Network security detection method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, and discloses a network security detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining log data of multi-source equipment; analyzing and monitoring the log data to obtain a security event; associating the security event with the historical event to obtain a potential attack target in the security event; determining a risk value of the potential attack target based on a preset risk assessment value between the historical event and the potential attack target, and giving a network security alarm when the risk value is determined to reach a preset threshold value; the problem that a traditional threat detection system lacks a multi-source log automatic association analysis capability and cannot support multi-condition alarm is solved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to network security detection methods, devices, electronic equipment, and storage media. Background Technology

[0002] In current enterprise network security operations and maintenance, the surge in log data volume and the increasing complexity of threats bring dual pressures. Traditional commercial security information and event management systems (SIEM) are not only limited in scalability due to their proprietary storage engines and hardware architecture, but also have functional shortcomings, such as lack of automatic correlation analysis capabilities for multi-source logs and inability to support multi-condition alarms. Summary of the Invention

[0003] This invention provides a network security detection method, device, electronic device, and storage medium to solve the problem that traditional threat detection systems lack the ability to automatically correlate and analyze multi-source logs and cannot support multi-condition alarms.

[0004] In a first aspect, the present invention provides a network security detection method, the method comprising: Acquire log data from multiple sources; Analyze and monitor log data to identify security incidents; By correlating security incidents with historical incidents, potential attack targets within the security incidents can be identified; Based on the preset risk assessment values ​​between historical events and potential attack targets, the risk value of potential attack targets is determined, and a network security alert is issued when the determined risk value reaches a preset threshold.

[0005] By acquiring log data from multiple sources, correlating the data, and extracting security events, the system identifies potential attack targets within these events by associating them with historical events. This eliminates the need for manual association with historical events, improving decision-making efficiency. Based on preset risk assessment values, the system determines the risk value of potential attack targets, enhancing decision-making accuracy. When the risk value is determined to be within a preset threshold, a network security alert is issued, improving threat detection accuracy and enabling threat detection based on multi-condition alert rules.

[0006] In one alternative implementation, log data is analyzed and monitored to obtain security events, including: In response to receiving user-defined filtering rules, the system filters the log data based on the filtering rules to select secure log data. In response to receiving user-defined alarm rules, the system monitors security log data based on these rules to identify security events.

[0007] By using custom filtering rules, the system can filter out the data that users need to analyze from the log data, reducing unnecessary analysis and decision-making processes and data processing volume. Each security log data entry needs further analysis to determine whether it constitutes a real threat. Therefore, based on custom alerting rules, the system can further monitor the security log data to obtain security events, making the network security detection method adaptable to security detection in different industries and enterprises of different sizes. By adaptively adjusting the security log filtering rules and alerting rules, potential attack targets can be identified.

[0008] In one optional implementation, log data is filtered based on filtering rules to select security log data, including: Based on filtering rules, brute-force attack detection, abnormal login detection, and malware activity detection are performed on log data to obtain security event monitoring results. Based on the results of security incident monitoring, security log data is determined.

[0009] By detecting the number of login attempts from the same source address, suspicious processes, and abnormal accounts in the log data, brute-force attack detection, abnormal login detection, and malware detection can be achieved, thereby identifying secure log data and reducing the system's false alarm rate.

[0010] In one optional implementation, security events and historical events are correlated to obtain potential attack targets within the security events, including: Retrieve alarm events that have been triggered in the historical events; Based on preset query rules, specific interfering events that are the same as alarm events that have been triggered in historical events are filtered out from security events, and specific interfering events are excluded. The system invokes preset multi-level nested alarm query conditions in the alarm rules to query non-specific interference events in security events and obtain potential attack targets.

[0011] Security events are events that occur within a specific time period. By associating security events with events that were triggered and issued alarms in the previous time period or earlier, specific interfering events that have already triggered alarms can be eliminated, thereby improving system detection performance and efficiency and reducing the system's false alarm rate.

[0012] In one optional implementation, the risk value of a potential attack target is determined based on a preset risk assessment value between historical events and potential attack targets, including: Obtain the data types and threat categories of potential attack targets; Based on the preset risk assessment values ​​corresponding to preset data types and preset threat types, the risk values ​​of data types and threat types are calculated to determine the risk values ​​of potential attack targets.

[0013] By setting different risk assessment values ​​for different data types and threat categories, multi-condition alarms can be achieved for multi-source log data. This allows the system to issue alarms based on different rules, only issuing alarms after identifying threat data that requires an alarm, thereby optimizing the alarm volume and reducing the system's false alarm rate.

[0014] In one alternative implementation, the method further includes: Retrieve the number of failed login attempts and sensitive data access records from security incidents; Based on the preset report generation template, input the number of failed login attempts and sensitive data access records into the preset report generation template to generate an alarm prompt analysis report.

[0015] Users can design templates based on their own business needs, customize data display content, and extract key indicators to improve system flexibility.

[0016] In one alternative implementation, before analyzing and monitoring log data to obtain a security event, the method further includes: Log data is categorized, cleaned, and uniformly formatted based on its log type.

[0017] By classifying and cleaning log data from multiple sources, security devices from multiple vendors can be classified and cleaned according to different tenants, preventing log data from being stored together simply because it comes from the same type of device, thus improving the ability of automated operation and maintenance.

[0018] Secondly, the present invention provides a network security detection device, the device comprising: The acquisition module is used to acquire log data from multiple sources. The analysis module is used to analyze and monitor log data to identify security events. The association module is used to associate security events with historical events to identify potential attack targets within the security events. The alarm module is used to determine the risk value of potential attack targets based on preset risk assessment values ​​between historical events and potential attack targets, and to issue a network security alarm when the determined risk value reaches a preset threshold.

[0019] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the network security detection method of the first aspect or any corresponding embodiment described above.

[0020] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the network security detection method of the first aspect or any corresponding embodiment described above. Attached Figure Description

[0021] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the first type of network security detection method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a second process of a network security detection method according to an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the reasoning process of a network security detection method according to an embodiment of the present invention; Figure 4 This is a structural block diagram of a network security detection device according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0025] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0026] Currently, in enterprise network security operation and maintenance environments, it is necessary to protect their internal networks through network security detection. An enhanced SIEM system based on OpenSearch is needed to collect and analyze log data from multiple sources to perform risk detection and alerts.

[0027] Currently, enterprise network security operations and maintenance face the dual challenges of a surge in log data volume and increasingly complex threats. Mainstream SIEM solutions fall into two categories: First, traditional commercial SIEMs (such as Splunk): relying on proprietary storage engines, while offering comprehensive functionality, suffer from high licensing fees and limited scalability due to hardware architecture limitations. Second, open-source solutions (such as OpenSearch): while reducing costs, are designed for general log retrieval and lack optimization for security scenarios. Specifically, their dashboard functionality is limited, failing to automatically correlate multi-source logs to generate attack posture views; report generation is inefficient, requiring manual data export and template assembly, which is time-consuming; and OpenSearch's native aggregation API does not support nested multi-condition alert rules.

[0028] Furthermore, in processing logs from hybrid cloud environments, the heterogeneous data formats further increase the complexity of analysis. Therefore, there is an urgent need for a SIEM platform that can integrate the low-cost advantages of open-source systems while providing automated operation and maintenance capabilities.

[0029] This invention provides a network security detection method that extends the data visualization and automation capabilities of OpenSearch to achieve real-time monitoring, alerting, and report generation of security events. By employing a dynamic dashboard, a customizable report generation system with customizable templates, and an SQL-based extended alert rule method, it addresses the technical shortcomings of existing security operation and maintenance tools in terms of visualization, automated report generation, and nested multi-condition alert rules.

[0030] According to an embodiment of the present invention, a network security detection method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] This embodiment provides a network security detection method that can be used in the aforementioned network security operation and maintenance scenarios, such as network security maintenance systems. Figure 1 This is a flowchart of a network security detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps: Step S101: Obtain log data from multiple source devices.

[0032] It's important to note that "multi-source devices" refers to security devices from multiple vendors, such as firewalls from different vendors. This involves compiling a comprehensive list of all network assets, including firewalls, switches, routers, Windows / Linux servers, databases, and application systems, to create a detailed log source inventory. For example, one company identified 237 log source categories, covering network devices, security devices, operating systems, databases, middleware, and business systems.

[0033] Step S102: Analyze and monitor the log data to obtain security events.

[0034] It should be noted that the log data is dynamically displayed on the dashboard based on customizable rules. The log data is analyzed and monitored according to different rules to extract security events. The data in the dashboard will be automatically updated as new logs are updated.

[0035] Step S103: Associate the security event with historical events to obtain potential attack targets in the security event.

[0036] Historical events refer to events that have occurred in the past, specifically those that triggered alerts within a certain period. Potential attack targets are threats present in the current security event. For example, a single failed login attempt might be due to a user entering the wrong password, but if the same account experiences multiple failed login attempts within a short period, followed by a successful login, it could be a brute-force attack. Another example is a current security event where antivirus software on the server is disabled. By associating historical events and using preset rules to detect that disabling the antivirus software is not a scheduled task, the current event can be identified as a potential attack target.

[0037] Step S104: Based on the preset risk assessment value between historical events and potential attack targets, determine the risk value of potential attack targets, and issue a network security alarm when the determined risk value reaches a preset threshold.

[0038] It should be noted that the preset risk assessment value is a risk value that is determined based on the data type and threat type results and can be used to judge potential attack targets, thereby reducing the false alarm rate of the system.

[0039] Specifically, without linking historical events, a basic risk score is assigned to each abnormal behavior based on data type and threat type. Log data is analyzed and monitored to obtain security events and their risk scores, for example, 60 points. Security events are then linked with historical events to identify potential attack targets within those events. For instance, if linking historical events reveals that a security event was flagged as a suspicious IP login in a previous time period and no alerts were issued during that period, the risk score for the potential attack target after linking historical events would be 100 points. The default threshold for issuing a network security alert is 70 points or higher, in which case a network security alert needs to be issued.

[0040] The preset threshold can also be divided into risk levels. The potential attack target is assessed based on the risk level of its risk score. When the risk level reaches the preset threshold, a network security alarm is issued. For example, a risk score of 40-70 is considered medium risk; 0-40 is low risk; and 70-100 is high risk. The security event obtained in the above example is medium risk, and the risk assessment value of the potential attack target obtained after associating with historical events is high risk.

[0041] The network security detection method provided in this embodiment acquires multi-source log data, correlates the multi-source data, extracts security events, and distinguishes event types by associating security events with historical events, thereby obtaining potential attack targets in security events. This eliminates the need for manual association with historical events, improving decision-making efficiency. Based on preset risk assessment values, it determines the risk value of potential attack targets, improving decision-making accuracy. Thus, when the risk value is determined to be a preset threshold, a network security alarm is issued, improving threat detection accuracy and realizing threat detection based on multi-condition alarm rules.

[0042] This embodiment provides a network security detection method that can be used in network security operation and maintenance scenarios, such as network security maintenance systems. Figure 2 This is a flowchart of a network security detection method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Obtain log data from multiple source devices. For details, please refer to [link to relevant documentation]. Figure 1 Step S101 of the illustrated embodiment will not be described again here.

[0043] Step S202: Classify, clean, and uniformly format the log data based on the log type in the log data.

[0044] The unified formatting process involves converting log data of different data types into a specific format. Custom parsing patterns are written for logs in specific formats. For example, parsing custom logs from a business system extracts key information such as user IDs and operation types, mapping log fields from different sources to standard fields to unify log fields and facilitate subsequent analysis and correlation. For instance, the source IP address field, src_ip, in various logs is uniformly mapped to source_ip. This simplifies the analysis process; regardless of which IP's activity is being investigated, only the source_ip needs to be searched in the system, which automatically searches all mapped log sources. Cross-log correlation is also enabled.

[0045] By classifying and cleaning log data from multiple sources, security devices from multiple vendors can be classified and cleaned according to different tenants, preventing log data from being stored together simply because it comes from the same type of device, thus improving the ability of automated operation and maintenance.

[0046] Step S203: Analyze and monitor the log data to obtain security events.

[0047] Specifically, step S203 includes: Step S2031: In response to receiving user-defined filtering rules, the log data is filtered based on the filtering rules to select security log data.

[0048] It's important to note that security analysts can flexibly define filtering rules based on actual network security operation and maintenance needs, meaning this network security detection method has strong adaptability. For example, when focusing on web application attack logs, custom filtering rules will prioritize data access logs. Filtering rules refer to the filtering conditions used when querying log data. Security log data filtered according to these rules better reflects actual needs.

[0049] Step S2032: In response to receiving a user-defined alarm rule, the security log data is monitored based on the alarm rule to obtain a security event.

[0050] It's important to note that users can collect and write SPL rules conforming to OpenSearch, covering common security scenarios such as brute-force attacks, abnormal logins, and malware activity. These rules are then imported into the SIEM platform, and multiple commands are linked together to detect security events, thereby filtering security log data. The integration of the threat intelligence database with the SIEM platform is configured, and threat indicators such as malicious IPs, domains, and file hashes are compared with log data to discover potential security threats. By customizing alert rules, truly necessary security events can be filtered out, reducing unnecessary alerts.

[0051] By using custom filtering rules, the system can filter out the data that users need to analyze from the log data, reducing unnecessary analysis and decision-making processes and data processing volume. Each security log data entry needs further analysis to determine whether it constitutes a real threat. Therefore, based on custom alerting rules, the system can further monitor the security log data to obtain security events, making the network security detection method adaptable to security detection in different industries and enterprises of different sizes. By adaptively adjusting the security log filtering rules and alerting rules, potential attack targets can be identified.

[0052] In some optional implementations, step S2031 above includes: Step a1: Based on the filtering rules, perform brute-force attack detection, abnormal login detection, and malware activity detection on the log data to obtain security event monitoring results.

[0053] Step a2: Based on the security event monitoring results, determine the security log data.

[0054] Specifically, alert rules based on brute-force attacks are used to detect brute-force attacks on log data. For example, a brute-force attack alert rule could be defined as: within 5 minutes, the same source IP address fails to log in to the same user account more than 10 times. Alert rules based on abnormal login detection are also used to detect abnormal logins on log data. Examples include abnormal login times (e.g., users logging in outside of working hours), abnormal login locations (e.g., users logging in from two different geographical locations sequentially, such as logging in from one city and then another), or abnormal login devices (e.g., users logging in from a device they have never used before). Alert rules based on malware activity are used to detect malware activity on log data. Examples include detecting a process creating a suspicious child process to access internal data, or detecting a host communicating with a malicious server. Based on these detection results, secure log data is determined. In one optional implementation, these three types of detection can be performed simultaneously, ultimately generating a unified detection result. The detection result includes brute-force attack detection results, abnormal login detection results, and malware activity detection results.

[0055] By detecting the number of login attempts from the same source address, suspicious processes, and abnormal accounts in the log data, brute-force attack detection, abnormal login detection, and malware detection can be achieved, thereby identifying secure log data and reducing the system's false alarm rate.

[0056] Step S204 involves correlating security events with historical events to identify potential attack targets within the security events. Specifically, step S204 includes: Step S2041: Obtain the alarm events that have been triggered in the historical events.

[0057] It should be noted that historical events are those that triggered alarm messages in the previous time period.

[0058] Step S2042: Based on preset query rules, filter out specific interference events in the security events that are the same as the alarm events that have been triggered in the historical events, and exclude specific interference events.

[0059] Specifically, for each newly generated security event, a preset query rule is run to determine if it matches a previously confirmed alarm event. If a match is found, it is identified as a specific interference event and excluded. If no match is found, it is marked as a potential attack target requiring attention. Specifically, this can be achieved by extracting key characters from the security event, such as the event source IP address and event type.

[0060] Step S2043: Invoke the preset multi-level nested alarm query conditions in the alarm rules to query non-specific interference events in the security events and obtain potential attack targets.

[0061] It should be noted that after excluding specific interference events, non-specific interference events are queried using preset multi-level nested alarm query conditions. These preset multi-level nested alarm query conditions are complex judgments composed of multiple layers of logic, which associate logs from different data sources and different time points to form a complete attack chain. For example, the system identifies attack intent and locks down attack targets by identifying risk values ​​through event association.

[0062] Security events are events that occur within a specific time period. By associating security events with events that were triggered and issued alarms in the previous time period or earlier, specific interfering events that have already triggered alarms can be eliminated, thereby improving system detection performance and efficiency and reducing the system's false alarm rate.

[0063] Step S205: Based on the preset risk assessment value between historical events and potential attack targets, determine the risk value of potential attack targets, and issue a network security alarm when the determined risk value reaches a preset threshold.

[0064] Specifically, step S205 includes: Step S2051: Obtain the data type and threat type of the potential attack target.

[0065] It should be noted that the data type refers to the source of log data, such as network device logs, operating system logs, application logs, and security device logs; the threat type refers to the type of security event, such as malware activity, intrusion attempts, insider threats, and data breaches.

[0066] Step S2052: Based on the preset risk assessment values ​​corresponding to preset data types and preset threat types, calculate the risk values ​​of data types and threat types to determine the risk values ​​of potential attack targets.

[0067] It should be noted that the basic risk score of a security event is obtained based on the data type and threat type. The risk value of the security event after excluding specific interference events is calculated based on the determined threat type, thereby determining the risk value of potential attack targets.

[0068] By setting different risk assessment values ​​for different data types and threat categories, multi-condition alarms can be achieved for multi-source log data. This allows the system to issue alarms based on different rules, only issuing alarms after identifying threat data that requires an alarm, thereby optimizing the alarm volume and reducing the system's false alarm rate.

[0069] Step S206: Obtain the number of failed login attempts and sensitive data access records from the security incident.

[0070] It should be noted that the number of failed login attempts is a result of brute-force attack detection. For example, if the same source IP address fails to log in to the same user account more than 10 times within 5 minutes. Sensitive data access records are a result of malware activity detection. For example, if a process is detected creating suspicious child processes to access internal data.

[0071] Step S207: Based on the preset report generation template, input the number of failed login attempts and sensitive data access records into the preset report generation template to generate an alarm prompt analysis report.

[0072] It should be noted that the dashboard data is dynamically displayed through preset report generation templates. For example, multiple operational dashboards can be designed, including a security incident overview dashboard, a real-time attack monitoring dashboard, and a system performance monitoring dashboard, which intuitively display key indicators such as security incident trends, attack source analysis, and system resource usage. Compliance requirements covering log retention, access control, and security incident handling are generated and automatically sent via email in PDF format for easy viewing by management and auditors.

[0073] Users can design templates based on their own business needs, customize data display content, and extract key indicators to improve system flexibility.

[0074] This embodiment provides a network security detection method. Figure 3 This is a schematic diagram illustrating the reasoning process of a network security detection method according to an embodiment of the present invention, such as... Figure 3 As shown, it includes the following steps: Step S301: Obtain log information from multiple security devices, and clean and uniformly format and store the log data according to different device tenants.

[0075] The log data from multiple sources includes firewalls, switches, routers, Windows / Linux servers, databases, application systems, etc., forming a detailed list of log sources (multi-source log data).

[0076] Step S302: Dynamically display Dashboard data based on customizable rules, and perform real-time monitoring and analysis of security events according to different rules.

[0077] To address the limitations of traditional SIEM Dashboards, such as their limited functionality and inability to automatically correlate multi-source logs, this system employs a modular front-end architecture. Security analysts can customize views (e.g., attack chain graphs, real-time threat heatmaps) through drag-and-drop functionality. The back-end, based on OpenSearch's log correlation metrics, automatically identifies attack paths between discrete security events, significantly improving efficiency compared to traditional manual correlation analysis.

[0078] Step S303: Associate current events with historical events and exclude interference from specific events to analyze potential attack information. To address the issue that OpenSearch's native API cannot support complex alerting rules, this system is designed to allow users to define multi-level nested conditions using standard SQL syntax.

[0079] Step S304: Combine real-time anomaly information and potential attack information for comprehensive analysis. When the threshold is reached, issue an alarm and send a detailed analysis report via email.

[0080] To address the issue of inefficient report generation, this system supports custom report templates, enabling highly customized end-to-end processing from log queries to compliance reports. The specific workflow includes: Custom template design: Users can design templates according to their own business needs, customize data display drag-and-drop modules, and extract key metrics (such as the number of failed login attempts and sensitive data access records). Dynamic template population: Automatically matches OpenSearch query results to preset templates, and supports PDF output.

[0081] In practical applications, the following preparatory work is required, including the requirements analysis and asset inventory stage: compiling log lists, log types and formats, log volume assessment, and other information.

[0082] The log source list includes firewalls, switches, routers, Windows / Linux servers, databases, application systems, etc., forming a detailed log source list (multi-source log data). For example, one company identified 237 types of log sources, covering network devices, security devices, operating systems, databases, middleware, business systems, etc.

[0083] Log types and formats: Determine the log types generated by each asset, such as system logs, security logs, application logs, etc., and analyze their formats, such as Syslog, Windows Event Log, JSON, XML, etc.

[0084] Log volume assessment: Assess the number of log events generated per second (EPS). For example, if a company's peak EPS is 55k and the average daily log volume reaches 1.2TB, this provides a basis for subsequent storage and computing resource planning.

[0085] The resource assessment and selection phase includes: Hardware resources: Based on the log volume assessment results, configure sufficient hardware resources. For example, select a server with a 16-core CPU, 64GB of memory, and a 2TB SSD to ensure that it can handle high-concurrency log data.

[0086] Network resources: Ensure sufficient network bandwidth, such as 2Gbps, for log transmission to avoid network bottlenecks.

[0087] SIEM Platform Selection: Consider factors such as functionality, performance, cost, and after-sales service to choose a suitable SIEM platform. For example, combining the open-source Elastic Stack with the commercial Splunk Cloud can balance cost and functionality.

[0088] Network and host preparation phase: Network isolation: Define an independent network area for the SIEM platform, isolating it from the business network to ensure the security and stability of log transmission.

[0089] Time synchronization: Configure an NTP server to ensure that all log sources and the SIEM platform are in the same time, which will facilitate subsequent log correlation analysis.

[0090] Certificates and Encryption: Configure SSL / TLS certificates for log transmission to encrypt log data and prevent it from being stolen or tampered with during transmission.

[0091] RAID Configuration: Configure the disks storing logs with RAID10 to improve data reliability and read / write performance.

[0092] Core component installation: OpenSearch: Install an OpenSearch cluster, configure an appropriate number of shards and replicas to ensure high data availability and query performance.

[0093] Logstash: Deploy Logstash nodes for log collection, parsing, and forwarding. Configure rich plugins, such as grok, date, geoip, etc., to meet the parsing needs of different log formats.

[0094] Log access: Windows Log Access: Install a self-developed agent on the Windows server, configure it to collect security logs, system logs, application logs, etc., set log filtering conditions, and reduce invalid log transmission.

[0095] Network device log access: Configure network devices such as firewalls and switches to send Syslog logs to the Logstash node of the SIEM platform, receive them through port 514, and use plugins to parse the log content and extract key fields such as source IP, destination IP, port, and protocol.

[0096] Application log access: For JSON format logs generated by the application system, configure the log path and JSON parsing plugin to transmit the logs to OpenSearch, ensuring the correct parsing and indexing of log fields.

[0097] Parsing standardization: Custom parsing mode: For logs of a specific format, write custom parsing modes, such as parsing the custom log format of a business system and extracting key information, such as user ID, operation type, etc.

[0098] Field mapping: Mapping log fields from different sources to standard fields to unify log fields and facilitate subsequent analysis and correlation. For example, mapping the source IP field in various logs to source_ip.

[0099] Testing rules: Rule writing: Collect and write SPL rules that conform to OpenSearch, covering common security scenarios such as brute-force attacks, abnormal logins, and malware activities, and import them into the SIEM platform to detect security events.

[0100] Threat Intelligence Integration: Configure the integration of the threat intelligence database with the SIEM platform to compare threat indicators such as malicious IPs, domains, and file hashes with log data to discover potential security threats.

[0101] Operational dashboards: Design multiple operational dashboards, including a security incident overview dashboard, a real-time attack monitoring dashboard, and a system performance monitoring dashboard, to intuitively display key indicators such as security incident trends, attack source distribution, and system resource usage.

[0102] Compliance Reports: Generates five types of compliance reports, such as the Cybersecurity Classified Protection 2.0 Compliance Report, covering compliance requirements for log retention, access control, security incident handling, etc. It supports automatic email sending in PDF format, making it easy for management and auditors to view.

[0103] Configure OpenSearch cross-cluster replication to achieve a dual-active architecture, ensuring real-time data synchronization across multiple data centers. When the primary cluster fails, the backup cluster can seamlessly take over, guaranteeing high availability of services.

[0104] Snapshot backup: Set up regular snapshot tasks to back up OpenSearch index data to object storage, retain it for 180 days, support incremental backup, and save storage space and costs.

[0105] Red Team / Blue Team Exercise: Organize red team / blue team exercises to simulate 20 common attack scenarios, such as SQL injection, DDoS attacks, and phishing emails, to test the detection capabilities and response speed of the SIEM platform.

[0106] Detection rate and MTTR: ​​According to the statistical exercise results, the SIEM platform achieved a detection rate of 96% and an average response time (MTTR) of 28 minutes, completing the entire process from alarm detection to IP blocking and account disabling within as little as 5 minutes.

[0107] Source tracing analysis: By leveraging the log correlation and attack chain timeline functions of the SIEM platform, the source of the attack can be quickly located and the attack path can be traced, providing a basis for subsequent security hardening and incident handling.

[0108] SOP (Standard Operating Procedures): Standard operating procedure documents are written to cover all aspects of the SIEM platform's daily operation and maintenance, security incident handling, system upgrades, etc., to standardize the operating procedures for operation and maintenance personnel.

[0109] Training courses: Three training courses were conducted, including basic SIEM platform operation, security incident analysis, and emergency response procedures, to improve the professional skills of the enterprise's internal security team.

[0110] Operations Manual: Compile a detailed operations manual that summarizes best practices, common problems and solutions, performance tuning techniques, etc. for the SIEM platform.

[0111] This invention, based on OpenSearch, is an enhanced SIEM system that significantly improves security operation and maintenance efficiency while bringing multi-dimensional comprehensive benefits: compared to commercial SIEM solutions, it reduces costs and maintenance manpower requirements, enabling SMEs to afford professional-grade security protection; its modular architecture not only improves attack detection efficiency but also supports rapid adaptation to compliance requirements in industries such as finance and healthcare, shortening audit preparation time; the system supports highly customizable modular technology combinations, which not only solves the pain point of traditional solutions' single functionality but also lays the foundation for future intelligent security operations, truly achieving a four-in-one value breakthrough of "cost reduction, efficiency improvement, compliance, and forward-looking vision". This invention, based on OpenSearch, is an enhanced SIEM system that significantly improves security operation and maintenance efficiency while bringing multi-dimensional comprehensive benefits: compared to commercial SIEM solutions, it reduces costs and maintenance manpower requirements, enabling SMEs to afford professional-grade security protection; its modular architecture not only improves attack detection efficiency but also supports rapid adaptation to compliance requirements in industries such as finance and healthcare, shortening audit preparation time; the system supports highly customizable modular technology combinations, which not only solves the pain point of traditional solutions' single functionality but also lays the foundation for future intelligent security operations, truly achieving a four-in-one value breakthrough of "cost reduction, efficiency improvement, compliance, and forward-looking vision".

[0112] This embodiment also provides a network security detection device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0113] This embodiment provides a network security detection device, such as... Figure 4 As shown, the device includes: Module 401 is used to acquire log data from multiple sources. Analysis module 402 is used to analyze and monitor log data to obtain security events; The association module 403 is used to associate security events with historical events to obtain potential attack targets in the security events; The alarm module 404 is used to determine the risk value of a potential attack target based on a preset risk assessment value between historical events and potential attack targets, and to issue a network security alarm when the determined risk value reaches a preset threshold.

[0114] In some optional implementations, the network security detection device further includes: The processing module is used to classify, clean, and uniformly format log data based on the log type in the log data.

[0115] In some alternative implementations, the analysis module 402 includes: The first analysis unit is used to respond to the received user-defined filtering rules, filter the log data based on the filtering rules, and filter out the security log data.

[0116] The second analysis unit is used to respond to user-defined alarm rules, monitor security log data based on the alarm rules, and obtain security events.

[0117] In some alternative implementations, the first associated unit includes: The first analysis subunit is used to perform brute-force attack detection, abnormal login detection, and malware activity detection on log data based on filtering rules, and obtain security event monitoring results.

[0118] The second analysis subunit is used to determine security log data based on the results of security event monitoring.

[0119] In some alternative implementations, the association module 403 includes: The first association unit is used to obtain alarm events that have been triggered in historical events.

[0120] The second association unit is used to filter out specific interference events in security events that are the same as alarm events that have been triggered in historical events, based on preset query rules, and to exclude specific interference events.

[0121] The third association unit is used to call the preset multi-level nested alarm query conditions in the alarm rules to query non-specific interference events in the security events and obtain potential attack targets.

[0122] In some alternative implementations, the alarm notification module 404 includes: The information acquisition unit is used to acquire the data types and threat categories of potential attack targets.

[0123] The risk assessment unit is used to calculate the risk value of a data type and a threat type based on the preset risk assessment value corresponding to the preset data type and preset threat type to determine the risk value of potential attack targets.

[0124] In some optional implementations, the network security detection device further includes a custom module, which includes: The data acquisition unit acquires the number of failed login attempts and sensitive data access records from security incidents.

[0125] The report generation unit is used to generate an alarm and alert analysis report by inputting the number of failed login attempts and sensitive data access records into the preset report generation template.

[0126] The network security detection device provided in this embodiment of the invention can execute the network security detection method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.

[0127] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0128] The following is a detailed reference. Figure 5 This diagram illustrates a suitable structural schematic for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from memory 508 into random access memory (RAM) 503. RAM 503 also stores various programs and data required for the operation of the electronic device. The processor 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0129] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0130] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a memory 508, or installed from a ROM 502. When the computer program is executed by the processor 501, it performs the functions defined in the network security detection method of the embodiments of the present invention.

[0131] Figure 5The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0132] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded over a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the network security detection method shown in the above embodiments is implemented.

[0133] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0134] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A network security detection method, characterized in that, The method includes: Acquire log data from multiple sources; The log data is analyzed and monitored to identify security events. By associating the security events with historical events, potential attack targets within the security events can be obtained; Based on a preset risk assessment value between historical events and potential attack targets, the risk value of the potential attack targets is determined, and a network security alarm is issued when the risk value reaches a preset threshold.

2. The method according to claim 1, characterized in that, The analysis and monitoring of the log data yields security events, including: In response to receiving a user-defined filtering rule, the log data is filtered based on the filtering rule to filter out security log data; In response to receiving a user-defined alarm rule, the security log data is monitored based on the alarm rule to obtain the security event.

3. The method according to claim 2, characterized in that, The process of filtering the log data based on the filtering rules to select security log data includes: Based on the filtering rules, the log data is subjected to brute-force attack detection, abnormal login detection, and malicious software activity detection to obtain security event monitoring results. The security log data is determined based on the security incident monitoring results.

4. The method according to claim 2, characterized in that, The step of associating the security events with historical events to obtain potential attack targets in the security events includes: Retrieve the alarm events that have been triggered in the historical events; Based on preset query rules, specific interfering events that are the same as the alarm events that have been triggered in the historical events are filtered out from the security events, and the specific interfering events are excluded. The preset multi-level nested alarm query conditions in the alarm rules are invoked to query non-specific interference events existing in the security event, thereby obtaining the potential attack target.

5. The method according to claim 1, characterized in that, The process of determining the risk value of a potential attack target based on a preset risk assessment value between historical events and potential attack targets includes: Obtain the data types and threat categories of potential attack targets; Based on the preset risk assessment values ​​corresponding to preset data types and preset threat types, the risk values ​​of the data types and the threat types are calculated to determine the risk values ​​of potential attack targets.

6. The method according to claim 5, characterized in that, The method further includes: Obtain the number of failed login attempts and sensitive data access records from the security incident; Based on the preset report generation template, the number of failed login attempts and the sensitive data access records are input into the preset report generation template to generate an alarm prompt analysis report.

7. The method according to claim 1, characterized in that, Before analyzing and monitoring the log data to obtain security events, the method further includes: The log data is classified, cleaned, and uniformly formatted based on the log type in the log data.

8. A network security detection device, characterized in that, The device includes: The acquisition module is used to acquire log data from multiple sources. The analysis module is used to analyze and monitor the log data to obtain security events; The association module is used to associate the security event with historical events to obtain potential attack targets in the security event; The alarm notification module is used to determine the risk value of the potential attack target based on the preset risk assessment value between historical events and potential attack targets, and to issue a network security alarm when the risk value reaches a preset threshold.

9. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the network security detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the network security detection method according to any one of claims 1 to 7.

Images