Network security comprehensive monitoring method, system and equipment and storage medium

Abstract

The invention discloses a network security comprehensive monitoring method, system and device and a storage medium, and belongs to the technical field of network security. A network security comprehensive monitoring method comprises the following steps: collecting log data of network security monitoring equipment, and carrying out standardization processing on the log data; setting a matching rule of warning information in the log data according to the type of the network security monitoring equipment; identifying a network security event and an emergency warning event by comparing the standardized log data with the matching rule; blocking a source address of an emergency warning event sent by the network security monitoring equipment, and distributing the warning information; wherein the standardization processing comprises the steps of establishing a data model for warning information processing, extracting core data of the warning information, and filling the core data into the data model.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a network security comprehensive monitoring method, system, device and storage medium. Background Art

[0002] With the rapid development of Internet technology and the continuous evolution of cyber attack methods, cyber security has become a global focus. Enterprises and organizations are facing increasingly complex cyber security threats, including malware, distributed denial of service attacks (DDoS), advanced persistent threats (APT), etc. These threats may lead to data leakage, service interruption and even business loss.

[0003] Traditional network security protection measures often rely on a single security device, such as a firewall, intrusion detection system (IDS) or intrusion prevention system (IPS). However, these devices usually operate independently and lack effective integration and coordination, resulting in decentralized security alert information and difficulty in unified management and analysis. In addition, since security devices from different manufacturers may use different log formats and alert standards, security operations personnel face huge challenges when analyzing and responding to security incidents.

[0004] Therefore, it is necessary to develop a comprehensive network security monitoring method and system that can effectively integrate, analyze and manage the alarm information of different security devices, quickly identify and respond to high-risk threats, and automatically implement security measures to improve the efficiency and effectiveness of network security protection. Summary of the invention

[0005] 1. Technical problems to be solved

[0006] The object of the present invention is to provide a network security comprehensive monitoring method, system, device and storage medium to solve the problems raised in the above background technology.

[0007] 2. Technical solution

[0008] The present invention is achieved through the following technical solutions:

[0009] A network security comprehensive monitoring method, system, device and storage medium, including collecting log data of network security monitoring equipment and performing standardized processing on the log data;

[0010] Set matching rules for warning information in log data according to the type of network security monitoring equipment;

[0011] Identify network security incidents and emergency warning events by comparing standardized log data and matching rules;

[0012] Block the source address of the emergency warning event issued by the network security monitoring equipment and distribute the warning information;

[0013] The standardization process includes establishing a data model for warning information processing, extracting the core data of the warning information, and filling it into the data model.

[0014] As an optional solution to the technical solution of the present application document, the method for collecting log data of the network security monitoring device also includes: detecting whether the network security monitoring device has the function of pushing warning information; if the warning information cannot be pushed, deploying agent software on the network security monitoring device, and sending the warning information through the agent software.

[0015] As an optional solution to the technical solution of the present application document, the standardized processing method also includes: customizing multiple parsing modes for warning information adapted to different types of devices; and storing the original warning information and the standardized warning information in different data storage systems respectively.

[0016] As an optional solution of the technical solution of the present application document, the data storage system includes: a non-relational database for storing original warning information; and a cache database for storing standardized warning information.

[0017] A network security integrated monitoring system, comprising:

[0018] A standardized processing unit, used to collect log data of network security monitoring equipment and perform standardized processing on the log data;

[0019] A matching rule setting unit, used to set matching rules for warning information in log data according to the type of network security monitoring equipment;

[0020] An emergency response unit, used to block the source address of emergency warning events issued by network security monitoring equipment;

[0021] Information sharing unit for distributing warning information.

[0022] 3. Beneficial effects

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] 1) This application collects and normalizes the system logs of different security monitoring devices, and the solution realizes the integrated management of scattered alarm information, which helps to provide a unified alarm view and simplifies the processing flow of alarm information.

[0025] 2) By configuring the correlation strategy of the alarm information in the system log, the solution can generate more relevant security events and high-risk alarm events, which helps to reduce false positives and missed positives and improve the accuracy of alarms. DETAILED DESCRIPTION

[0026] Example 1

[0027] The present invention provides a network security comprehensive monitoring method, comprising:

[0028] Collect log data of network security monitoring equipment and perform standardized processing on the log data;

[0029] Set matching rules for warning information in log data according to the type of network security monitoring equipment;

[0030] Identify network security incidents and emergency warning events by comparing standardized log data and matching rules;

[0031] Blocking the source address of the emergency warning event issued by the network security monitoring equipment and distributing the warning information;

[0032] The standardization process includes establishing a data model for warning information processing, extracting the core data of the warning information, and filling it into the data model.

[0033] The method for collecting log data of network security monitoring equipment also includes: detecting whether the network security monitoring equipment has the function of pushing warning information; if the warning information cannot be pushed, deploying agent software on the network security monitoring equipment, and sending the warning information through the agent software.

[0034] The standardized processing method also includes: customizing a plurality of analysis modes of warning information adapted to different types of equipment; and storing the original warning information and the standardized warning information in different data storage systems respectively.

[0035] The data storage system comprises: a non-relational database for storing original warning information; and a high-speed cache database for storing standardized warning information.

[0036] Example 2

[0037] The present invention provides a network security integrated monitoring system, comprising:

[0038] A standardized processing unit, used to collect log data of network security monitoring equipment and perform standardized processing on the log data;

[0039] A matching rule setting unit, used to set matching rules for warning information in log data according to the type of network security monitoring equipment;

[0040] An emergency response unit, used to block the source address of emergency warning events issued by network security monitoring equipment;

[0041] Information sharing unit for distributing warning information.

[0042] Example 3

[0043] The present invention provides an electronic device, comprising:

[0044] A data storage component for storing software programs;

[0045] A control unit is used to execute the software program to implement the method steps recorded in Example 1.

[0046] Example 4

[0047] The present invention provides a computer storage medium, wherein a software program is stored on the computer-readable storage medium, and when the software program is executed by a control unit, the method steps described in Example 1 are implemented.

Claims

1. A network security comprehensive monitoring method, characterized in that: include: Collect log data of network security monitoring equipment and perform standardized processing on the log data; Set matching rules for warning information in log data according to the type of network security monitoring equipment; Identify network security incidents and emergency warning events by comparing standardized log data and matching rules; Blocking the source address of the emergency warning event issued by the network security monitoring equipment and distributing the warning information; The standardization process includes establishing a data model for warning information processing, extracting the core data of the warning information, and filling it into the data model.

2. A network security integrated monitoring method according to claim 1, characterized in that: The method for collecting log data of network security monitoring equipment also includes: detecting whether the network security monitoring equipment has the function of pushing warning information; if the warning information cannot be pushed, deploying agent software on the network security monitoring equipment, and sending the warning information through the agent software.

3. A network security integrated monitoring method according to claim 1, characterized in that: The standardized processing method also includes: customizing a plurality of analysis modes of warning information adapted to different types of equipment; and storing the original warning information and the standardized warning information in different data storage systems respectively.

4. A network security integrated monitoring method according to claim 3, characterized in that: The data storage system comprises: a non-relational database for storing original warning information; and a high-speed cache database for storing standardized warning information.

5. A network security integrated monitoring system, using a network security integrated monitoring method according to any one of claims 1 to 4, characterized in that: include: A standardized processing unit, used to collect log data of network security monitoring equipment and perform standardized processing on the log data; A matching rule setting unit, used to set matching rules for warning information in log data according to the type of network security monitoring equipment; An emergency response unit, used to block the source address of emergency warning events issued by network security monitoring equipment; Information sharing unit for distributing warning information.

6. An electronic device, characterized in that: include: A data storage component for storing software programs; A control unit is used to execute the software program to implement a network security integrated monitoring method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a software program, and when the software program is executed by the control unit, the network security integrated monitoring method according to any one of claims 1 to 4 is implemented.