Rapid association classification and hierarchical storage method for network security logs

Abstract

The invention discloses a rapid association classification and hierarchical storage method for network security logs, which comprises the following steps: defining an XML (Extensible Markup Language) format log template according to different application metadata, the log template comprising alarm log information, association flow log information, application metadata log information, message log information and file attachment log information; associating the alarm logs, the associated flow logs, the application metadata logs, the message logs and the file attachment logs together through flow and transaction information in the logs, wherein each alarm log outputs a complete log; performing hierarchical storage mechanism output on logs, including values in alarm log information, associated flow log information, application metadata log information, message log information and file attachment log information; the hierarchical storage mechanism adopts two levels, the first level adopts a memory file system, and the second level adopts an SSD / HD storage system with RAID. According to the technical scheme, the performance problem of Json log format output is solved.

Description

technical field [0001] The invention relates to the technical field of data communication, in particular to a method for fast associative classification and hierarchical storage of network security logs. Background technique [0002] In the field of network security, when network security devices such as IPS / IDS devices analyze the access traffic of the existing network, they can conduct in-depth analysis of the traffic according to the security detection rules issued by the device, and find existing attack behaviors, abnormal logins, and intrusions. Behavior and other behaviors, and then record the related alarm information, flow information, application information, packet information, attachments and other information of these behaviors through the device's own log system for later log auditing system query or forensics. [0003] There are many log output methods in IPS / IDS devices, such as outputting to Syslog, outputting to Redis, and outputting to log files, among whic...

AI Technical Summary

Problems solved by technology

[0009] The main purpose of the present invention is to propose a fast association classification and hierarchical storage method of network security logs, aiming to solve the performance problem of Json log format output

Images