Threat tracking method and device for log access relation and electronic equipment

Abstract

The invention discloses a threat tracking method and device for a log access relation, electronic equipment and a readable storage medium. The method comprises the following steps: obtaining an access relation query request, wherein the access relation query request comprises query targets and query types; if the query types comprise detail types, searching for detail data corresponding to the query targets from a detail database; and if the query types comprise form types, searching for form data corresponding to the query targets from a form database, wherein the form database stores form data corresponding to original access logs. According to the invention, the form database is used for storing the form data corresponding to each query target, and the search speed of log access relations is increased through storage of the form data; and the detail database is utilized to store the detail data corresponding to each query target, so that the latest log details can be quickly stored in the detail database. Therefore, real-time search of the latest data is realized on the premise of ensuring the search performance of the log access relations.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a method, device, electronic device and readable storage medium for threat tracing of log access relations. Background technique [0002] At present, the main purpose of the threat tracking system for log access relations is to discover threats in the logs by searching key information such as IP (Internet Protocol, Internet Protocol), URL (Uniform Resource Locator, Uniform Resource Locator) and domain names, and through Extended search to track the path of threat propagation; enabling people to vividly observe existing threats and their extended propagation path from the intricate logs. [0003] However, the threat tracking scheme of log access relationship in the prior art is often difficult to achieve second-level search response due to the huge amount of log data; and it is difficult to search for the latest data in real time under the premise of ensuring ...

AI Technical Summary

Problems solved by technology

[0003] However, the threat tracking scheme of log access relationship in the existing technology is often difficult to achieve second-level response of search due to the huge amount of log data; and it is difficult to search for the latest data in real time under the premise of ensuring search performance

Images