Network space asset log association analysis system based on finite-state machine

Abstract

The invention relates to a network space asset log association analysis system based on a finite-state machine. Comprising a rule configuration module which is provided for a security administrator to configure association analysis rules, and the configured rules are stored in a database in a tree form; conditions and a knowledge base are built in, implementation of built-in basic sub-rules and a parameter dictionary are provided, and a user configures and combines the built-in conditions to form rules; the rule compiler is used for converting the tree-shaped rule configuration stored in the rule configuration module into a finite-state machine corresponding to the rule; the log event receiving module is used for providing the event in the cache as an input event to the task scheduler; the task scheduler is used for scheduling all finite-state machines for matching for each event in the cache, and outputting a matching result, namely a matching event list, to the alarm generation module; and the alarm generation module is used for receiving the matching event list in the task scheduler, extracting related attributes in the event according to the definition of the alarm, generating an alarm report and sending the alarm report to a security administrator.

Description

technical field [0001] The invention relates to the field of information security, in particular to a network space asset log association analysis system based on a finite state machine. Background technique [0002] In the prior art, the closest one is the association analysis system based on rule tree. (Association analysis device based on event classification and rule tree. Patent application number: 200920182619.3 Authorization announcement number: CN 201491020 U). [0003] Association analysis system based on rule tree, its modeling of rules is based on rule tree. The basic principle of the rule tree system is: first create an initial rule tree Tree0 and add it to the rule tree collection. This tree contains 3 tree nodes. The root node contains >> (followed by operator ID). The root node has two rule node children, rule A and rule B in that order. When event E1 matches rule A, it is necessary to copy an initial tree Tree1, add E1 to rule node A of Tree1, then ...

AI Technical Summary

Problems solved by technology

[0005] 1. Saving intermediate results requires copying the event instance in the rule node of the entire rule tree, and the cost of copying is relatively large

[0006] 2. Since the event flow is continuous, if there are many intermediate results, or the space occupied by the rule tree itself is relatively large, the storage overhead will be relatively large

[0007] 3. With the replication of the rule tree, there may be more and more trees in the rule tree collection, the time overhead of matching will become larger, and the delay of matching will be relatively high

Images