Multi-source log data association analysis method for security service

Abstract

The invention relates to the technical field of network security big data analysis, and discloses a security service-oriented multi-source log data association analysis method, which comprises the following steps of: obtaining network behavior data; the network behavior data comprises stream data and domain name data; for the domain name data, performing data aggregation in a specified time window according to a source IP, a request domain name and a request type to obtain each first data set; for the streaming data, performing data aggregation in a specified time window according to a quintuple of the streaming data to obtain each second data set; associating each first data set with each second data set according to an IP address or a domain name to obtain a log set; and performing network security analysis on the log set to obtain an analysis result. According to the invention, the accuracy and efficiency of network security analysis can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security big data analysis, and in particular to a multi-source log data correlation analysis method for security services. Background Art

[0002] In the process of network security analysis, it is necessary to conduct unified correlation analysis on security data from multiple sources, including traffic logs and protocol analysis logs at various levels such as http, dns, etc. The upper-level analysis services or scenarios are numerous and complex, and often grow with the expansion of analysis requirements. In most cases, network security log data is different from ordinary non-security data and has security-specific attributes. For example, the impact of an attack on one IP on another target IP will vary in importance in network traffic or timing behavior. The timing behavior of the attack needs to be considered in the correlation analysis. Due to the complexity of network attacks, when multiple services are analyzed simultaneously, the traditional method of collision correlation through field attributes cannot efficiently correlate the timing process of the attack, resulting in low accuracy of security analysis. Summary of the invention

[0003] In view of this, the present invention provides a multi-source log data association analysis method for security business to improve the accuracy and efficiency of network security analysis.

[0004] In a first aspect, the present invention provides a multi-source log data association analysis method for security services, the method comprising: acquiring network behavior data; the network behavior data comprising flow data and domain name data; for the domain name data, performing data aggregation within a specified time window according to the source IP, request domain name and request type to obtain each first data set; for the flow data, performing data aggregation within a specified time window according to the quintuple of the flow data to obtain each second data set; associating each first data set with each second data set according to the IP address or domain name to obtain a log set; performing network security analysis on the log set to obtain an analysis result.

[0005] In an optional implementation, each first data set is associated with each second data set according to an IP address or domain name to obtain a log set, including: obtaining a target entity object; the target entity object is an IP address or domain name; integrating the first data set and the second data set where the target entity object is located to obtain a log set.

[0006] In an optional embodiment, each first data set is associated with each second data set according to the IP address or domain name to obtain a log set, including: if it is detected that within a specified time period after the target source IP address requests the domain name data, the resolved IP address corresponding to the target domain name establishes communication with the target source IP address, then the first data set and the second data set where the target IP address and the target domain name are respectively located are integrated to obtain a log set.

[0007] In an optional embodiment, the method also includes: dividing the domain name data according to specified time intervals to obtain a first statistical distribution; the first statistical distribution includes the source IP address in the domain name data in each time interval; dividing the flow data according to specified time intervals to obtain a second statistical distribution; the second statistical distribution includes the source IP address and the target IP address in the flow data in each time interval; in the first statistical distribution and the second statistical distribution, the source IP address and the target IP address are screened according to specified rules to detect whether the resolved IP address corresponding to the target domain name and the target source IP address establish communication within a specified time period after the target source IP address requests the domain name data; the specified rule includes matching the source IP address in the nth time interval of the first statistical distribution with the source IP address and the target IP address in the nth or n+1th time interval of the second statistical distribution.

[0008] In an optional embodiment, obtaining network behavior data includes: obtaining initial behavior data; the initial behavior data includes initial flow data and initial domain name data; according to a preset whitelist, the initial flow data and the initial domain name data are filtered out to obtain network behavior data; the preset whitelist includes at least one of a preset public domain name and a preset IP address.

[0009] In an optional embodiment, the method also includes: when it is detected in the first data set that the frequency of candidate source IP address request txt records is greater than a first threshold, the candidate source IP address is marked as abnormal; when it is detected in the second data set that the total traffic of candidate flow data requests within a specified time window is greater than a second threshold, the source IP address and target IP address corresponding to the candidate flow data are marked as abnormal.

[0010] In a second aspect, the present invention provides a multi-source log data correlation analysis device for security services, the device comprising: a behavior data acquisition module for acquiring network behavior data; the network behavior data includes flow data and domain name data;

[0011] The first set acquisition module is used to perform data aggregation within a specified time window for domain name data according to the source IP, request domain name and request type to obtain each first data set; the second set acquisition module is used to perform data aggregation within a specified time window for stream data according to the quintuple of stream data to obtain each second data set; the log set acquisition module is used to associate each first data set with each second data set according to the IP address or domain name to obtain a log set; the network security analysis module is used to perform network security analysis on the log set to obtain analysis results.

[0012] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the multi-source log data correlation analysis method for security business according to the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0013] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the multi-source log data correlation analysis method for security services according to the first aspect or any corresponding embodiment thereof.

[0014] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the multi-source log data correlation analysis method for security services according to the first aspect or any corresponding embodiment thereof.

[0015] The technical solution provided by this application may have the following beneficial effects:

[0016] Acquiring network behavior data (including flow data and domain name data) provides a data basis for subsequent steps. For domain name data, data aggregation is performed within a specified time window according to the source IP, request domain name, and request type to obtain each first data set, providing a data structure for subsequent correlation analysis. For flow data, data aggregation is performed within a specified time window according to the five-tuple of flow data, which can distinguish different network flows, retain the key features of the flow, and obtain each second data set. By associating domain name data and flow data by IP address or domain name, a log set is obtained, thereby realizing the integration of multi-source log data. Perform network security analysis on the log set to obtain analysis results. The above scheme realizes efficient correlation analysis of multi-source log data through data acquisition, data aggregation, data association and network security analysis, thereby improving the accuracy and efficiency of network security analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flowchart of a multi-source log data correlation analysis method for security business according to an embodiment of the present invention;

[0019] Figure 2 is a flow chart of a method for performing association analysis on a data source according to an optional embodiment of the present invention;

[0020] Figure 3 is a flow chart of a method for detecting abnormal IP addresses based on multi-source log data according to an optional embodiment of the present invention;

[0021] Figure 4 is a structural block diagram of a multi-source log data correlation analysis device for security services according to an embodiment of the present invention;

[0022] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0024] According to an embodiment of the present invention, an embodiment of a multi-source log data correlation analysis method for security business is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] In this embodiment, a multi-source log data correlation analysis method for security business is provided. Figure 1 FIG. 1 is a flow chart of a multi-source log data correlation analysis method for security services according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0026] Step S101, obtaining network behavior data; the network behavior data includes flow data and domain name data.

[0027] Network behavior data refers to the data generated by various operations performed by devices on the network in a network environment. Network behavior data includes security event data, flow data, domain name data, URL log data, etc. It can also introduce external threat intelligence, whois domain name registration data, etc.

[0028] Step S102, for the domain name data, data aggregation is performed within a specified time window according to the source IP, the request domain name and the request type to obtain various first data sets.

[0029] The domain name data is processed by first filtering out irrelevant data by setting a whitelist, and then aggregating the data within a specified time window (such as 5 minutes) according to the source IP, request domain name, and request type. The aggregated data will form a first data set including statistical information.

[0030] In an optional embodiment of the present invention, the time window grouping and aggregation is specifically as follows:

[0031] 1) Set a time window, usually 5 minutes. The window size is determined by the amount of data to be processed and the performance to be processed. It should not be too large or too small. A large window will result in data accumulation, while a small window will not achieve the purpose of association processing.

[0032] 2) Receive the data stream from the data bus and perform real-time processing according to the time window, including two steps: grouping, aggregation, statistics, and label mapping;

[0033] 3) For group aggregation statistics, different grouping strategies are adopted for flow data and domain name data, specifically the following strategies:

[0034] For domain name data: The grouping strategy is to deduplicate and aggregate the same source IP, request domain name, and request type within the set time window, and obtain the data set in Table 1:

[0035] Table 1 The second data set

[0036]

[0037] The start_time and end_time identify the window size for the aggregation analysis, and the key values ​​in the domain name data are retained and aggregated.

[0038] Step S103 , for the stream data, data aggregation is performed within a specified time window according to the quintuples of the stream data to obtain respective second data sets.

[0039] Similarly, after data filtering, data aggregation is performed within a specified time window according to the five-tuple (source IP, source port, destination IP, destination port, protocol) of the flow data. The aggregated data will form a second data set including statistical information.

[0040] In an optional embodiment of the present invention, grouping and aggregation are performed according to the quintuple to obtain the data set in Table 2:

[0041] Table 2 Second data set

[0042] Fields meaning Remark sip Source IP Grouping Field dip Destination IP Grouping Field sport Source Port Grouping Field dport Destination Port Grouping Field proto_ protocol Grouping Field start_time Start time end_time End Time win_type Window size type 5 minutes c_packets Total number of packets in the time window c_bytes Total number of bytes in the time window

[0043] The start_time and end_time indicate the window size for the aggregate analysis. The number of packets and bytes in the traffic log are summed to obtain the total data in the window, and the summed value is retained and aggregated.

[0044] Step S104: Associating each first data set with each second data set according to the IP address or domain name to obtain a log set.

[0045] The association method can be entity association (such as IP address or domain name) or time series association (such as observing the time series relationship of a behavior in two data sources). The associated data forms a log set.

[0046] Specifically, the entity association method is to associate the same analyzed security entity object such as IP or domain name, integrate the log data of this entity in two or more data sources, form an entity behavior log set, and then perform further analysis on it; the time series association method is to observe the time series association method of a behavior in two data sources. For example, after a source IP requests domain name data, a communication log is generated for the resolution value corresponding to this source IP and the domain name within 5 seconds to realize time series association analysis.

[0047] Step S105: perform network security analysis on the log set to obtain analysis results.

[0048] Network security analysis may involve a variety of methods, such as using the Apriori algorithm or other machine learning algorithms to perform in-depth analysis to obtain analysis results.

[0049] Specifically, through the above-mentioned correlation analysis, business correlation analysis of multi-source logs can be performed in the context of business goals, and business applications can directly use the correlated data. Since the correlated data has been pre-aggregated and pre-labeled in the previous steps, some businesses can realize business analysis capabilities without penetrating to the original data layer. At the same time, during the preprocessing or above processing, the common processing requirements of multiple different security businesses can be extracted and set, so that different security business analyses can realize the sharing and use of data processing, thereby improving business application efficiency.

[0050] In summary, the present embodiment provides a multi-source log data correlation analysis method for security business, which realizes efficient correlation analysis of multi-source log data through data acquisition, data aggregation, data correlation and network security analysis, thereby improving the accuracy and efficiency of network security analysis.

[0051] In an optional implementation, the process of step S104 includes:

[0052] Step S1041, obtaining a target entity object; the target entity object is an IP address or a domain name.

[0053] The target entity object can be an IP address or domain name, which are identifiers commonly used in network security analysis to uniquely identify devices or resources on the network.

[0054] Step S1042: Integrate the first data set and the second data set where the target entity object is located to obtain a log set.

[0055] Integrate to form a collection of complete behavior logs of the target entity object for subsequent network security analysis.

[0056] In an optional implementation, the process of step S104 further includes:

[0057] If it is detected that within a specified time period after the target source IP address requests domain name data, the resolved IP address corresponding to the target domain name establishes communication with the target source IP address, the first data set and the second data set where the target IP address and the target domain name are respectively located are integrated to obtain a log set.

[0058] When it is detected that a target source IP address has requested domain name data, it is determined whether the resolution IP address corresponding to the target domain name has established communication with the original target source IP address within a specified time period (such as within 5 seconds, which can be adjusted according to actual needs). If the above timing association condition is met, that is, the target source IP address has established communication with the resolution IP address corresponding to the target domain name within a specified time period after requesting the domain name data, a data integration step is performed. This step integrates the records of the target IP address in the first data set with the records of the target domain name in the second data set.

[0059] Figure 2 FIG. 1 is a flow chart of a method for performing association analysis on a data source according to an optional embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0060] Step S201, divide the domain name data according to the specified time interval to obtain a first statistical distribution; the first statistical distribution includes the source IP address in the domain name data in each time interval.

[0061] The domain name data is divided into a plurality of discrete time periods according to a specified time interval (such as 5 minutes, 10 minutes, etc.), so as to analyze the domain name data in each time period. The domain name data in each time interval includes information such as the source IP address, which will be used to construct the first statistical distribution.

[0062] Step S202: Divide the flow data according to the specified time interval to obtain a second statistical distribution; the second statistical distribution includes the source IP address and the destination IP address in the flow data in each time interval.

[0063] Step S203, in the first statistical distribution and the second statistical distribution, the source IP address and the target IP address are screened according to the specified rules to detect whether the resolved IP address corresponding to the target domain name and the target source IP address have established communication within a specified time period after the target source IP address requests the domain name data; the specified rules include matching the source IP address within the nth time interval of the first statistical distribution with the source IP address and the target IP address within the nth or n+1th time interval of the second statistical distribution.

[0064] The source IP addresses and the target IP addresses in the first statistical distribution and the second statistical distribution are screened and matched according to the specified rules. The rules involve temporal associations, such as checking whether the source IP address in the nth time interval of the first statistical distribution has a communication record with the target IP address in the nth or n+1th time interval of the second statistical distribution, and detecting whether the resolved IP address corresponding to the target domain name has established communication with the target source IP address within a specified time period after the target source IP address requests the domain name data.

[0065] Specific methods include:

[0066] Separate the flow data and domain name data by timestamp, such as dividing it into a time period of 5 seconds. For the domain name data, each segment retains the statistical value of the current source IP to form a statistical distribution:

[0067] (A1,A2,…,A N ),

[0068] Where N is the total number of all IPs, and each value corresponds to the number of times each IP appears in the current segment. If it does not appear, it is 0.

[0069] For the flow data, count the source IP and destination IP pairs, and perform the same operation as above to obtain another statistical distribution:

[0070] (B1,B2,…,B m ),

[0071] B is the number of occurrences of each corresponding IP pair in the current segment of the stream data, and M is the number of all IP pairs. The maximum value is N*N, and the actual environment may be much smaller than this value.

[0072] According to the source IP of the current segment of the domain name data, by associating the stream data segment with the segment of the same timestamp or the next segment (next 5 seconds) with the peer IP of the domain name, the source IP and destination IP that meet the rules are filtered out while retaining their time segments.

[0073] Based on the Apriori algorithm, the abnormal IP pairs are mined. Apriori is an association rule analysis method that calculates frequent rules through the support and confidence of the item set, thereby generating strong association rules. In the present invention, the source IP and destination IP pairs obtained by the above rule analysis can be regarded as an item set, which calculates the support and confidence of the IP pair in the time series association by the number of occurrences of the above rule association. Through the Apriori algorithm, the IP pair set with the highest support (such as TOP10) is mined as a candidate for further analysis.

[0074] In an optional implementation, the process of step S101 includes:

[0075] Step S1011, obtaining initial behavior data; the initial behavior data includes initial flow data and initial domain name data.

[0076] The original data obtained for network behavior analysis is the initial behavior data. The initial behavior data includes the initial flow data and the initial domain name data. The initial flow data records the flow of data packets in the network, such as source IP, destination IP, source port, destination port, protocol type, etc., while the initial domain name data records the relevant information of the domain name request, such as the requested domain name, the requested source IP, etc.

[0077] Step S1012, according to a preset whitelist, the initial flow data and the initial domain name data are screened to obtain network behavior data; the preset whitelist includes at least one of a preset public domain name and a preset IP address.

[0078] After obtaining the initial behavior data, the data is filtered according to the preset whitelist. The preset public domain names and IP addresses are not directly related to network security analysis, or are known security sources. The initial flow data and initial domain name data are checked one by one. If a data item (such as a domain name or IP address) appears in the preset whitelist, it is removed from the initial behavior data.

[0079] Specifically, the whitelist settings can be targeted according to business needs. For example, when analyzing abnormal domain name request behavior, the whitelist can be set to the TOP10000 common active domain names to filter out requests for these common domain names.

[0080] Figure 3 is a flow chart of a method for detecting abnormal IP addresses based on multi-source log data according to an optional embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0081] Step S301: when it is detected in the first data set that the frequency of requesting txt records by a candidate source IP address is greater than a first threshold, the candidate source IP address is marked as abnormal.

[0082] Monitor the frequency of candidate source IP addresses requesting txt records (such as TXT records in DNS queries, which are usually used to store text information, such as SPF records, etc.). When the frequency of a candidate source IP address requesting txt records exceeds a preset first threshold, the source IP address will be marked as abnormal.

[0083] Step S302: When it is detected in the second data set that the total flow of candidate flow data requests within the specified time window is greater than a second threshold, the source IP address and the target IP address corresponding to the candidate flow data are marked as abnormal.

[0084] Monitor the total traffic of candidate flow data requests within the specified time window. When the total traffic of the source IP address or target IP address corresponding to a candidate flow data within the specified time window exceeds the preset second threshold, these IP addresses will be marked as abnormal.

[0085] In summary, the present invention establishes a unified correlation analysis technology for multiple types of case log data, extracts the common points of different business processing, establishes a common data processing process, enables different businesses to use the processed common data set, reduces repeated processing processes, and thus improves the efficiency of security business analysis. At the same time, due to the complexity of network attacks, the correlation process is usually divided into multiple attack stages from the attacker's perspective. The general data correlation processing process cannot support the security analysis business well. This patent fully reflects the data correlation processing based on the correlation analysis process of the attack timing process on the basis of fully considering the security business, and improves the effect of log correlation analysis.

[0086] In this embodiment, a multi-source log data association analysis device for security business is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0087] This embodiment provides a multi-source log data correlation analysis device for security services, such as Figure 4 As shown, including:

[0088] The behavior data acquisition module 401 is used to acquire network behavior data; the network behavior data includes flow data and domain name data;

[0089] The first set acquisition module 402 is used to aggregate the domain name data within a specified time window according to the source IP, the request domain name and the request type to obtain each first data set;

[0090] The second set acquisition module 403 is used to perform data aggregation within a specified time window according to the five-tuple of the stream data to obtain each second data set;

[0091] The log set obtaining module 404 is used to associate each first data set with each second data set according to the IP address or domain name to obtain a log set;

[0092] The network security analysis module 405 is used to perform network security analysis on the log set to obtain analysis results.

[0093] In an optional implementation, the log set obtaining module 404 includes:

[0094] The first log set obtaining unit is used to obtain a target entity object; the target entity object is an IP address or a domain name.

[0095] The second log set obtaining unit is used to integrate the first data set and the second data set where the target entity object is located to obtain a log set.

[0096] In an optional implementation, the log set obtaining module 404 is further used to:

[0097] If it is detected that within a specified time period after the target source IP address requests domain name data, the resolved IP address corresponding to the target domain name establishes communication with the target source IP address, the first data set and the second data set where the target IP address and the target domain name are respectively located are integrated to obtain a log set.

[0098] In an optional implementation, the device further includes an address screening module, and the address screening module includes:

[0099] A first address screening unit, used to divide the domain name data according to a specified time interval to obtain a first statistical distribution; the first statistical distribution includes a source IP address in the domain name data within each time interval;

[0100] A first address screening unit is used to divide the flow data according to a specified time interval to obtain a second statistical distribution; the second statistical distribution includes a source IP address and a destination IP address in the flow data within each time interval;

[0101] The first address screening unit is used to screen the source IP address and the target IP address in the first statistical distribution and the second statistical distribution according to the specified rules, so as to detect whether the resolved IP address corresponding to the target domain name and the target source IP address have established communication within a specified time period after the target source IP address requests the domain name data; the specified rules include matching the source IP address within the nth time interval of the first statistical distribution with the source IP address and the target IP address within the nth or n+1th time interval of the second statistical distribution.

[0102] In an optional implementation, the behavior data acquisition module 401 includes:

[0103] The first behavior acquisition unit is used to acquire initial behavior data; the initial behavior data includes initial flow data and initial domain name data.

[0104] The second behavior acquisition unit is used to filter out the initial flow data and the initial domain name data according to a preset white list to obtain network behavior data; the preset white list includes at least one of a preset public domain name and a preset IP address.

[0105] In an optional implementation, the method further includes an abnormality marking module, and the abnormality marking module includes:

[0106] The first abnormal marking unit is used to mark the candidate source IP address as abnormal when it is detected in the first data set that the frequency of the candidate source IP address requesting the txt record is greater than a first threshold.

[0107] The second abnormal marking unit is used to mark the source IP address and the target IP address corresponding to the candidate flow data as abnormal when it is detected in the second data set that the total flow of the candidate flow data request within the specified time window is greater than the second threshold.

[0108] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0109] In this embodiment, a multi-source log data correlation analysis device for security services is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0110] The embodiment of the present invention also provides a computer device having the above Figure 4 A multi-source log data correlation analysis device for security services is shown.

[0111] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0112] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0113] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0114] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0115] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0116] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0117] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0118] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0119] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0120] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A multi-source log data correlation analysis method for security business, characterized in that: The method comprises: Acquire network behavior data; the network behavior data includes flow data and domain name data; For the domain name data, data aggregation is performed within a specified time window according to the source IP, the request domain name, and the request type to obtain each first data set; For the stream data, data aggregation is performed within a specified time window according to the five-tuple of the stream data to obtain each second data set; Associating each first data set with each second data set according to the IP address or domain name to obtain a log set; Perform network security analysis on the log set to obtain analysis results.

2. The method according to claim 1, characterized in that The step of associating each first data set with each second data set according to the IP address or domain name to obtain a log set includes: Obtain a target entity object; the target entity object is an IP address or a domain name; The first data set and the second data set where the target entity object is located are integrated to obtain a log set.

3. The method according to claim 1, characterized in that The step of associating each first data set with each second data set according to the IP address or domain name to obtain a log set includes: If it is detected that within a specified time period after the target source IP address requests domain name data, the resolved IP address corresponding to the target domain name establishes communication with the target source IP address, the first data set and the second data set where the target IP address and the target domain name are respectively located are integrated to obtain a log set.

4. The method according to claim 3, characterized in that The method further comprises: Dividing the domain name data according to a specified time interval to obtain a first statistical distribution; the first statistical distribution includes a source IP address in the domain name data within each time interval; Dividing the flow data according to a specified time interval to obtain a second statistical distribution; the second statistical distribution includes a source IP address and a destination IP address in the flow data within each time interval; In the first statistical distribution and the second statistical distribution, the source IP address and the target IP address are screened according to the specified rules to detect whether the resolved IP address corresponding to the target domain name and the target source IP address establish communication within a specified time period after the target source IP address requests the domain name data; the specified rules include matching the source IP address within the nth time interval of the first statistical distribution with the source IP address and the target IP address within the nth or n+1th time interval of the second statistical distribution.

5. The method according to any one of claims 1 to 4, characterized in that: The obtaining of network behavior data includes: Acquire initial behavior data; the initial behavior data includes initial flow data and initial domain name data; According to a preset whitelist, the initial flow data and the initial domain name data are screened to obtain the network behavior data; the preset whitelist includes at least one of a preset public domain name and a preset IP address.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When it is detected in the first data set that the frequency of requesting txt records by the candidate source IP address is greater than a first threshold, the candidate source IP address is marked as abnormal; When it is detected in the second data set that the total flow of candidate flow data requests within the specified time window is greater than the second threshold, the source IP address and the target IP address corresponding to the candidate flow data are marked as abnormal.

7. A multi-source log data correlation analysis device for security services, characterized in that: The device comprises: A behavior data acquisition module, used to acquire network behavior data; the network behavior data includes flow data and domain name data; A first set acquisition module, configured to aggregate the domain name data within a specified time window according to the source IP, the request domain name, and the request type, to obtain each first data set; A second set acquisition module is used to perform data aggregation within a specified time window according to the five-tuple of the stream data to obtain each second data set; A log set acquisition module, used to associate each first data set with each second data set according to an IP address or a domain name to obtain a log set; The network security analysis module is used to perform network security analysis on the log set to obtain analysis results.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the multi-source log data association analysis method for security services described in any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the multi-source log data correlation analysis method for security services according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the multi-source log data correlation analysis method for security services according to any one of claims 1 to 6.

Images