Log analysis method, device, equipment and storage medium

Abstract

The present application discloses a log analysis method, device, equipment and storage medium, which relates to the field of network security, including: obtaining the status information of the client in the preset database based on the service layer in the server, and judging whether the client is online; if so, sending a log collection instruction to the client to obtain the first log file sent by the client, and parsing it; comparing the event ID in the parsed first log file with the preset rule base, determining the first attack event corresponding to the first log file, and determining the associated client of the first log file through the first attack event; collecting the second attack event of the associated client, and determining the attack scenario through attack link aggregation. After determining the attack event through the parsed event ID, the associated client is determined, and then the attack scenario is obtained according to the attack events of all clients, so that the attack event can be automatically determined in a complex network environment for response, thereby improving the response efficiency of network security events.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a log analysis method, device, equipment and storage medium. Background Art

[0002] When responding to network security incidents, operation and maintenance personnel locate problems and solve network security incidents by collecting and analyzing server logs. However, in a complex network environment, network security incidents will involve more servers, and the number of servers that need to be analyzed will also increase. In this case, operation and maintenance personnel will not be able to quickly sort out network security incidents and quickly locate related hosts, resulting in confusion in the current internal network environment, lack of intelligence, etc., reducing the efficiency of emergency response, and causing network security incidents to cause greater losses to the victimized companies.

[0003] Although the existing technology can automatically collect log files according to the log storage path of the server, in the face of a complex network environment, the operation and maintenance personnel need to first analyze the known problem servers, and then rely on the analysis results and experience to determine the possible problem servers, and then repeat the log collection and analysis work, which greatly reduces the efficiency of the emergency response process and may cause analysis errors. Therefore, how to improve the efficiency of emergency response to network security incidents and improve the accuracy of emergency response is an urgent problem to be solved in this field. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a log analysis method, device, equipment and storage medium, which can determine the attack event through the parsed event ID and then determine the associated client, and then obtain the attack scenario based on the attack events of all clients, and can automatically determine the attack event in a complex network environment and respond to it, thereby improving the response efficiency of network security events. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a log analysis method, which is applied to a server, including:

[0006] Acquire, based on a preset service layer in the server, status information of a client corresponding to the server in a preset database, and determine, based on the status information of the client, whether the client is in an online state;

[0007] If yes, sending a log collection instruction to the client to obtain the first log file sent by the client, and performing file parsing based on the corresponding format of the first log file;

[0008] Comparing the parsed event ID in the first log file with a preset rule base to determine a first attack event corresponding to the first log file, and determining an associated client of the first log file through the first attack event;

[0009] A second log file of the associated client is collected and a corresponding second attack event is determined based on the second log file, and then a corresponding attack scenario is determined based on the first attack event and the second attack event and through attack link aggregation.

[0010] Optionally, before acquiring the status information of the client corresponding to the server in a preset database based on the preset service layer in the server, the method further includes:

[0011] Determining a log collection method based on a preset interface layer of the server;

[0012] If the log collection mode is automatic collection, the step of obtaining the status information of the client corresponding to the server in the preset database based on the preset service layer in the server is triggered.

[0013] Optionally, after determining the log collection method based on the preset interface layer of the server, the method further includes:

[0014] If the log collection method is automatic collection, the corresponding target client is determined by the IP address of the device to be monitored obtained in advance, so as to determine the target collection range of the automatic collection; the corresponding client is pre-installed on the device to be monitored;

[0015] Correspondingly, the acquiring, based on the preset service layer in the server, the status information of the client corresponding to the server in the preset database includes:

[0016] The status information of the target client corresponding to the target acquisition range in a preset database is obtained based on a preset service layer in the server.

[0017] Optionally, after determining the log collection method based on the preset interface layer of the server, the method further includes:

[0018] If the log collection method is manual upload, the third log file uploaded by the staff is directly received through a preset file receiving interface, so as to perform file parsing based on the corresponding format of the third log file.

[0019] Optionally, obtaining the first log file sent by the client includes:

[0020] A first log file sent by the client to the preset shared folder for storage is obtained from the preset shared folder.

[0021] Optionally, the performing file parsing based on a corresponding format of any of the log files includes:

[0022] Determining the file format of the log file based on the file suffix of the log file;

[0023] If the file format of the log file is a compressed package format, decompress the log file to obtain an evtx log file, and perform file parsing on the evtx log file;

[0024] If the file format of the log file is evtx format, the log file is directly parsed.

[0025] Optionally, comparing the parsed event ID in the first log file with a preset rule base to determine the first attack event corresponding to the first log file includes:

[0026] Determine the attack behavior corresponding to the first log file according to the event ID in the first log file based on a preset rule base;

[0027] The first log file is analyzed based on the attack condition corresponding to the attack behavior to obtain a first attack event corresponding to the first log file.

[0028] In a second aspect, the present application provides a log analysis device, which is applied to a server, including:

[0029] A status determination module, configured to obtain status information of a client corresponding to the server in a preset database based on a preset service layer in the server, and determine whether the client is online based on the status information of the client;

[0030] A file parsing module, configured to, if yes, send a log collection instruction to the client to obtain a first log file sent by the client, and perform file parsing based on a corresponding format of the first log file;

[0031] A client determination module, configured to compare the event ID in the first log file parsed with a preset rule base, determine a first attack event corresponding to the first log file, and determine an associated client of the first log file through the first attack event;

[0032] A scene restoration module is used to collect the second log file of the associated client and determine the corresponding second attack event based on the second log file, and then determine the corresponding attack scene based on the first attack event and the second attack event and through attack link aggregation.

[0033] In a third aspect, the present application provides an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the aforementioned log analysis method.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which implements the aforementioned log analysis method when executed by a processor.

[0035] In the present application, first, based on the preset service layer in the server, the status information of the client corresponding to the server in the preset database is obtained, and based on the status information of the client, it is determined whether the client is online; if the client is online, a log collection instruction is sent to the client to obtain the first log file sent by the client, and the file is parsed based on the corresponding format of the first log file; then the event ID in the parsed first log file is compared with the preset rule library to determine the first attack event corresponding to the first log file, and the associated client of the first log file is determined through the first attack event; the second log file of the associated client is collected and the corresponding second attack event is determined based on the second log file, and then the corresponding attack scenario is determined based on the first attack event and the second attack event and through attack link aggregation. It can be seen that through the above technical solution, the present application can determine the corresponding attack event by parsing the event ID in the log file of the corresponding client through the server, and determine the associated client according to the current attack event, and then automatically restore the attack scenario according to the first attack event and the second attack event of the associated client. In this way, in a complex network environment, the current attack event can be determined first and then analyzed in a point-to-surface manner, and possible attack events of other associated clients can be obtained for response, which can ensure that the obtained network security event analysis results are more comprehensive and accurate, avoiding the problems of inefficiency and error-prone results that may be caused by manual analysis of log files by operation and maintenance personnel, thereby improving the response efficiency of network security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flow chart of a log analysis method provided for this application;

[0038] Figure 2 A specific log analysis method flow chart provided for this application;

[0039] Figure 3 An example of log file content provided for this application;

[0040] Figure 4 A specific log analysis method flow chart provided for this application;

[0041] Figure 5 A specific log analysis module flow chart provided for this application;

[0042] Figure 6 A communication flow chart between the agent and the server provided for this application;

[0043] Figure 7 A schematic diagram of the structure of a log analysis device provided in this application;

[0044] Figure 8 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Network security incidents in complex network environments may involve many servers, and operation and maintenance personnel cannot quickly sort out and locate related hosts, resulting in low emergency response efficiency. Although the existing technology can automatically collect log files, it still requires operation and maintenance personnel to analyze known problem servers and judge other problem servers based on the analysis results. The present application discloses a method for automatically extracting and analyzing host logs for Windows servers. The method can determine the attack event through the parsed event ID and then determine the related client, and then obtain the attack scenario based on the attack events of all clients. The method can automatically determine the attack event in a complex network environment and respond to it, thereby improving the response efficiency of network security incidents.

[0047] See also Figure 1 As shown, an embodiment of the present invention discloses a log analysis method, which is applied to a server, including:

[0048] Step S11: obtaining status information of a client corresponding to the server in a preset database based on a preset service layer in the server, and determining whether the client is online based on the status information of the client.

[0049] It should be pointed out that the log analysis method disclosed in this embodiment is divided into a server and an agent, that is, a server and a client, and the client can be run on the device to be monitored. For example, the client running on the server corresponding to the server is used as the client corresponding to the server. In this embodiment, firstly, the status information of the client in the preset database is obtained based on the preset service layer in the server, and it is determined whether the client is online based on the status information of the client.

[0050] like Figure 2 As shown, the server is divided into an interface layer and a service layer. The preset service layer is used to process, analyze and link the log file with the agent. The preset service layer is developed in Go language and can be divided into two modules: a log analysis module and an analysis result processing module. The server can obtain the status information of the client in the preset database through the log analysis module in the service layer to judge the status of the client. It can be understood that the agent is deployed together with the server, and the deployment object is all Windows system servers or personal hosts in the current network environment. After the deployment is completed, the communication with the server is completed, and the local status information, that is, the client status information, including system version, IP address, process, service and other information is sent to the server, so that the server receives the information sent by the client and saves it in the preset database, and judges whether the client is online based on the client status information in the preset database to perform the next operation. By deploying the server together with the agent when deploying, and sending the client status information to the server and saving it in the preset database, it is convenient for the subsequent server to directly call the status information in the preset database, which can improve the efficiency of confirming the client status before log collection.

[0051] Step S12: If yes, send a log collection instruction to the client to obtain a first log file sent by the client, and perform file parsing based on a corresponding format of the first log file.

[0052] In this embodiment, when the agent is online, the server sends a log collection instruction to it to obtain the first log file sent by the agent. It can be understood that the agent has a built-in instruction receiving function, and after receiving the log collection instruction from the server, it starts to execute on the current server where the agent is located, that is, the device to be monitored. After receiving the log file, the log analysis module of the server needs to first determine the format of the received log file, and select the corresponding parsing strategy based on the corresponding format of the first log file to perform file parsing, such as Figure 3As shown, the log analysis module uses the elastic / beats module in the Go language to call wevtapi.dll to analyze and extract fields from the log file based on the event ID, recorded event, process ID, thread ID, destination address, source address and other information in the log file.

[0053] Step S13: Compare the parsed event ID in the first log file with a preset rule base to determine a first attack event corresponding to the first log file, and determine an associated client of the first log file through the first attack event.

[0054] In this embodiment, the event ID in the parsed first log file is compared with a preset rule base, which integrates event IDs and their corresponding system event behaviors, as well as possible attack behavior rules. The first attack event corresponding to the first log file is determined by comparison, and the associated client of the first log file is determined by the first attack event. For example, after a log in the first log file matches the corresponding system event behavior or attack behavior, the destination address, source address, and event field in the log are extracted, and other servers associated with this log are searched, so as to extract logs from the associated servers and perform the analysis process again. In this way, the associated server is found through the system event behavior or attack behavior corresponding to the log, avoiding errors that may be caused by manual associated server search, and improving the speed of log file analysis.

[0055] Step S14: collecting a second log file of the associated client and determining a corresponding second attack event based on the second log file, and then determining a corresponding attack scenario based on the first attack event and the second attack event and through attack link aggregation.

[0056] In this embodiment, after determining the associated server, the second log file of the associated client is collected and the corresponding second attack event is determined based on the second log file. The steps for determining the second attack event are the same as the steps for determining the first attack event, and will not be described in detail here. Figure 2 As shown in the figure, after the log analysis module outputs the analysis results, it enters the analysis result processing module of the service layer. In this module, the attack link aggregation is first performed for the attack event in combination with the analysis results of the associated assets, that is, the associated clients, and the attack scenario is restored after aggregation. By analyzing the log files of the associated servers and combining the analysis results of multiple clients that may have network attacks, the response accuracy of network security events is improved.

[0057] like Figure 2As shown, through the above technical solution, in this embodiment, firstly, the status information of the client corresponding to the server in the preset database is obtained based on the preset service layer in the server, and whether the client is online is determined based on the status information of the client; if the client is online, a log collection instruction is sent to the client to obtain the first log file sent by the client, and the file is parsed based on the corresponding format of the first log file; then the event ID in the parsed first log file is compared with the preset rule library to determine the first attack event corresponding to the first log file, and the associated client of the first log file is determined through the first attack event; the second log file of the associated client is collected and the corresponding second attack event is determined based on the second log file, and then the corresponding attack scenario is determined based on the first attack event and the second attack event and through attack link aggregation. It can be seen that through the above technical solution, the present application can determine the corresponding attack event by parsing the event ID in the log file of the corresponding client through the server, and determine the associated client according to the current attack event, and then automatically restore the attack scenario according to the first attack event and the second attack event of the associated client. In this way, in a complex network environment, through a point-to-surface approach, the current attack event can be first determined and then analyzed, and possible attack events of other associated clients can be obtained for response, which can ensure that the obtained network security event analysis results are more comprehensive and accurate, and improve the response efficiency of network security events.

[0058] Based on the previous embodiment, it can be seen that the present application can automatically collect log files and determine the attack events associated with the server after parsing them. Next, the present embodiment will elaborate on the process of log collection and log file parsing in detail. Figure 4 As shown, the embodiment of the present application discloses a specific log analysis method, which is applied to the server, including:

[0059] Step S21: determine the log collection method based on the preset interface layer of the server.

[0060] Based on the previous embodiment, it can be known that the server is divided into an interface layer and a service layer. The interface layer is the front-end Web page function area. The Vue framework is used as the front-end development framework. Through the Vue framework, the interface layer has the advantages of lightweight, two-way data binding, componentization, and fast running speed, and a task management-style Web front-end application can be constructed. In this embodiment, the log collection method can be determined by presetting the interface layer. The interface layer is specifically used for task management, log collection, and result display. The task management includes the functions of creating tasks, project personnel management, and progress synchronization display; the log collection is divided into two modes: automatic collection and manual upload; the result display function is used to form a complete attack scenario analysis diagram at the interface layer after the log analysis task is completed, including specific events, time, operation, source\destination IP and other information. In this way, the response results of network security time can be intuitively displayed, which is conducive to the operation and maintenance personnel to obtain analysis results more conveniently and quickly.

[0061] Step S22: If the log collection mode is automatic collection, the status information of the client corresponding to the server in the preset database is obtained based on the preset service layer in the server, and whether the client is online is determined based on the status information of the client.

[0062] In this embodiment, Figure 5 As shown, after the interface layer of the server creates a log analysis task and sets relevant parameters, it is necessary to determine the log collection method. In a specific embodiment, if the log collection method is automatic collection, it is necessary to specify the collection target range, which can be a single server or multiple servers, and correspond through the server IP address. The corresponding target client can be determined by the pre-acquired IP address of the device to be monitored to determine the target collection range of the automatic collection. It is understandable that the corresponding client is pre-installed on the device to be monitored. Then correspondingly, the status information of the client corresponding to the server in the preset database based on the preset service layer in the server includes: obtaining the status information of the target client corresponding to the target collection range in the preset database based on the preset service layer in the server.

[0063] In another specific embodiment, if the log collection method is manual upload, the third log file uploaded by the staff is directly received through a preset file receiving interface, and the file is parsed based on the corresponding format of the third log file. By setting a variety of log collection methods, it is more convenient to select the corresponding method for log collection in different situations, thereby improving the stability of network security incident response.

[0064] Step S23: If yes, a log collection instruction is sent to the client to obtain, from a preset shared folder, a first log file sent by the client to the preset shared folder for storage, and perform file parsing on the first log file.

[0065] In this embodiment, if the log collection method is automatic collection, the server sends a log collection instruction to the agent through the interface layer when the agent is online. It can be understood that in this process, the agent has a built-in instruction receiving function, and starts executing on the current server after receiving the instruction from the server. When the log file collection is completed, the agent uses the Windows file sharing function during file transfer to upload the log files to a preset shared folder for the server to obtain. In this way, in the internal network environment of an enterprise or unit, the use of the file sharing function that comes with Windows can ensure the stability and reliability of the entire file transfer process.

[0066] It can be understood that in step S22, if the log collection method selected is manual upload, log files of various formats may be obtained, so the file format of the log file can be judged based on the file suffix of the log file; if the file format of the log file is a compressed package format, the log file is decompressed to obtain an evtx log file, and the evtx log file is parsed; if the file format of the log file is an evtx format, the log file is directly parsed.

[0067] Step S24: determine the attack behavior corresponding to the first log file according to the event ID in the first log file based on a preset rule base, analyze the first log file based on the attack condition corresponding to the attack behavior, obtain the first attack event corresponding to the first log file, and then determine the associated client of the first log file through the first attack event.

[0068] In this embodiment, after parsing the log file, a preliminary match is performed on the corresponding event ID and possible attack behavior based on a rule library constructed based on rules pre-collected and organized in the system. After matching the corresponding attack behavior, the attack conditions required for different attack behaviors are further matched and analyzed, and then a comprehensive analysis and judgment is performed in combination with the log context to ultimately obtain a more accurate analysis result. In this way, the accuracy of the log analysis results can be improved.

[0069] Step S25: collecting the second log file of the associated client and determining a corresponding second attack event based on the second log file, and then determining a corresponding attack scenario based on the first attack event and the second attack event and through attack link aggregation.

[0070] For a more specific processing procedure of the above step S25, reference may be made to the corresponding contents disclosed in the above embodiments, which will not be described in detail here.

[0071] Through the above technical solution, such as Figure 5 , Figure 6 As shown, in this embodiment, the agent end saves its own status information to the preset database when it is deployed. When the server end determines that the agent end is online by obtaining the status information in the preset database, the log analysis module sends a log collection instruction so that the agent end uploads the log file to the preset shared folder. Then the server end determines the attack behavior corresponding to the first log file according to the event ID in the first log file based on the preset rule library, and analyzes the first log file based on the attack condition corresponding to the attack behavior to obtain the first attack event corresponding to the first log file, and then determines the associated client of the first log file through the first attack event, and further restores the attack scene. In this way, an emergency response system with a dual-end working mode of the server end and the agent end is constructed, which facilitates file transmission between the log file server end and the agent end, improves the speed of log analysis, and further determines the attack event after determining the associated client, which can improve the accuracy of the log analysis result.

[0072] See also Figure 7 As shown, the embodiment of the present application also discloses a log analysis device, which is applied to the server, including:

[0073] A status determination module 11 is used to obtain status information of a client corresponding to the server in a preset database based on a preset service layer in the server, and determine whether the client is online based on the status information of the client;

[0074] A file parsing module 12, configured to, if yes, send a log collection instruction to the client to obtain a first log file sent by the client, and perform file parsing based on a corresponding format of the first log file;

[0075] The client determination module 13 is used to compare the event ID in the first log file parsed with a preset rule base to determine the first attack event corresponding to the first log file, and determine the associated client of the first log file through the first attack event;

[0076] The scene restoration module 14 is used to collect the second log file of the associated client and determine the corresponding second attack event based on the second log file, and then determine the corresponding attack scene based on the first attack event and the second attack event and through attack link aggregation.

[0077] In this embodiment, firstly, based on the preset service layer in the server, the status information of the client corresponding to the server in the preset database is obtained, and based on the status information of the client, it is determined whether the client is online; if the client is online, a log collection instruction is sent to the client to obtain the first log file sent by the client, and the file is parsed based on the corresponding format of the first log file; then the event ID in the parsed first log file is compared with the preset rule library to determine the first attack event corresponding to the first log file, and the associated client of the first log file is determined through the first attack event; the second log file of the associated client is collected and the corresponding second attack event is determined based on the second log file, and then the corresponding attack scenario is determined based on the first attack event and the second attack event and through the attack link aggregation. It can be seen that in this embodiment, the event ID in the log file of the corresponding client can be parsed by the server to determine the corresponding attack event, and the associated client can be determined according to the current attack event, and then the attack scenario can be automatically restored according to the first attack event and the second attack event of the associated client. In this way, in a complex network environment, the current attack event can be determined first and then analyzed in a point-to-surface manner, and the possible attack events of other associated clients can be obtained for response, which can ensure that the obtained network security event analysis results are more comprehensive and accurate, and improve the response efficiency of network security events.

[0078] In some specific embodiments, the state determination module 11 further includes:

[0079] A collection mode determination submodule, used to determine the log collection mode based on the preset interface layer of the server;

[0080] The information acquisition trigger unit is used to trigger the step of acquiring the status information of the client corresponding to the server in the preset database based on the preset service layer in the server if the log collection mode is automatic collection.

[0081] In some specific embodiments, the acquisition mode determination submodule further includes:

[0082] A range determination unit, for determining a corresponding target client by using a pre-acquired IP address of the device to be monitored to determine a target collection range of the automatic collection if the log collection mode is automatic collection; the device to be monitored has a corresponding client pre-installed thereon;

[0083] Accordingly, the state determination module 11 specifically includes:

[0084] The information acquisition unit is used to acquire the status information of the target client corresponding to the target collection range in a preset database based on the preset service layer in the server.

[0085] In some specific embodiments, the acquisition mode determination submodule further includes:

[0086] The file receiving unit is used to directly receive the third log file uploaded by the staff through a preset file receiving interface if the log collection method is manual upload, so as to perform file parsing based on the corresponding format of the third log file.

[0087] In some specific embodiments, the file parsing module 12 specifically includes:

[0088] The file acquisition unit is used to acquire, from a preset shared folder, a first log file sent by the client to the preset shared folder for storage.

[0089] In some specific embodiments, the file parsing module 12 specifically includes:

[0090] A format determination unit, configured to determine the file format of the log file based on a file suffix of the log file;

[0091] A first file parsing unit, configured to decompress the log file to obtain an evtx log file if the file format of the log file is a compressed package format, and perform file parsing on the evtx log file;

[0092] The second file parsing unit is used to directly parse the log file if the file format of the log file is evtx format.

[0093] In some specific embodiments, the client determination module 13 specifically includes:

[0094] an attack behavior determination unit, configured to determine the attack behavior corresponding to the first log file according to the event ID in the first log file based on a preset rule base;

[0095] The attack event determination unit is used to analyze the first log file based on the attack condition corresponding to the attack behavior to obtain a first attack event corresponding to the first log file.

[0096] Furthermore, the present application also discloses an electronic device. Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0097] Figure 8A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the log analysis method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0098] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0099] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0100] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the log analysis method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0101] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed log analysis method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0102] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0103] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0104] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0105] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0106] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A log analysis method, characterized in that: Applied to the server, including: Acquire, based on a preset service layer in the server, status information of a client corresponding to the server in a preset database, and determine, based on the status information of the client, whether the client is in an online state; If yes, sending a log collection instruction to the client to obtain the first log file sent by the client, and performing file parsing based on the corresponding format of the first log file; Comparing the parsed event ID in the first log file with a preset rule base to determine a first attack event corresponding to the first log file, and determining an associated client of the first log file through the first attack event; A second log file of the associated client is collected and a corresponding second attack event is determined based on the second log file, and then a corresponding attack scenario is determined based on the first attack event and the second attack event and through attack link aggregation.

2. The log analysis method according to claim 1, characterized in that: Before acquiring the status information of the client corresponding to the server in the preset database based on the preset service layer in the server, the method further includes: Determining a log collection method based on a preset interface layer of the server; If the log collection mode is automatic collection, the step of obtaining the status information of the client corresponding to the server in the preset database based on the preset service layer in the server is triggered.

3. The log analysis method according to claim 2, characterized in that: After determining the log collection method based on the preset interface layer of the server, the method further includes: If the log collection method is automatic collection, the corresponding target client is determined by the IP address of the device to be monitored obtained in advance, so as to determine the target collection range of the automatic collection; the corresponding client is pre-installed on the device to be monitored; Correspondingly, the acquiring, based on the preset service layer in the server, the status information of the client corresponding to the server in the preset database includes: The status information of the target client corresponding to the target acquisition range in a preset database is obtained based on a preset service layer in the server.

4. The log analysis method according to claim 2, characterized in that: After determining the log collection method based on the preset interface layer of the server, the method further includes: If the log collection method is manual upload, the third log file uploaded by the staff is directly received through a preset file receiving interface, so as to perform file parsing based on the corresponding format of the third log file.

5. The log analysis method according to claim 1, characterized in that: The obtaining of the first log file sent by the client includes: A first log file sent by the client to the preset shared folder for storage is obtained from the preset shared folder.

6. The log analysis method according to any one of claims 1 to 5, characterized in that: The performing file parsing based on the corresponding format of the first log file includes: Determining a file format of the first log file based on a file suffix of the first log file; If the file format of the first log file is a compressed package format, decompress the first log file to obtain an evtx log file, and perform file parsing on the evtx log file; If the file format of the first log file is evtx format, the first log file is directly parsed.

7. The log analysis method according to any one of claims 1 to 5, characterized in that: The comparing the parsed event ID in the first log file with a preset rule base to determine the first attack event corresponding to the first log file includes: Determine the attack behavior corresponding to the first log file according to the event ID in the first log file based on a preset rule base; The first log file is analyzed based on the attack condition corresponding to the attack behavior to obtain a first attack event corresponding to the first log file.

8. A log analysis device, characterized in that: Applied to the server, including: A status determination module, configured to obtain status information of a client corresponding to the server in a preset database based on a preset service layer in the server, and determine whether the client is online based on the status information of the client; A file parsing module, configured to, if yes, send a log collection instruction to the client to obtain a first log file sent by the client, and perform file parsing based on a corresponding format of the first log file; A client determination module, configured to compare the event ID in the first log file parsed with a preset rule base, determine a first attack event corresponding to the first log file, and determine an associated client of the first log file through the first attack event; A scene restoration module is used to collect the second log file of the associated client and determine the corresponding second attack event based on the second log file, and then determine the corresponding attack scene based on the first attack event and the second attack event and through attack link aggregation.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the log analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the log analysis method according to any one of claims 1 to 7.

Images