Network threat detection method and system

Abstract

A network threat detection method is suitable for detection of network threats, and is characterized by comprising the following steps: S1, a system executes a network threat detection process, and then collects a current log file of the system and a current configuration file of the system; s2, processing according to the current configuration file of the system to obtain configuration change information of the system; s3, comparing the current log file of the system with the configuration change information: if the current log file of the system does not accord with the configuration change information, indicating that the configuration change is abnormal, and then returning to the step S1 to wait for the system to execute the next network threat detection process; and if yes, indicating that the configuration change is normal, and then returning to the step S1 to wait for the system to execute the next network threat detection process. Through an automatic processing method associated with logs and configuration, network threats can be effectively found, the safety of operation and maintenance can be improved, and baseline and standard management of configuration is enhanced.

Description

technical field [0001] The present invention relates to a network threat detection method and system, in particular to a network threat detection method and system based on log audit and configuration baseline correlation. Background technique [0002] In existing security products, audit logs are usually used to deal with network threats, and the audit logs are uniformly retained and archived for problem query and response audit; and the configuration is usually backed up for system disaster recovery and version Compare. There is no more in-depth utilization. [0003] Most of the existing technologies are judged based on the signature database of known attack methods. When the audit log does not match the signature database, the attack has caused substantial damage, business has been affected, and security incidents have occurred. The backup of the system configuration is only It is used for recovery after the system is attacked, and lacks the ability to respond in time. ...

AI Technical Summary

Problems solved by technology

[0003] Most of the existing technologies are judged based on the signature database of known attack methods. When the audit log does not match the signature database, the attack has caused substantial damage, business has been affected, and security incidents have occurred. The backup of the system configuration is only It is used for recovery after the system is attacked, and lacks the ability to respond in time

Images