Network security management method and device based on firewall log and medium

Abstract

The invention discloses a network security management method and device based on a firewall log, and a medium. The method comprises the following steps: acquiring flow log data and threat log data of a firewall from an HDFS (Hadoop Distributed File System); based on Hive, performing multi-dimensional static analysis on the historical traffic log data through Spark SQL, and determining a first analysis result; based on Kafka, in a preset time interval, performing multi-dimensional dynamic analysis on the online traffic log data through Spark Streaming, and determining a second analysis result; performing risk analysis on the threat log data through a set multi-classification SVM model to determine a third analysis result; and performing security management on the network of the firewall according to the first analysis result, the second analysis result and the third analysis result. When network security management is carried out through firewall logs, a log analysis platform of a Spark distributed memory computing framework is constructed, and in combination with technical components such as Hive, Spark Streaming and Kafka, processing of massive log data can be efficiently completed, and the network security management efficiency is improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a firewall log-based network security management method, equipment and media. Background technique [0002] With the advent of global informatization, a large number of enterprises and institutions are building their own networks to share network resources. The network plays an important role in the information society, but frequent network security issues cannot be ignored. [0003] The firewall isolates the LAN and the external network, can identify and shield illegal requests from the outside world, and prevent unauthorized data access. The firewall system can strengthen the security of the network, so as to simplify the security management of the LAN. [0004] However, the firewall has a powerful log function, which can view communication behaviors and check security holes in the network. However, the number of logs generated by the firewall grows too fas...

AI Technical Summary

Problems solved by technology

[0005] The embodiment of the present application provides a firewall log-based network security management method, equipment, and media, which are used to solve the problem that the number of logs generated by the firewall grows too fast, and the processing of massive log data cannot be efficiently completed, resulting in low efficiency of network security management. question

Images