Network security statistical analysis system and method based on multi-structure data

Abstract

The invention discloses a network security statistical analysis system and method based on multi-structure data. The system comprises a data resource layer and a network security monitoring platform, the data resource layer is used for monitoring and sorting key data of an information system and equipment, opening a data channel and determining a data source; the network security monitoring platform comprises a data collection layer, a data analysis layer, an event processing layer and an event display layer. According to the invention, the multi-structure data is acquired through the data resource layer and the data collection layer, and the multi-structure data is analyzed through the data analysis layer, so that network security risks existing in an information system can be found from a multi-dimensional perspective, network security risks existing in a deep layer can be found, and the security is high; the event processing layer carries out event processing according to the event processing rule, so that false alarm is avoided, manpower work is greatly saved, and the network safety working efficiency is high; the event display layer can display the processing state of each layer and update information in real time through the timestamp module, so that the timeliness is high.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security statistical analysis, and in particular relates to a network security statistical analysis system and method based on multi-structured data. Background Art

[0002] With the rapid development of informatization, IT assets, business systems, and auxiliary systems have expanded rapidly, and data has also shown a geometric growth. Coupled with the complexity of the system, it has brought great pressure to network security work. The common network security monitoring method now is to monitor network traffic by deploying various security and confidentiality products, and then regularly check the log processes of various security products to determine whether there are network security vulnerabilities in the information system. However, in this mode, the data of various security products are isolated from each other, and data sharing and correlation analysis cannot be achieved. Therefore, it is impossible to timely discover deeper network security problems in the information system. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a network security statistical analysis system and method based on multi-structure data.

[0004] The present invention is achieved through the following technical solutions.

[0005] The present invention provides a network security statistical analysis system based on multi-structure data, including a data resource layer and a network security monitoring platform;

[0006] The data resource layer is used to monitor and sort out key data of information systems and equipment, open up data channels, and determine data sources;

[0007] The network security monitoring platform includes a data collection layer, a data analysis layer, an event processing layer and an event display layer;

[0008] The data collection layer is used to obtain security data through data sources;

[0009] The data analysis layer is used to analyze security data and obtain security events;

[0010] The event processing layer is used to configure event processing rules, process security events, and obtain and push security events to be processed;

[0011] The event display layer is used to centrally display information of the data resource layer, data collection layer, data analysis layer and event processing layer.

[0012] Preferably, the data resource layer includes network monitoring, server monitoring, database monitoring, application system monitoring and middleware monitoring;

[0013] The key data of the information systems and devices include network security logs, traffic, and actor audit logs;

[0014] The data channel is opened by directly reading the database or sending the log.

[0015] Preferably, the obtaining of security data through a data source specifically refers to: using a technical approach of SQL extraction or syslog active sending to collect data from a data source and obtain security data.

[0016] Preferably, the data sources include security and confidentiality products, network equipment, operating systems, applications and middleware.

[0017] Preferably, the security and confidentiality products include intrusion detection systems, vulnerability scanning systems, host monitoring and auditing systems, and security systems;

[0018] The network equipment includes switches, routers and firewalls;

[0019] The operating system includes server and desktop operating systems;

[0020] The applications include web applications and databases;

[0021] The security data includes security and confidentiality product logs, network equipment logs, operating system logs and application logs.

[0022] Preferably, the data analysis layer includes a data classification module, a data cleaning module, a data conversion module and a rule design module;

[0023] The data classification module is used to cluster the security data;

[0024] The data cleaning module is used to clean abnormal data in security data;

[0025] The data conversion module is used to create a new view;

[0026] The rule design module is used to establish data analysis rules through regular expressions and obtain security events according to the data analysis rules.

[0027] Preferably, the event processing layer includes an event management module, a configuration management module and an event notification module;

[0028] The event management module is used to determine whether a security event is a pending security event according to event processing rules;

[0029] The configuration management module is used to configure event processing rules;

[0030] The event notification module is used to push pending security events.

[0031] Preferably, the event display layer includes a display module and a timestamp module;

[0032] The display module is used to display information of the data resource layer, data collection layer, data analysis layer and event processing layer;

[0033] The timestamp module is used to implement real-time update of event progress.

[0034] A network security statistical analysis method based on multi-structure data is implemented by the above-mentioned network security statistical analysis system, comprising the following steps:

[0035] S1. Data resource layer monitors and sorts out key data of information systems and equipment, and determines the data source;

[0036] S2, the data collection layer collects data from the data source and obtains security data;

[0037] S3, the data analysis layer classifies, cleans and converts security data, and analyzes it according to analysis rules to obtain security events;

[0038] S4, the event processing layer configures event processing rules and processes security events according to the event processing rules;

[0039] S5. The event display layer displays the information of the data resource layer, data collection layer, data analysis layer and event processing layer, and updates the information in real time according to the timestamp module.

[0040] Preferably, the analyzing according to the analysis rules to obtain security events specifically refers to: establishing data analysis rules through regular expressions, analyzing security data through the analysis rules, and obtaining security events;

[0041] The processing of security events according to the event processing rules is specifically: judging whether the security event is a pending security event according to the event processing rules, if so, pushing the pending security event, otherwise it is a false alarm event and is ignored.

[0042] The beneficial effects of the present invention are:

[0043] 1. Obtain multi-structured data through the data resource layer and the data collection layer, and analyze the multi-structured data through the data analysis layer to discover network security risks in the information system from a multi-dimensional perspective. It can discover deep network security risks and has strong security;

[0044] 2. The event processing layer processes events according to event processing rules to avoid false alarms, greatly saving manpower and improving network security work efficiency;

[0045] 3. The event display layer can display the processing status of each layer and update the information in real time through the timestamp module, which is very timely. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the network security statistical analysis system architecture provided by an embodiment of the present invention;

[0047] Figure 2 is a flow chart of a network security statistical analysis method provided by an embodiment of the present invention;

[0048] Figure 3 is a schematic diagram of illegal behavior detection provided by an embodiment of the present invention;

[0049] Figure 4 Schematic diagram of abnormal behavior detection provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The technical solution of the present invention is further described below, but the scope of protection claimed is not limited to the description.

[0051] like Figure 1 As shown, a network security statistical analysis system based on multi-structure data includes a data resource layer and a network security monitoring platform;

[0052] The data resource layer is used to monitor and sort out key data of information systems and equipment, open up data channels, and determine data sources;

[0053] The data resource layer includes network monitoring, server monitoring, database monitoring, application system monitoring and middleware monitoring;

[0054] The key data of the information systems and devices include network security logs, traffic, and actor audit logs;

[0055] The data channel is opened by directly reading the database or sending the log.

[0056] The network security monitoring platform includes a data collection layer, a data analysis layer, an event processing layer and an event display layer;

[0057] The data collection layer is used to obtain security data through data sources;

[0058] The obtaining of security data through the data source specifically refers to: using the technical approach of SQL extraction or syslog active sending to collect data from the data source and obtain security data.

[0059] The data sources include security and confidentiality products, network equipment, operating systems, applications and middleware.

[0060] The security and confidentiality products include intrusion detection systems, vulnerability scanning systems, host monitoring and auditing systems, and security systems;

[0061] The network equipment includes switches, routers and firewalls;

[0062] The operating system includes server and desktop operating systems;

[0063] The applications include web applications and databases;

[0064] The security data includes security and confidentiality product logs, network equipment logs, operating system logs and application logs.

[0065] The data analysis layer is used to analyze security data and obtain security events;

[0066] The data analysis layer includes a data classification module, a data cleaning module, a data conversion module and a rule design module;

[0067] The data classification module is used to cluster the security data;

[0068] The data cleaning module is used to clean abnormal data in security data;

[0069] The data conversion module is used to create a new view;

[0070] Through clustering, cleaning and transformation, effective and usable data can be obtained.

[0071] The rule design module is used to establish data analysis rules through regular expressions and obtain security events according to the data analysis rules.

[0072] For example, virus outbreaks and equipment violations can be compared over time to determine the causes of related events, thereby discovering network security events occurring in real time in the information system.

[0073] The event processing layer is used to configure event processing rules, process security events, and obtain and push security events to be processed;

[0074] The event processing layer includes an event management module, a configuration management module and an event notification module;

[0075] The event management module is used to determine whether a security event is a pending security event according to event processing rules;

[0076] The configuration management module is used to configure event processing rules;

[0077] The event notification module is used to push pending security events.

[0078] The event display layer is used to centrally display information of the data resource layer, data collection layer, data analysis layer and event processing layer.

[0079] The event display layer includes a display module and a timestamp module;

[0080] The display module is used to display information of the data resource layer, data collection layer, data analysis layer and event processing layer;

[0081] The timestamp module is used to implement real-time update of event progress.

[0082] like Figure 2 As shown, a network security statistical analysis method based on multi-structure data is implemented by the above-mentioned network security statistical analysis system, comprising the following steps:

[0083] S1. Data resource layer monitors and sorts out key data of information systems and equipment, and determines the data source;

[0084] S2, the data collection layer collects data from the data source and obtains security data;

[0085] S3, the data analysis layer classifies, cleans and converts security data, and analyzes it according to analysis rules to obtain security events;

[0086] The analyzing according to the analysis rules to obtain security events specifically refers to: establishing data analysis rules through regular expressions, analyzing security data through the analysis rules, and obtaining security events;

[0087] S4, the event processing layer configures event processing rules and processes security events according to the event processing rules;

[0088] The processing of security events according to the event processing rules is specifically: judging whether the security event is a pending security event according to the event processing rules, if so, pushing the pending security event, otherwise it is a false alarm event and is ignored.

[0089] like Figure 3 , 4 As shown, the specific rules of the event processing rules of this embodiment. In this embodiment, the security events to be processed are divided into violation events and abnormal events, among which violation events are subdivided into illegal data disposal, illegal file output, illegal access to peripherals, etc., and abnormal events are subdivided into login abnormalities, user operation abnormalities, information ferrying abnormalities, etc.

[0090] S5. The event display layer displays the information of the data resource layer, data collection layer, data analysis layer and event processing layer, and updates the information in real time according to the timestamp module.

[0091] The present invention obtains multi-structured data through the data resource layer and the data collection layer, and analyzes the multi-structured data through the data analysis layer, so as to realize the discovery of network security risks existing in the information system from a multi-dimensional perspective, and can discover deep-seated network security risks, with strong security; the event processing layer processes events according to event processing rules to avoid false alarms, greatly saving manpower and improving network security work efficiency; the event display layer can display the processing status of each layer, and update information in real time through the timestamp module, with strong timeliness.

Claims

1. A network security statistical analysis system based on multi-structured data, It is characterized in that Includes data resource layer and network security monitoring platform; The data resource layer is used to monitor and sort out key data of information systems and equipment, open up data channels, and determine data sources; The network security monitoring platform includes a data collection layer, a data analysis layer, an event processing layer and an event display layer; The data collection layer is used to obtain security data through data sources; The data analysis layer is used to analyze security data and obtain security events; The event processing layer is used to configure event processing rules, process security events, and obtain and push security events to be processed; The event display layer is used to centrally display information of the data resource layer, data collection layer, data analysis layer and event processing layer.

2. The network security statistical analysis system according to claim 1, It is characterized in that The data resource layer includes network monitoring, server monitoring, database monitoring, application system monitoring and middleware monitoring; The key data of the information systems and devices include network security logs, traffic, and actor audit logs; The data channel is opened by directly reading the database or sending the log.

3. The network security statistical analysis system according to claim 1, It is characterized in that The obtaining of security data through the data source specifically refers to: using the technical approach of SQL extraction or syslog active sending to collect data from the data source and obtain security data.

4. The network security statistical analysis system according to claim 1, It is characterized in that The data sources include security and confidentiality products, network equipment, operating systems, applications and middleware.

5. The network security statistical analysis system as claimed in claim 4, It is characterized in that The security and confidentiality products include intrusion detection systems, vulnerability scanning systems, host monitoring and auditing systems, and security systems; The network equipment includes switches, routers and firewalls; The operating system includes server and desktop operating systems; The applications include web applications and databases; The security data includes security and confidentiality product logs, network equipment logs, operating system logs and application logs.

6. The network security statistical analysis system according to claim 1, It is characterized in that The data analysis layer includes a data classification module, a data cleaning module, a data conversion module and a rule design module; The data classification module is used to cluster the security data; The data cleaning module is used to clean abnormal data in security data; The data conversion module is used to create a new view; The rule design module is used to establish data analysis rules through regular expressions and obtain security events according to the data analysis rules.

7. The network security statistical analysis system according to claim 1, It is characterized in that The event processing layer includes an event management module, a configuration management module and an event notification module; The event management module is used to determine whether a security event is a pending security event according to event processing rules; The configuration management module is used to configure event processing rules; The event notification module is used to push pending security events.

8. The network security statistical analysis system according to claim 1, It is characterized in that The event display layer includes a display module and a timestamp module; The display module is used to display information of the data resource layer, data collection layer, data analysis layer and event processing layer; The timestamp module is used to implement real-time update of event progress.

9. A network security statistical analysis method based on multi-structured data, It is characterized in that The method is implemented by the network security statistical analysis system according to any one of claims 1 to 8, comprising the following steps: S1. Data resource layer monitors and sorts out key data of information systems and equipment, and determines the data source; S2, the data collection layer collects data from the data source and obtains security data; S3, the data analysis layer classifies, cleans and converts security data, and analyzes it according to analysis rules to obtain security events; S4, the event processing layer configures event processing rules and processes security events according to the event processing rules; S5. The event display layer displays the information of the data resource layer, data collection layer, data analysis layer and event processing layer, and updates the information in real time according to the timestamp module.

10. The network security statistical analysis method according to claim 9, It is characterized in that The analyzing according to the analysis rules to obtain security events specifically refers to: establishing data analysis rules through regular expressions, analyzing security data through the analysis rules, and obtaining security events; The processing of security events according to the event processing rules is specifically: judging whether the security event is a pending security event according to the event processing rules, if so, pushing the pending security event, otherwise it is a false alarm event and is ignored.

Images