System log and firewall linkage method and device, equipment and storage medium

Abstract

The invention discloses a system log and firewall linkage method and device, equipment and a storage medium, and belongs to the technical field of information security, and the method comprises the steps that a configuration file is defined, and the configuration file comprises equipment connection information, a log analysis rule and a banning rule; constructing a connection path between the network equipment and a firewall based on preset middleware and the equipment connection information; when the network equipment is successfully connected with the firewall, acquiring a real-time system log in the network equipment, analyzing the real-time system log according to the log analysis rule, and matching information in the analyzed system log according to the banning rule to generate a banning log; and sending the forbidden log to a firewall, and blocking the IP address in the forbidden log. According to the invention, the system log is connected with the firewall through the middleware, so that the system log is automatically extracted and sent to the firewall to realize automatic plugging.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a system log and firewall linkage method, device, equipment and storage medium. Background Art

[0002] With the continuous development of network technology, network security threats are also increasing. Hacker attacks, virus propagation, malware, etc. all pose serious threats to network security. In order to deal with these threats, enterprises need to take effective security measures, such as deploying firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc. System logs are an important source of information for a network device to record the activities of its system server, and they play an important role in the investigation, analysis and prevention of network security incidents. By collecting, analyzing and storing system logs, enterprises can promptly discover and respond to network security incidents and improve the security and stability of the system.

[0003] Currently, to extract system logs from the syslog server of each network device, it is necessary to download the syslog server, manually extract the logs, and send the extracted log information to the firewall device. In this process, manual extraction and manual sending will result in time delays and human errors, which will lead to the inability to handle network security incidents in a timely and accurate manner.

[0004] Therefore, there is an urgent need for a system log and firewall linkage method that can connect network devices and devices through middleware, monitor the system logs of network devices in real time, and enable the firewall to implement corresponding security measures for network security incidents in a timely and accurate manner. Summary of the invention

[0005] In view of this, it is necessary to provide a method, device, equipment and storage medium for linking system logs with firewalls, which can connect network devices with devices through middleware, monitor the system logs of network devices in real time, and enable the firewall to implement corresponding security measures for network security incidents in a timely and accurate manner.

[0006] In order to solve the above technical problems, on the one hand, the present invention provides a system log and firewall linkage method, comprising: Define a configuration file, which includes device connection information, log parsing rules, and blocking rules; Building a connection path between the network device and the firewall based on the preset middleware and the device connection information; When the network device is successfully connected to the firewall, a real-time system log in the network device is obtained, the real-time system log is parsed according to the log parsing rule, and the information in the parsed system log is matched according to the blocking rule to generate a blocking log; The blocking log is sent to the firewall, and the IP addresses in the blocking log are blocked.

[0007] In a possible implementation, the configuration file definition includes: Determine device connection information based on the information of network devices and firewalls that need to be monitored; Determine log parsing rules based on the log type, log level, and log message that need to be processed; Determine the ban rules based on the ban target.

[0008] In a possible implementation, the device connection information includes: the IP address and port of the network device, the designated IP address and port for monitoring, the IP address of the firewall, and the authentication user name and password.

[0009] In a possible implementation, the log parsing rule includes: a regular log type field, a regular log level field, and a regular log message field.

[0010] In a possible implementation, the blocking rules include: a regular blocking IP address, a blocking alarm log type, a blocking alarm log level, and a blocking policy corresponding to each blocking alarm log level and type.

[0011] In a possible implementation, obtaining a real-time system log in a network device and parsing the real-time system log according to the log parsing rule includes: Start the monitoring function of the preset middleware to obtain the system log in the network device; The log type, log level and log message of the system log are parsed according to the log parsing rules to generate parsed log information.

[0012] In a possible implementation, extracting information from the parsed system log according to the blocking rule to generate a blocking log includes: Based on the regular banned IP address, extract the IP address to be banned in the parsed log information and its corresponding log level, log type and log message to generate IP ban information; Based on the blocking alarm log type and blocking alarm log level and the blocking policies corresponding to each blocking alarm log level and type, an IP blocking policy is generated according to the corresponding matching log information in the parsed log information; The IP blocking information and IP blocking policy constitute a blocking log.

[0013] In a second aspect, the present invention further provides a system log and firewall linkage device, comprising: A configuration file definition module is used to define a configuration file, wherein the configuration file includes device connection information, log parsing rules, and blocking rules; A connection module, used to build a connection path between the network device and the firewall based on the preset middleware and the device connection information; A log extraction module, used for obtaining the real-time system log in the network device after the network device is successfully connected to the firewall, parsing the real-time system log according to the log parsing rule, and matching the information in the parsed system log according to the blocking rule to generate a blocking log; The blocking module is used to send the blocking log to the firewall and block the IP addresses in the blocking log.

[0014] In a third aspect, the present invention further provides a device, including a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the above-mentioned system log and firewall linkage method.

[0015] In a fourth aspect, the present invention further provides a computer storage medium for storing computer-readable programs or instructions, which, when executed by a processor, can implement the system log and firewall linkage method as described above.

[0016] The beneficial effects of the present invention are as follows: first, a configuration file is defined, the configuration file includes device connection information, log parsing rules and blocking rules; then, based on the preset middleware, a connection path between a network device and a firewall is constructed according to the device connection information; when the network device is successfully connected to the firewall, a real-time system log in the network device is obtained, the real-time system log is parsed according to the log parsing rules, and the information in the parsed system log is matched according to the blocking rules to generate a blocking log; finally, the blocking log is sent to the firewall to block the IP address in the blocking log. The present invention connects the network device and the firewall according to the connection information in the configuration file through the preset middleware, and when the connection is successful, the real-time system log in the network device is monitored and processed, the real-time system log is parsed according to the log parsing rules, the information in the parsed system log is extracted according to the blocking rules, and the extracted IP information that needs to be blocked is sent to the firewall, so that the real-time monitoring and extraction of the system log is realized, and the monitored and extracted log information is sent to the firewall in real time, so that the firewall can block the IP that needs to be blocked in a timely and accurate manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A schematic diagram of an embodiment of the system log and firewall linkage method provided by the present invention; Figure 2 The present invention provides Figure 1 A schematic flow chart of an embodiment of step S101; Figure 3 The present invention provides Figure 1 A schematic flow chart of a first embodiment of step S103; Figure 4 A schematic diagram of information for connecting a firewall and a network device with the middleware EBG Connecter provided by the present invention; Figure 5 The present invention provides Figure 1 A schematic flow chart of a second embodiment of step S103; Figure 6 A schematic diagram of the structure of an embodiment of the system log and firewall linkage device provided by the present invention; Figure 7 A schematic diagram of the structure of an embodiment of the system log and firewall linkage storage medium provided by the present invention. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0020] In the description of the embodiments of the present invention, unless otherwise specified, "multiple" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone.

[0021] The descriptions of "first", "second", etc. involved in the embodiments of the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" or "second" may explicitly or implicitly include at least one of the features.

[0022] Reference to an "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0023] The present invention provides a system log and firewall linkage method, device, equipment and storage medium, which are described below respectively.

[0024] Figure 1 A flow chart of an embodiment of the system log and firewall linkage method provided by the present invention is as follows: Figure 1 As shown in the figure, the linkage method between system log and firewall includes: S101, defining a configuration file, where the configuration file includes device connection information, log parsing rules, and blocking rules; S102, constructing a connection path between the network device and the firewall based on the preset middleware and device connection information; S103, when the network device is successfully connected to the firewall, obtain the real-time system log in the network device, parse the real-time system log according to the log parsing rule, and match the information in the parsed system log according to the blocking rule to generate a blocking log; S104: Send the blocking log to the firewall, and block the IP addresses in the blocking log.

[0025] Specifically, first, a configuration file containing necessary information and rules is created, including device connection information, log parsing rules and blocking rules, wherein the device connection information includes the IP address, port information and authentication information between the network device and the monitoring device and the firewall, the log parsing rules include defining how to extract key information from the system log of the network device, such as event type, event level, source IP address, target IP address, etc., the blocking rule is to issue corresponding blocking operations for matching log entries, such as from a specific IP address, or a specific event level and event type; the preset middleware is used to establish a secure connection between the network device and the firewall. This embodiment constructs an intermediate software EBG Connecter for realizing the linkage and blocking of the firewall product with other network devices. After the connection is successful, the system log of the network device is parsed by EBG Connecter, the attack source address is found from the system log, and this address is sent to the blacklist of the firewall, which is blocked by the firewall, thereby realizing a simple linkage effect.

[0026] This embodiment connects the network device and the firewall according to the connection information in the configuration file through the preset middleware. When the connection is successful, the real-time system log in the network device is monitored and processed, the real-time system log is parsed according to the log parsing rules, the information in the parsed system log is extracted according to the blocking rules, and the extracted IP information that needs to be blocked is sent to the firewall, thereby realizing real-time monitoring and extraction of the system log, and sending the monitored and extracted log information to the firewall in real time, so that the firewall can block the IP that needs to be blocked in a timely and accurate manner.

[0027] In some embodiments of the present invention, Figure 2 As shown, Figure 2 The present invention provides Figure 1 The flowchart of an embodiment of step S101 in FIG. 1 is a flowchart of a method for defining a configuration file, comprising: S201, determining device connection information according to the information of the network device and firewall that needs to be monitored; S202, determining log parsing rules according to the log type, log level and log message to be processed; S203: Determine a blocking rule according to the blocking target.

[0028] It should be noted that system logs usually follow a certain format, including timestamp, host name, log level, log type, and specific log content.

[0029] Specifically, for device connection information, the IP address, port number, protocol type, authentication method and other information of the network device and server to be monitored are defined in the configuration file. In this embodiment, the device connection information in the configuration file can be added, modified and deleted according to actual needs; the log parsing rule is to parse the system log according to the log type, log level and corresponding log message to be processed, and the log information that does not need to be processed does not need to be processed, thereby reducing unnecessary workload and improving the efficiency of log parsing; the blocking rule needs to clarify which behaviors or entities need to be blocked, such as specific IP addresses, domain names, user accounts, etc. , define the specific conditions that trigger the ban, such as the number of failed login attempts, the rate of sending malicious traffic, etc., set specific ban measures, different log types or different log levels, set different ban measures, such as blocking network connections, restricting access rights, triggering alarms, etc.; in addition, according to changes in the security situation and actual needs, regularly adjust and optimize log parsing rules and ban rules. It is understandable that in the configuration file process, in addition to the above three types of files, it is also necessary to formulate corresponding configuration file contents according to actual needs, such as whether to record log information, whether to issue log record file names, original alarm log record file names, and the source of issued blacklists.

[0030] This embodiment defines the device connection information, log parsing rules and blocking rules in the configuration file according to actual needs.

[0031] In some embodiments of the present invention, the device connection information includes: the IP address and port of the network device, the designated IP address and port for monitoring, the IP address of the firewall, and the authentication user name and password.

[0032] Specifically, in this embodiment, the device connection information is in utf-8 encoding format, and its content mainly includes the IP address, service port and cache space of the network device, the IP address, port, authentication user name and password of the monitoring device, and the IP address, authentication user name and password of the firewall.

[0033] In some embodiments of the present invention, the log parsing rule includes: a regular log type field, a regular log level field, and a regular log message field.

[0034] Specifically, log parsing is an important step in processing and monitoring log data. It extracts key information from logs by defining rules. Regular expressions are used to match and extract specific log types, log levels, and log messages from logs, and then parse them out. Log information that does not need to be processed does not need to be processed, thus reducing unnecessary workload and improving the efficiency of log parsing.

[0035] In some embodiments of the present invention, the blocking rules include: regular blocking IP addresses, blocking alarm log types, blocking alarm log levels, and blocking policies corresponding to each blocking alarm log level and type.

[0036] It should be noted that regular expressions are used to match and block IP addresses with specific patterns. For example, to block all IP addresses with a specific prefix, when the regular expression value of an IP address is "^192\.168\.1\.\d{1,3}", it means that all IP addresses with the form "192.168.1.x" will be blocked. To block IP addresses containing specific strings, when the regular expression value of an IP address is "\.bad\.ip", it means that all IP addresses ending with ".bad.ip" will be blocked.

[0037] It should be further explained that common log types include login logs for recording user login behaviors, access logs for recording access to system resources, operation logs for recording user operations on the system, and error logs for recording errors that occur during system operation; the ban and alarm log levels are used to distinguish the classification system of log importance or severity, including DEBUG debugging information for information recording during the development process, INFO general information for recording the normal operation of the system, NOTICE attention information for indicating normal but noteworthy events, and WARN warning information for indicating potential problems. ERROR error information is used to indicate that an error has occurred in the system that needs to be handled. FATAL fatal errors are used to indicate that the system cannot continue to operate, and ALERT alert information is used to indicate situations that require immediate action.

[0038] Specifically, the log type and log level are combined to specify the corresponding blocking strategy, as shown in Table 1. Table 1 lists the blocking strategies corresponding to some log levels and log types in this embodiment. At the same time, these blocking strategies need to be periodically adjusted and optimized according to the specific system environment and security requirements to ensure the effectiveness and maintainability of the rules.

[0039] Table 1. Banning policies corresponding to log levels and log types

[0040] This embodiment processes system logs safely and accurately by assigning different blocking policies to different log types and different log levels.

[0041] In some embodiments of the present invention, Figure 3 As shown, Figure 3 The present invention provides Figure 1The flowchart of the first embodiment of step S103 in the embodiment of the present invention is to obtain the real-time system log in the network device and parse the real-time system log according to the log parsing rule, including: S301, start the monitoring function of the preset middleware to obtain the system log in the network device; S302: Parse the log type, log level and log message of the system log according to the log parsing rules to generate parsed log information.

[0042] It should be noted that this embodiment builds a middleware EBG Connecter, which is used to connect the firewall product with other network devices, realize real-time analysis of system logs, and download the blocked IP to the firewall. When the firewall and the network device are successfully connected using the middleware EBG Connecter, the connection success information is displayed, such as Figure 4 As shown, Figure 4 The information schematic diagram of the middleware EBG Connecter provided by the present invention connecting the firewall and the network device, parses the system log of the network device through EBG Connecter, finds the attack source address from the system log, and sends this address to the blacklist of the firewall, which is blocked by the firewall, thereby achieving a simple linkage effect. When the network device is successfully connected to the firewall, the monitoring function of the middleware EBG Connecter is started, and the middleware EBG Connecter begins to receive the system log of the network device, processes the system log related information according to the log parsing rules, and extracts the matching log type, log level and log message to obtain the parsed log information.

[0043] This embodiment connects the network device to the firewall through the middleware, and can automatically obtain the real-time system log of the network device.

[0044] In some embodiments of the present invention, Figure 5 As shown, Figure 5 The present invention provides Figure 1 The flowchart of the second embodiment of step S103 in the embodiment of the present invention is to obtain the real-time system log in the network device and parse the real-time system log according to the log parsing rule, including: S501, based on the regular banned IP address, extract and parse the IP address to be banned in the log information and its corresponding log level, log type and log message, and generate IP ban information; S502, based on the blocking alarm log type and blocking alarm log level and the blocking policies corresponding to each blocking alarm log level and type, generate an IP blocking policy according to the corresponding matching log information in the parsed log information; S503, IP blocking information and IP blocking policy constitute a blocking log.

[0045] Specifically, define one or more regular expressions to match the IP addresses that need to be blocked, read and parse the log information, use the defined regular expressions to match the IP addresses in the log information, and extract the log levels (such as ERROR, WARNING, etc.), log types (such as access logs, error logs, etc.) and log messages (specific log content) associated with these IP addresses.

[0046] Furthermore, different blocking policies are defined for different log types and different log levels, log information is read and parsed, and system logs of corresponding log types and log levels are matched with corresponding blocking policies.

[0047] This embodiment sets different blocking policies for different log types and log levels, and can make real-time analysis and decisions on the read system logs, providing data support for firewall blocking.

[0048] In order to better implement the system log and firewall linkage method in the embodiment of the present invention, based on the system log and firewall linkage method, correspondingly, Figure 6 As shown, the embodiment of the present invention further provides a system log and firewall linkage device 600 including: A configuration file definition module 601 is used to define a configuration file, wherein the configuration file includes device connection information, log parsing rules, and blocking rules; A connection module 602, used to build a connection path between the network device and the firewall based on the preset middleware and device connection information; The log extraction module 603 is used to obtain the real-time system log in the network device after the network device is successfully connected to the firewall, parse the real-time system log according to the log parsing rule, and match the information in the parsed system log according to the blocking rule to generate a blocking log; The blocking module 604 is used to send the blocking log to the firewall and block the IP addresses in the blocking log.

[0049] The system log and firewall linkage device 600 provided in the above embodiment can implement the technical solution described in the above system log and firewall linkage method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above system log and firewall linkage method embodiment, which will not be repeated here.

[0050] In the embodiment of the present invention, the system log and firewall linkage device can be an independent server, or a server network or server cluster composed of servers. For example, the system log and firewall linkage device described in the embodiment of the present invention includes but is not limited to a computer, a network host, a single network server, a plurality of network server sets or a cloud server composed of multiple servers. The cloud server is composed of a large number of computers or network servers based on cloud computing.

[0051] like Figure 7 As shown, the present invention also provides a system log and firewall linkage device 700. The system log and firewall linkage device 700 includes a processor 701, a memory 702 and a display 703. Figure 7 Only some components of the system log and firewall linkage device 700 are shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

[0052] In some embodiments, the processor 701 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 702, such as the system log and firewall linkage method of the present invention.

[0053] In some embodiments of the present invention, the processor 701 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, the processor 701 may be local or remote. In some embodiments, the processor 701 may be implemented in a cloud platform. In one embodiment, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.

[0054] In some embodiments, the memory 702 may be an internal storage unit of the system log and firewall linkage device 700, such as a hard disk or memory of the system log and firewall linkage device 700. In other embodiments, the memory 702 may also be an external storage device of the system log and firewall linkage device 700, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the system log and firewall linkage device 700.

[0055] Furthermore, the memory 702 may include both an internal storage unit and an external storage device of the system log and firewall linkage device 700. The memory 702 is used to store application software for installing the system log and firewall linkage device 700 and various data.

[0056] In some embodiments, the display 703 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 703 is used to display information of the system log and firewall linkage device 700 and to display a visual user interface. The components 701-703 of the system log and firewall linkage device 700 communicate with each other through a system bus.

[0057] In some embodiments of the present invention, when the processor 701 executes the system log and firewall linkage program in the memory 702, the following steps may be implemented: Define configuration files, which include device connection information, log parsing rules, and blocking rules; Building a connection path between network devices and firewalls based on preset middleware and device connection information; When the network device is successfully connected to the firewall, the real-time system log in the network device is obtained, the real-time system log is parsed according to the log parsing rule, and the information in the parsed system log is matched according to the banning rule to generate a banning log; Send the blocking log to the firewall and block the IP addresses in the blocking log.

[0058] It should be understood that: when the processor 701 executes the system log and firewall linkage program in the memory 702, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.

[0059] Furthermore, the embodiment of the present invention does not specifically limit the type of the system log and firewall linkage device 700 mentioned. The system log and firewall linkage device 700 can be a portable system log and firewall linkage device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable system log and firewall linkage devices include but are not limited to portable system log and firewall linkage devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable system log and firewall linkage device can also be other portable system log and firewall linkage devices. It should also be understood that in some other embodiments of the present invention, the system log and firewall linkage device 700 may not be a portable system log and firewall linkage device, but a desktop computer with a touch-sensitive surface (such as a touch panel).

[0060] Correspondingly, an embodiment of the present invention also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, the steps or functions in the system log and firewall linkage method provided in the above-mentioned method embodiments can be implemented.

[0061] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0062] The system log and firewall linkage method, device, equipment and storage device provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for linking system logs with firewalls, characterized in that: include: Define a configuration file, which includes device connection information, log parsing rules, and blocking rules; Building a connection path between the network device and the firewall based on the preset middleware and the device connection information; When the network device is successfully connected to the firewall, a real-time system log in the network device is obtained, the real-time system log is parsed according to the log parsing rule, and the information in the parsed system log is matched according to the blocking rule to generate a blocking log; The blocking log is sent to the firewall, and the IP addresses in the blocking log are blocked.

2. The system log and firewall linkage method according to claim 1, characterized in that: The definition configuration file includes: Determine device connection information based on the information of the network devices and firewalls that need to be monitored; Determine log parsing rules based on the log type, log level, and log message that need to be processed; Determine the ban rules based on the ban target.

3. The system log and firewall linkage method according to claim 2, characterized in that: The device connection information includes: the IP address and port of the network device, the designated IP address and port for monitoring, the IP address of the firewall, the authentication user name and password.

4. The system log and firewall linkage method according to claim 3, characterized in that: The log parsing rules include: a regular log type field, a regular log level field and a regular log message field.

5. The system log and firewall linkage method according to claim 4, characterized in that: The blocking rules include: regular blocking IP addresses, blocking alarm log types, blocking alarm log levels, and blocking policies corresponding to each blocking alarm log level and type.

6. The system log and firewall linkage method according to claim 5, characterized in that: Acquiring a real-time system log in a network device and parsing the real-time system log according to the log parsing rule includes: Start the monitoring function of the preset middleware to obtain the system log in the network device; The log type, log level and log message of the system log are parsed according to the log parsing rules to generate parsed log information.

7. The system log and firewall linkage method according to claim 5, characterized in that: Extracting information from the parsed system log according to the blocking rule to generate a blocking log includes: Based on the regular banned IP address, extract the IP address to be banned in the parsed log information and its corresponding log level, log type and log message to generate IP ban information; Based on the blocking alarm log type and blocking alarm log level and the blocking policies corresponding to each blocking alarm log level and type, an IP blocking policy is generated according to the corresponding matching log information in the parsed log information; The IP blocking information and IP blocking policy constitute a blocking log.

8. A system log and firewall linkage device, characterized in that: include: A configuration file definition module is used to define a configuration file, wherein the configuration file includes device connection information, log parsing rules, and blocking rules; A connection module, used to build a connection path between the network device and the firewall based on the preset middleware and the device connection information; A log extraction module, used for obtaining the real-time system log in the network device after the network device is successfully connected to the firewall, parsing the real-time system log according to the log parsing rule, and matching the information in the parsed system log according to the blocking rule to generate a blocking log; The blocking module is used to send the blocking log to the firewall and block the IP addresses in the blocking log.

9. A system log and firewall linkage device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the system server and firewall linkage method described in any one of claims 1 to 7 above.

10. A storage medium, characterized in that: The storage medium stores computer program instructions, and when the computer program instructions are executed by a computer, the computer executes the system log and firewall linkage method according to any one of claims 1 to 7.

Images