Network security log real-time monitoring system

Abstract

The invention discloses a network security log real-time monitoring system, and relates to the technical field of network security, and the technical scheme is that the network security log real-time monitoring system comprises a central processing unit which is used for guaranteeing the calculation and operation of the system; the log storage library is used for storing logs of the network host; the log automatic updating module is used for automatically updating the logs of the network host to the log storage library for storage, and the log automatic updating module is connected to the input end of the log storage library; the log extraction and transmission module is used for extracting the logs from the log storage library and transmitting the logs. The system has the beneficial effects that the log abnormity monitoring module is designed to carry out abnormity monitoring on the logs, so that the logs of the network host can be automatically monitored; according to the invention, manual auxiliary monitoring is not needed during monitoring, so that the labor intensity of workers can be greatly reduced, the phenomenon that part of abnormities cannot be found in time can be avoided, and the safety monitoring effect is further ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security log real-time monitoring system. Background Art

[0002] Logs are information recorded by network hosts, computer systems, devices, software, etc. under certain circumstances. The specific content depends on the source of the logs. There is a lot of information in the logs, which tells you why the logs need to be generated and what has happened to the network host. Through the logs, operation and maintenance managers can understand the operation status, security status, and even operation status of the network host. In order to understand the operation status of the network host in the first place, it is necessary to monitor the logs in real time.

[0003] The existing real-time log monitoring system needs manual assistance during use and cannot realize automatic monitoring. In addition, some anomalies in manual assistance monitoring cannot be discovered in time, and the security monitoring effect is poor. Therefore, it needs to be improved.

[0004] Therefore, it is necessary to invent a real-time monitoring system for network security logs. Summary of the invention

[0005] To this end, the present invention provides a network security log real-time monitoring system to solve the problems in the background technology.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a network security log real-time monitoring system, comprising:

[0007] The central processing unit is used to ensure the calculation and operation of the system;

[0008] Log repository, which is used to store logs of network hosts;

[0009] A log automatic update module, which is used to automatically update the log of the network host to the log storage library for storage, and the log automatic update module is connected to the input end of the log storage library;

[0010] A log extraction and transmission module, which is used to extract logs from the log storage repository and transmit them, and the log extraction and transmission module is connected to the output end of the log storage repository;

[0011] A log parsing module, which is used to parse the logs, and the log parsing module is connected to the output end of the log extraction and transmission module;

[0012] A parsing report output module, which is used to export the parsing report of the log by the log parsing module, and the parsing report output module is connected to the output end of the log parsing module;

[0013] The log anomaly monitoring module is used to monitor the log for anomalies according to the log analysis report. The log anomaly monitoring module includes a network log monitoring module, a database log monitoring module, a hardware log monitoring module, an I / O log monitoring module and a system log monitoring module. The log anomaly monitoring module is connected to the output end of the analysis report output module.

[0014] Preferably, it also includes:

[0015] An abnormal intelligent judgment module, which is used to judge whether there is an abnormality in the log according to the monitoring report of the log abnormality monitoring module, and the abnormal intelligent judgment module is connected to the output end of the log abnormality monitoring module, and the abnormal intelligent judgment module is connected to the input end of the central processing unit;

[0016] An intelligent alarm module, which is used to alarm when the log is abnormal, and the intelligent alarm module is connected to the output end of the central processing unit;

[0017] An abnormality identification module, which is used to identify the type of abnormality in the log abnormality, and the abnormality identification module is connected to the output end of the abnormality intelligent judgment module;

[0018] An abnormal event storage module, which is used to store each abnormal event in the log, and the abnormal event storage module is connected to the output end of the abnormal identification module;

[0019] An intelligent retrieval module, which is used to retrieve log abnormal events from the abnormal event storage module, and the intelligent retrieval module is connected to the input end of the abnormal event storage module;

[0020] The virus isolation module is used to prevent network viruses from being updated when the logs of the network host are automatically updated to the log storage library. The virus isolation module is connected to the input end of the log automatic update module.

[0021] Preferably, the network log monitoring module is used to monitor whether there are abnormalities in the network log, the database log monitoring module is used to monitor whether there are abnormalities in the database log, the hardware log monitoring module is used to monitor whether there are abnormalities in the hardware log, the I / O log monitoring module is used to monitor whether there are abnormalities in the I / O log, and the system log monitoring module is used to monitor whether there are abnormalities in the system log.

[0022] Preferably, the log automatic update module is electrically connected to the log storage repository, the log extraction and transmission module is electrically connected to the log storage repository, the log analysis module is electrically connected to the log extraction and transmission module, and the analysis report output module is electrically connected to the log analysis module.

[0023] Preferably, the log anomaly monitoring module is electrically connected to the analysis report output module, the abnormality intelligent judgment module is electrically connected to the log anomaly monitoring module, the abnormality intelligent judgment module is electrically connected to the central processing unit, and the intelligent alarm module is electrically connected to the central processing unit.

[0024] Preferably, the abnormal identification module is electrically connected to the abnormal intelligent judgment module, the abnormal event storage module is electrically connected to the abnormal identification module, the intelligent retrieval module is electrically connected to the abnormal event storage module, and the virus isolation module is electrically connected to the log automatic update module.

[0025] Preferably, the intelligent alarm module includes a shell, the top of the shell is set to be open, the bottom of the shell is provided with a buzzer, the outside of the buzzer is provided with four card slots evenly distributed in a circular shape, the bottom of the shell is provided with four through slots evenly distributed in a circular shape, the inner wall of the bottom of the shell is fixedly connected to four support blocks evenly distributed in a circular shape, the inner wall of the bottom of the shell is fixedly connected to a shell, the bottom of the shell is set to be open, four threaded rods are embedded in the shell, the outer ends of the four threaded rods are respectively connected to the inner sides of the four support blocks, the outsides of the four threaded rods are all sleeved with threaded blocks, the threaded blocks are connected to the threaded rods by threads, the four threaded blocks respectively penetrate the four through slots and are slidably connected thereto, the bottoms of the four threaded blocks are fixedly connected to card blocks, and the four card blocks are respectively embedded in the four card slots.

[0026] Preferably, a rotating shaft 1 is embedded in the top of the shell, and the bottom end of the rotating shaft 1 is connected to the bottom inner wall of the shell, the rotating shaft 1 is provided with a bevel gear 1 on the outside of the rotating shaft, and the bottom of the bevel gear 1 is provided with four bevel gears 2 meshingly connected with it, and the four bevel gears 2 are respectively fixedly connected to the inner ends of four threaded rods, and a movable plate is slidably provided inside the shell, and a movable frame is fixedly connected to the bottom of the movable plate, and the movable frame is movably sleeved on the outside of the rotating shaft 1, and a spiral strip is provided on the outside of the rotating shaft 1, and the spiral strip passes through the movable frame and is movably connected to it, and four springs are fixedly connected to the bottom of the movable plate, and the bottom ends of the four springs are all connected to the bottom inner wall of the shell.

[0027] Preferably, U-shaped frames are fixedly connected to the inner walls on both sides of the shell, and the two U-shaped frames pass through the movable plate and are slidably connected thereto. Mounting frames are fixedly connected to the four corners of the top of the movable plate, and mounting holes are opened inside the four mounting frames.

[0028] Preferably, the threaded rod is connected to the housing and the support block via a bearing, and the rotating shaft 1 is connected to the outer shell and the housing via a bearing.

[0029] The beneficial effects of the present invention are:

[0030] 1. The present invention can perform abnormality monitoring on logs by designing a log abnormality monitoring module. During monitoring, the network log monitoring module monitors whether there is an abnormality in the network log, the database log monitoring module monitors whether there is an abnormality in the database log, the hardware log monitoring module monitors whether there is an abnormality in the hardware log, the I / O log monitoring module monitors whether there is an abnormality in the I / O log, and the system log monitoring module monitors whether there is an abnormality in the system log. In this way, the logs of the network host can be automatically monitored. When monitoring, there is no need for manual auxiliary monitoring, which can greatly reduce the labor intensity of manual labor. At the same time, it can also avoid the phenomenon that some abnormalities cannot be discovered in time, thereby ensuring the effect of security monitoring.

[0031] 2. The present invention pushes the buzzer upward so that the shell can move upward, and then the rotating shaft 1 and the four threaded rods can be rotated under the action of the movable frame and the spiral strip, so that the four threaded rods can move outward, and the movement of the threaded block drives the card block to move, so that the card block can be removed from the four card slots, so that the buzzer can be disassembled and assembled, and when the buzzer is damaged in the later stage, it can be quickly replaced. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the drawings required for the implementation methods or the prior art descriptions are briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0033] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0034] Figure 1 A schematic diagram of the overall system provided by the present invention;

[0035] Figure 2 A schematic diagram of a log anomaly monitoring module system provided by the present invention;

[0036] Figure 3 This is a schematic diagram of the structure of the intelligent alarm module provided by the present invention;

[0037] Figure 4 The present invention provides Figure 3 Sectional view;

[0038] Figure 5 The present invention provides Figure 4 A in the enlarged view;

[0039] Figure 6 A three-dimensional exploded view of the movable frame, the rotating shaft 1 and the spiral strip provided by the present invention;

[0040] In the figure: 1 central processing unit, 2 log storage library, 3 log automatic update module, 4 log extraction and transmission module, 5 log parsing module, 6 parsing report output module, 7 log abnormality monitoring module, 8 network log monitoring module, 9 database log monitoring module, 10 hardware log monitoring module, 11 I / O log monitoring module, 12 system log monitoring module, 13 abnormal intelligent judgment module, 14 intelligent alarm module, 15 abnormal identification module, 16 abnormal event storage module, 17 intelligent retrieval module, 18 virus isolation module, 19 shell, 20 buzzer, 21 support block, 22 shell, 23 threaded rod, 24 threaded block, 25 card block, 26 rotating shaft 1, 27 bevel gear 1, 28 bevel gear 2, 29 moving plate, 30 moving frame, 31 spiral strip, 32 spring, 33 U-shaped frame, 34 mounting frame, 35 mounting hole. DETAILED DESCRIPTION

[0041] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0042] Refer to the attached Figure 1 -Attached Figure 6 The present invention provides a network security log real-time monitoring system, comprising:

[0043] Central processing unit 1, which is used to ensure the calculation and operation of the system;

[0044] Log repository 2, which is used to store logs of network hosts;

[0045] The log automatic updating module 3 is used to automatically update the log of the network host to the log storage library 2 for storage. The log automatic updating module 3 is connected to the input end of the log storage library 2;

[0046] A log extraction and transmission module 4 is used to extract logs from the log storage repository 2 and transmit them. The log extraction and transmission module 4 is connected to the output end of the log storage repository 2;

[0047] A log parsing module 5, which is used to parse the logs. The log parsing module 5 is connected to the output end of the log extraction and transmission module 4;

[0048] The analysis report output module 6 is used to export the analysis report of the log by the log analysis module 5. The analysis report output module 6 is connected to the output end of the log analysis module 5;

[0049] A log anomaly monitoring module 7, which is used to perform anomaly monitoring on the log according to the log analysis report. The log anomaly monitoring module 7 includes a network log monitoring module 8, a database log monitoring module 9, a hardware log monitoring module 10, an I / O log monitoring module 11 and a system log monitoring module 12. The log anomaly monitoring module 7 is connected to the output end of the analysis report output module 6;

[0050] An abnormal intelligent judgment module 13, which is used to judge whether there is an abnormality in the log according to the monitoring report of the log abnormality monitoring module 7, and the abnormal intelligent judgment module 13 is connected to the output end of the log abnormality monitoring module 7, and the abnormal intelligent judgment module 13 is connected to the input end of the central processor 1;

[0051] An intelligent alarm module 14, which is used to alarm when the log is abnormal, and the intelligent alarm module 14 is connected to the output end of the central processor 1;

[0052] The abnormality identification module 15 is used to identify the abnormality type in the log abnormality. The abnormality identification module 15 is connected to the output end of the abnormality intelligent judgment module 13;

[0053] The abnormal event storage module 16 is used to store each abnormal event in the log. The abnormal event storage module 16 is connected to the output end of the abnormal identification module 15;

[0054] An intelligent retrieval module 17, which is used to retrieve log abnormal events from the abnormal event storage module 16, and the intelligent retrieval module 17 is connected to the input end of the abnormal event storage module 16;

[0055] The virus isolation module 18 is used to prevent network viruses from being updated when the network host log is automatically updated to the log storage library 2. The virus isolation module 18 is connected to the input end of the log automatic update module 3;

[0056] The network log monitoring module 8 is used to monitor whether there is an abnormality in the network log, the database log monitoring module 9 is used to monitor whether there is an abnormality in the database log, the hardware log monitoring module 10 is used to monitor whether there is an abnormality in the hardware log, the I / O log monitoring module 11 is used to monitor whether there is an abnormality in the I / O log, and the system log monitoring module 12 is used to monitor whether there is an abnormality in the system log;

[0057] In this implementation scheme, the log anomaly monitoring module 7 is designed to monitor the log for anomalies. During monitoring, the network log monitoring module 8 monitors whether the network log has anomalies, the database log monitoring module 9 monitors whether the database log has anomalies, the hardware log monitoring module 10 monitors whether the hardware log has anomalies, the I / O log monitoring module 11 monitors whether the I / O log has anomalies, and the system log monitoring module 12 monitors whether the system log has anomalies. In this way, the logs of the network host can be automatically monitored. When monitoring, no manual auxiliary monitoring is required, which can greatly reduce the labor intensity of manual labor. At the same time, it can also avoid the phenomenon that some anomalies cannot be discovered in time, thereby ensuring the effect of security monitoring.

[0058] Among them, in order to achieve the purpose of ensuring the normal operation of the system, the present device adopts the following technical solutions: the log automatic update module 3 is electrically connected to the log storage library 2, the log extraction and transmission module 4 is electrically connected to the log storage library 2, the log analysis module 5 is electrically connected to the log extraction and transmission module 4, the analysis report output module 6 is electrically connected to the log analysis module 5, the log abnormality monitoring module 7 is electrically connected to the analysis report output module 6, the abnormal intelligent judgment module 13 is electrically connected to the log abnormality monitoring module 7, the abnormal intelligent judgment module 13 is electrically connected to the central processing unit 1, the intelligent alarm module 14 is electrically connected to the central processing unit 1, the abnormal identification module 15 is electrically connected to the abnormal intelligent judgment module 13, the abnormal event storage module 16 is electrically connected to the abnormal identification module 15, the intelligent retrieval module 17 is electrically connected to the abnormal event storage module 16, and the virus isolation module 18 is electrically connected to the log automatic update module 3. The electrical connection between each module can ensure the normal operation of the system;

[0059] Among them, in order to achieve the purpose of disassembling and assembling the buzzer 20, the present device adopts the following technical solutions: the intelligent alarm module 14 includes a shell 19, the top of the shell 19 is set to be open, the bottom of the shell 19 is provided with a buzzer 20, the outside of the buzzer 20 is provided with four card slots evenly distributed in a circumferential shape, the bottom of the shell 19 is provided with four through grooves evenly distributed in a circumferential shape, the bottom inner wall of the shell 19 is fixedly connected to four support blocks 21 evenly distributed in a circumferential shape, the bottom inner wall of the shell 19 is fixedly connected to a shell 22, the bottom of the shell 22 is set to be open, and four threaded rods 23 are embedded in the shell 22, and the outer ends of the four threaded rods 23 are respectively connected to the inner sides of the four support blocks 21 The four threaded rods 23 are connected, and the outside of each of the four threaded rods 23 is sleeved with a threaded block 24, and the threaded block 24 is connected to the threaded rod 23 by a thread, and the four threaded blocks 24 respectively penetrate the four through grooves and are slidably connected thereto, and the bottom of each of the four threaded blocks 24 is fixedly connected with a clamping block 25, and the four clamping blocks 25 are respectively embedded in the four clamping grooves, and a rotating shaft 26 is embedded in the top of the shell 22, and the bottom end of the rotating shaft 26 is connected to the bottom inner wall of the shell 19, and a bevel gear 27 is fixedly sleeved on the outside of the rotating shaft 26, and four bevel gears 28 meshingly connected thereto are provided at the bottom of the bevel gear 27, and the four bevel gears 28 are respectively fixedly connected to the inner ends of the four threaded rods 23, and a movable plate is slidably provided inside the shell 19 29, the bottom of the movable plate 29 is fixedly connected to a movable frame 30, and the movable frame 30 is movably sleeved on the outside of the rotating shaft 26. The outer fixed sleeve of the rotating shaft 26 is provided with a spiral strip 31, and the spiral strip 31 penetrates the movable frame 30 and is movably connected with it. Four springs 32 are fixedly connected to the bottom of the movable plate 29, and the bottom ends of the four springs 32 are connected to the inner wall of the bottom of the shell 19, pushing the buzzer 20 upward, so that the shell 19 and the components on the shell 19 can be moved upward, and the spring 32 is compressed. Since the spiral strip 31 is provided on the rotating shaft 26, and the movable frame 30 does not move, the rotating shaft 26 moves upward under the action of the spiral groove, so that the rotating shaft 26 can be moved. The bevel gear 1 27 is rotated, thereby driving the bevel gear 1 27 to rotate. The rotation of the bevel gear 1 27 drives the four bevel gears 28 and the four threaded rods 23 to rotate. The rotation of the four threaded rods 23 drives the four threaded blocks 24 to move outward, thereby driving the four clamping blocks 25 to move outward, so that the clamping blocks 25 can be moved out of the four clamping slots. Then, one hand can hold the shell 19 and the other hand can take down the buzzer 20, and then the new one can be put in its original position. Then, the shell 19 and other components can be moved downward by the rebound of the spring 32, and then the rotating shaft 1 26 and the threaded rod 23 are reversed, so that the four clamping blocks 25 can be opened in the clamping slots again, so that the disassembly and assembly of the buzzer 20 can be realized.

[0060] In order to achieve the purpose of stable movement of the shell 19, the present device adopts the following technical solutions: the inner walls on both sides of the shell 19 are fixedly connected with U-shaped frames 33, the two U-shaped frames 33 penetrate the moving plate 29 and are slidably connected thereto, the four corners of the top of the moving plate 29 are fixedly connected with mounting frames 34, and the four mounting frames 34 are provided with mounting holes 35 inside, and the U-shaped frames 33 can ensure the stable movement of the shell 19;

[0061] Among them, in order to achieve the purpose of reducing wear, the present device adopts the following technical solution: the threaded rod 23 is connected to the shell 22 and the support block 21 through a bearing, and the rotating shaft 26 is connected to the outer shell 19 and the shell 22 through a bearing. The bearing connection can reduce wear.

[0062] The use process of the present invention is as follows: when it is necessary to perform security monitoring on the log of the network host, the log automatic update module 3 can continuously and automatically update the log of the network host to the log storage library 2 for storage, then the log extraction and transmission module 4 can extract the log from the log storage library 2 and transmit it, then the log parsing module 5 can receive the log and parse it, and the parsing report output module 6 can export the parsing report of the log by the log parsing module 5, when the parsing report comes out, the log abnormality monitoring module 7 can perform abnormality monitoring on the log according to the parsing report of the log, during monitoring, the network log monitoring module 8 monitors whether there is an abnormality in the network log, the database log monitoring module 9 monitors whether there is an abnormality in the database log, the hardware log monitoring module 10 monitors whether there is an abnormality in the hardware log, the I / O log monitoring module 11 monitors whether there is an abnormality in the I / O log, and the system log monitoring module 12 monitors whether there is an abnormality in the system log, so that the log of the network host can be automatically monitored, and no manual auxiliary monitoring is required during monitoring, which can greatly reduce the labor intensity of manual labor, and at the same time, it can also avoid the phenomenon that some abnormalities cannot be discovered in time, thereby ensuring the effect of security monitoring;

[0063] When the monitoring report of the log abnormality monitoring module 7 comes out, the abnormality intelligent judgment module 13 can judge whether there is an abnormality in the log according to the monitoring report of the log abnormality monitoring module 7. When there is an abnormality, the central processor 1 can control the intelligent alarm module 14 to alarm. At the same time, the abnormality identification module 15 can identify the type of abnormality in the log abnormality, so as to determine which one of the network, database, hardware, I / O, and system the abnormality comes from. Then the abnormal event storage module 16 can store each log abnormal event. When the log abnormal event needs to be retrieved later, the intelligent retrieval module 17 can retrieve the log abnormal event from the abnormal event storage module 16;

[0064] When the buzzer 20 in the intelligent alarm module 14 is damaged after long-term use and needs to be replaced, the buzzer 20 is pushed upward, so that the housing 19 and the components on the housing 19 can be moved upward, and the spring 32 is compressed. Since the rotating shaft 1 26 is provided with a spiral strip 31, and the movable frame 30 does not move, the rotating shaft 1 26 moves upward under the action of the spiral groove, so that the rotating shaft 1 26 can be rotated, thereby driving the bevel gear 1 27 to rotate, and the rotation of the bevel gear 1 27 drives the four bevel gears 28 and the four threaded rods 23 to rotate, and the four threaded rods 23 rotate The four threaded blocks 24 are driven to move outward, thereby driving the four card blocks 25 to move outward, so that the card blocks 25 can be moved out of the four card slots. Then, one hand can hold the shell 19 and the other hand can take down the buzzer 20, and then put the new one in its place. Then, the shell 19 and other components can be moved downward by the rebound of the spring 32, and then the rotating shaft 26 and the threaded rod 23 are reversed, so that the four card blocks 25 can be opened in the card slots again, so that the buzzer 20 can be disassembled and assembled, and it can be quickly replaced when the buzzer 20 is damaged in the later stage.

[0065] The above are only preferred embodiments of the present invention. Any person skilled in the art may modify the present invention by using the above technical solutions or modify it into an equivalent technical solution. Therefore, any simple modification or equivalent replacement made according to the technical solution of the present invention shall fall within the scope of protection claimed by the present invention.

Claims

1. A network security log real-time monitoring system, characterized in that: include: A central processing unit (1), which is used to ensure the calculation and operation of the system; A log repository (2), which is used to store logs of network hosts; An automatic log update module (3) is used to automatically update the log of the network host to the log storage library (2) for storage, and the automatic log update module (3) is connected to the input end of the log storage library (2); A log extraction and transmission module (4), which is used to extract logs from the log storage repository (2) and transmit them, and the log extraction and transmission module (4) is connected to the output end of the log storage repository (2); A log parsing module (5), which is used to parse the log, and the log parsing module (5) is connected to the output end of the log extraction and transmission module (4); A parsing report output module (6), which is used to export a parsing report of the log by the log parsing module (5), and the parsing report output module (6) is connected to the output end of the log parsing module (5); A log anomaly monitoring module (7) is used to perform anomaly monitoring on the log according to the log analysis report, the log anomaly monitoring module (7) comprises a network log monitoring module (8), a database log monitoring module (9), a hardware log monitoring module (10), an I / O log monitoring module (11) and a system log monitoring module (12), and the log anomaly monitoring module (7) is connected to the output end of the analysis report output module (6).

2. A network security log real-time monitoring system according to claim 1, characterized in that: Also includes: An abnormality intelligent judgment module (13) is used to judge whether the log has an abnormality according to the monitoring report of the log abnormality monitoring module (7), and the abnormality intelligent judgment module (13) is connected to the output end of the log abnormality monitoring module (7), and the abnormality intelligent judgment module (13) is connected to the input end of the central processing unit (1); An intelligent alarm module (14) is used to generate an alarm when the log is abnormal, and the intelligent alarm module (14) is connected to the output end of the central processing unit (1); An abnormality identification module (15) is used to identify the type of abnormality in the log abnormality, and the abnormality identification module (15) is connected to the output end of the abnormality intelligent judgment module (13); An abnormal event storage module (16) is used to store each abnormal event in the log, and the abnormal event storage module (16) is connected to the output end of the abnormal identification module (15); An intelligent retrieval module (17) is used to retrieve log abnormal events from the abnormal event storage module (16), wherein the intelligent retrieval module (17) is connected to an input end of the abnormal event storage module (16); The virus isolation module (18) is used to prevent network viruses from being updated when the log of the network host is automatically updated to the log storage library (2). The virus isolation module (18) is connected to the input end of the log automatic update module (3).

3. A network security log real-time monitoring system according to claim 1, characterized in that: The network log monitoring module (8) is used to monitor whether there is an abnormality in the network log, the database log monitoring module (9) is used to monitor whether there is an abnormality in the database log, the hardware log monitoring module (10) is used to monitor whether there is an abnormality in the hardware log, the I / O log monitoring module (11) is used to monitor whether there is an abnormality in the I / O log, and the system log monitoring module (12) is used to monitor whether there is an abnormality in the system log.

4. A network security log real-time monitoring system according to claim 2, characterized in that: The log automatic update module (3) is electrically connected to the log storage repository (2), the log extraction and transmission module (4) is electrically connected to the log storage repository (2), the log analysis module (5) is electrically connected to the log extraction and transmission module (4), and the analysis report output module (6) is electrically connected to the log analysis module (5).

5. A network security log real-time monitoring system according to claim 2, characterized in that: The log anomaly monitoring module (7) is electrically connected to the analysis report output module (6), the abnormal intelligent judgment module (13) is electrically connected to the log anomaly monitoring module (7), the abnormal intelligent judgment module (13) is electrically connected to the central processing unit (1), and the intelligent alarm module (14) is electrically connected to the central processing unit (1).

6. A network security log real-time monitoring system according to claim 2, characterized in that: The abnormal identification module (15) is electrically connected to the abnormal intelligent judgment module (13), the abnormal event storage module (16) is electrically connected to the abnormal identification module (15), the intelligent retrieval module (17) is electrically connected to the abnormal event storage module (16), and the virus isolation module (18) is electrically connected to the log automatic update module (3).

7. A network security log real-time monitoring system according to claim 2, characterized in that: The intelligent alarm module (14) comprises a shell (19), the top of the shell (19) is arranged to be open, a buzzer (20) is arranged at the bottom of the shell (19), four card slots evenly distributed in a circumferential shape are opened on the outside of the buzzer (20), four through slots evenly distributed in a circumferential shape are opened at the bottom of the shell (19), four support blocks (21) evenly distributed in a circumferential shape are fixedly connected to the inner wall of the bottom of the shell (19), a shell (22) is fixedly connected to the inner wall of the bottom of the shell (19), and the bottom of the shell (22) The housing (22) is configured to be open, and four threaded rods (23) are embedded in the housing (22). The outer ends of the four threaded rods (23) are respectively connected to the inner sides of four support blocks (21). The outer sides of the four threaded rods (23) are sleeved with threaded blocks (24). The threaded blocks (24) are connected to the threaded rods (23) by threads. The four threaded blocks (24) respectively penetrate four through grooves and are slidably connected thereto. The bottoms of the four threaded blocks (24) are fixedly connected with clamping blocks (25), and the four clamping blocks (25) are respectively embedded in the four clamping grooves.

8. A network security log real-time monitoring system according to claim 7, characterized in that: A rotating shaft (26) is embedded in the top of the shell (22), and the bottom end of the rotating shaft (26) is connected to the inner wall of the bottom of the shell (19). A bevel gear (27) is fixedly sleeved outside the rotating shaft (26), and four bevel gears (28) meshingly connected to the bevel gear (27) are provided at the bottom of the bevel gear (27). The four bevel gears (28) are respectively fixedly connected to the inner ends of the four threaded rods (23). A movable plate (29) is slidably provided inside the shell (19), and a movable frame (30) is fixedly connected to the bottom of the movable plate (29). The movable frame (30) is movably sleeved outside the rotating shaft (26). A spiral strip (31) is fixedly sleeved outside the rotating shaft (26), and the spiral strip (31) penetrates the movable frame (30) and is movably connected to the movable frame (30). Four springs (32) are fixedly connected to the bottom of the movable plate (29), and the bottom ends of the four springs (32) are all connected to the inner wall of the bottom of the shell (19).

9. A network security log real-time monitoring system according to claim 8, characterized in that: The inner walls on both sides of the shell (19) are fixedly connected with U-shaped frames (33), the two U-shaped frames (33) penetrate the movable plate (29) and are slidably connected thereto, the four corners of the top of the movable plate (29) are fixedly connected with mounting frames (34), and the four mounting frames (34) are provided with mounting holes (35) inside.

10. A network security log real-time monitoring system according to claim 9, characterized in that: The threaded rod (23) is connected to the housing (22) and the support block (21) via bearings, and the rotating shaft (26) is connected to the outer shell (19) and the housing (22) via bearings.

Images