Log identification method and device, electronic equipment and storage medium

Abstract

The invention provides a log identification method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining attack log information; the attack log information comprises a target IP address and a target rule identifier; obtaining first asset information aiming at the attack log information according to the target rule identifier; acquiring second asset information from an asset table corresponding to the monitored equipment according to the target IP address; and comparing the first asset information with the second asset information, and determining a target risk level corresponding to the attack log information according to a comparison result. According to the embodiment of the invention, the first asset information corresponding to the attack log information and the second asset information corresponding to the server are concerned, and the risk level corresponding to the attack log information is determined by comparing the first asset information with the second asset information, so that whether the attack log information is misreported or not can be automatically researched and judged; the study and judgment workload of security personnel is reduced, and the log recognition efficiency is improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular, to a log identification method, device, electronic equipment and storage medium. Background technique [0002] With the improvement of firewall functions, each functional module in the firewall will generate a lot of attack logs within a period of time, and the attack logs will contain some false positive logs. This is a false positive. [0003] At present, to confirm whether the firewall log is a real attack, security personnel with security knowledge need to conduct a manual investigation. First, understand which operating system or application software the attack log is targeted at, and then confirm the operating system or installation of the attacked host. Combining the information of the application software and the information of the two to confirm whether the attack is a false positive log. This requires high security knowledge of security personnel, and...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the embodiments of the present application is to provide a log identification method, device, electronic equipment, and storage medium to solve the time-consuming and labor-consuming problem of log identification in the prior art, thereby improving the efficiency of manual investigation

Images