform format through an automatic analysis engine, filtering useless and meaningless logs through a log filtering rule, and then converting the logs into security alarm events through a network attack event classification rule. Then associated alarm events in a certain time range are combined through an alarm rule and an association analysis algorithm, so that repeated alarms are effectively de-duplicated, the repeated occurrence frequency is recorded, and the analysis quality of the alarm events is improved. According to the method, a set of visual, reliable and stable network security log analysis method is established, collected network security log data is subjected to normal form analysis processing in a simple, convenient and rapid mode, log data with unified log attributes are generated, then alarm events generated by logs are subjected to duplicate removal and merging processing, the network security detection efficiency is effectively improved, false alarm and repetition of alarms are reduced, and therefore the pressure of alarm analysis processing is relieved.

Description

technical field [0001] The invention relates to the technical field of electric power information systems, in particular to a network security log alarm processing method based on big data analysis technology. Background technique [0002] In recent years, information network security incidents have occurred frequently, and the security situation has become increasingly severe. With the expansion of network boundaries and the increase of network security devices, the log data generated by various network security devices has grown rapidly, and a large number of log events requires security operation and maintenance personnel. Identify and process, which contains many duplicate logs and invalid junk logs, and different security vendors have different attack signature databases, and adopt different monitoring and alarm strategies. In order to improve the overall perception of network security, we can only reduce The alarm threshold causes many attack alarms to be falsely repor...

AI Technical Summary

Problems solved by technology

[0008] The present invention provides a network security log alarm processing method based on big data analysis technology, which is used to solve the problem in the prior art that due to the large number and types of network security logs, the generated alarm event messages cannot be processed in a timely and efficient manner

Images