Network security detection methods, devices, electronic equipment, and storage media

Abstract

The invention relates to the technical field of network security, and discloses a network security detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining log data of multi-source equipment; analyzing and monitoring the log data to obtain a security event; associating the security event with the historical event to obtain a potential attack target in the security event; determining a risk value of the potential attack target based on a preset risk assessment value between the historical event and the potential attack target, and giving a network security alarm when the risk value is determined to reach a preset threshold value; the problem that a traditional threat detection system lacks a multi-source log automatic association analysis capability and cannot support multi-condition alarm is solved.

Description

(19) State Intellectual Property Office (12) Invention Patent Application (10) Application Publication Number (43) Application Publication Date (21) Application Number 202511881830.4 (22) Application Date 2025.12.12 (71) Applicant CITIC International Telecommunications (Information Technology) Limited Address 20 / F, Lincoln Tower, Taikoo Place, 979 King's Road, Quarry Bay, Hong Kong Applicant China Enterprise Network Communication Technology Co., Ltd. (72) Inventor Li Chaoqun (74) Patent Agency Beijing Sanju Sunshine Intellectual Property Agency Co., Ltd. 11250 Patent Attorney Hu Xiaojing (51) Int.Cl. H04L 9 / 40 (2022.01) (54) Invention Title Network Security Detection Method, Device, Electronic Equipment and Storage Medium (57) Abstract This invention relates to the field of network security technology and discloses a network security detection method, device, electronic equipment and storage medium. The method includes: acquiring log data from multiple sources; analyzing and monitoring the log data to obtain security events; correlating the security events with historical events to obtain potential attack targets in the security events; determining the risk value of the potential attack targets based on a preset risk assessment value between historical events and potential attack targets; and issuing a network security alarm when the determined risk value reaches a preset threshold. This solves the problem that traditional threat detection systems lack the ability to automatically correlate and analyze multi-source logs and therefore cannot support multi-condition alarms. (Claims: 2 pages; Description: 12 pages; Drawings: 4 pages) CN 121664535 A 2026.03.13 CN 1 21 66 45 35 A 1. A network security detection method, characterized in that the method includes: acquiring log data from multiple sources; analyzing and monitoring the log data to obtain security events; correlating the security events with historical events to obtain potential attack targets in the security events; determining the risk value of the potential attack targets based on a preset risk assessment value between historical events and potential attack targets; and issuing a network security alarm when the determined risk value reaches a preset threshold. 2. The method according to claim 1, wherein analyzing and monitoring the log data to obtain security events includes: responding to receiving a user-defined filtering rule, filtering the log data based on the filtering rule to select security log data; responding to receiving a user-defined alarm rule, monitoring the security log data based on the alarm rule to obtain the security events. 3. The method according to claim 2, wherein filtering the log data based on the filtering rule to select security log data includes: performing brute-force attack detection, abnormal login detection, and malicious software activity detection on the log data based on the filtering rule to obtain security event monitoring results;Based on the security event monitoring results, the security log data is determined. 4. The method according to claim 2, wherein associating the security event with historical events to obtain potential attack targets in the security event includes: obtaining alarm events that have been triggered in the historical events; filtering out specific interference events in the security event that are the same as the alarm events that have been triggered in the historical events based on preset query rules, and excluding the specific interference events; calling preset multi-level nested alarm query conditions in the alarm rules to query non-specific interference events existing in the security event to obtain the potential attack targets. 5. The method according to claim 1, wherein determining the risk value of the potential attack target based on a preset risk assessment value between historical events and potential attack targets includes: obtaining the data type and threat type of the potential attack target; calculating the risk value of the data type and the threat type based on preset risk assessment values ​​corresponding to preset data types and preset threat types to determine the risk value of the potential attack target. 6. The method according to claim 5, characterized in that the method further includes: acquiring the number of failed login attempts and sensitive data access records in the security event; and inputting the number of failed login attempts and sensitive data access records into the preset report generation template to generate an alarm prompt analysis report based on a preset report generation template. 7. The method according to claim 1, characterized in that, before analyzing and monitoring the log data to obtain a security event, the method further includes: classifying, cleaning, and uniformly formatting the log data based on the log type in the log data. 8. A network security detection device, characterized in that the device includes: an acquisition module for acquiring log data from multiple sources; an analysis module for analyzing and monitoring the log data to obtain a security event; an association module for associating the security event with historical events to obtain potential attack targets in the security event; and an alarm prompt module for determining the risk value of the potential attack target based on a preset risk assessment value between historical events and potential attack targets, and issuing a network security alarm when the determined risk value reaches a preset threshold. 9. An electronic device, characterized in that it comprises: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the network security detection method according to any one of claims 1 to 7. 10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer instructions, the computer instructions being used to cause a computer to perform the network security detection method according to any one of claims 1 to 7.Claims 2 / 2 pages 3 CN 121664535 A Network Security Detection Method, Device, Electronic Equipment and Storage Medium Technical Field

[0001] This invention relates to the field of network security technology, specifically to network security detection methods, devices, electronic equipment and storage media. Background Art

[0002] In current enterprise network security operation and maintenance, the surge in log data volume and the increasing complexity of threats bring dual pressures. Traditional commercial security information and event management systems (SIEM) not only have limited scalability due to their proprietary storage engines, which are constrained by the hardware architecture, but also have functional shortcomings, lacking the ability to automatically correlate and analyze multi-source logs and thus unable to support multi-condition alarms. Summary of the Invention

[0003] This invention provides a network security detection method, device, electronic equipment and storage medium to solve the problem that traditional threat detection systems lack the ability to automatically correlate and analyze multi-source logs and thus cannot support multi-condition alarms.

[0004] In a first aspect, the present invention provides a network security detection method, the method comprising: acquiring log data from multiple sources; analyzing and monitoring the log data to obtain security events; associating security events with historical events to obtain potential attack targets in the security events; determining the risk value of potential attack targets based on a preset risk assessment value between historical events and potential attack targets; and issuing a network security alarm when the determined risk value reaches a preset threshold.

[0005] By acquiring log data from multiple sources, associating the data from multiple sources, extracting security events, and distinguishing event types by associating security events with historical events to obtain potential attack targets in the security events, there is no need to manually associate historical events, thus improving decision-making efficiency. Based on the preset risk assessment value, the risk value of potential attack targets is determined, thus improving decision-making accuracy. Therefore, when the determined risk value reaches a preset threshold, a network security alarm is issued, improving threat detection accuracy and realizing threat detection based on multi-condition alarm rules.

[0006] In an optional implementation, analyzing and monitoring log data to obtain security events includes: responding to receiving a user-defined filtering rule, filtering log data based on the filtering rule to select security log data; responding to receiving a user-defined alarm rule, monitoring security log data based on the alarm rule to obtain security events.

[0007] By using custom filtering rules, data that the user needs to analyze is filtered from the log data, reducing unnecessary analysis and decision-making processes and data processing volume. Since a single security log data entry needs further analysis to determine if it constitutes a real threat, further monitoring of the security log data based on custom alarm rules is used to obtain security events, making the network security detection method adaptable to security detection in different industries and of different sizes; and by adaptively adjusting the security log filtering...Rules and alert rules are used to identify potential attack targets.

[0008] In an optional implementation, log data is filtered based on filtering rules to filter out secure log data, including: Based on the filtering rules, brute-force attack detection, abnormal login detection, and malware activity detection are performed on the log data to obtain security event monitoring results; Based on the security event monitoring results, secure log data is determined.

[0009] By detecting the number of logins from the same source address, suspicious processes, abnormal accounts, etc. in the log data, brute-force attack detection, abnormal login detection, and malware detection are achieved, thereby determining secure log data and reducing the system false alarm rate.

[0010] In an optional embodiment, associating security events with historical events to obtain potential attack targets in security events includes: obtaining alarm events that have been triggered in historical events; filtering out specific interference events in security events that are the same as alarm events that have been triggered in historical events based on preset query rules, and excluding specific interference events; calling preset multi-level nested alarm query conditions in the alarm rules to query non-specific interference events existing in security events to obtain potential attack targets.

[0011] Security events are events that occur within a specific time period. By associating security events with events that have been triggered and issued alarms in the previous time period or earlier, specific interference events that have already triggered alarms are excluded, thereby improving system detection performance and efficiency and reducing system false alarm rate.

[0012] In an optional embodiment, determining the risk value of potential attack targets based on preset risk assessment values ​​between historical events and potential attack targets includes: obtaining the data type and threat type of potential attack targets; calculating the risk value of the data type and threat type based on preset risk assessment values ​​corresponding to preset data types and preset threat types to determine the risk value of potential attack targets.

[0013] By setting different risk assessment values ​​for different data types and threat types, multi-condition alarms for multi-source log data can be achieved, enabling the system to issue targeted alarms based on different rules. Alarms are only issued after identifying threat data that requires alarm, thereby optimizing the alarm volume and reducing the system's false alarm rate.

[0014] In an optional embodiment, the method further includes: obtaining the number of failed login attempts and sensitive data access records in the security event; and inputting the number of failed login attempts and sensitive data access records into the preset report generation template to generate an alarm prompt analysis report based on a preset report generation template.

[0015] Users can design templates according to their own business needs, customize data display content, and extract key indicators to improve system flexibility.

[0016] In an optional embodiment, before analyzing and monitoring log data to obtain security events, the method further includes:Based on the log type in the log data, the log data is classified, cleaned, and uniformly formatted.

[0017] By classifying and cleaning log data from multiple sources, security devices from multiple vendors can be classified and cleaned according to different tenants, and will not be stored together because the log data comes from the same type of device, thereby improving the ability of automated operation and maintenance.

[0018] In a second aspect, the present invention provides a network security detection device, the device comprising: an acquisition module for acquiring log data from multiple sources; an analysis module for analyzing and monitoring the log data to obtain security events; an association module for associating security events with historical events to obtain potential attack targets in the security events; and an alarm prompting module for determining the risk value of potential attack targets based on a preset risk assessment value between historical events and potential attack targets, and issuing a network security alarm when the determined risk value reaches a preset threshold.

[0019] In a third aspect, the present invention provides an electronic device comprising: a memory and a processor, the memory and the processor being interconnected, the memory storing computer instructions, and the processor executing the computer instructions to perform the network security detection method of the first aspect or any corresponding embodiment described above.

[0020] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the network security detection method of the first aspect or any corresponding embodiment described above. Brief Description of the Drawings

[0021] To more clearly illustrate the technical solutions in the specific embodiments of the present invention or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] FIG1 is a schematic flowchart of a first type of network security detection method according to an embodiment of the present invention; FIG2 is a schematic flowchart of a second type of network security detection method according to an embodiment of the present invention; FIG3 is a schematic diagram of the reasoning process of a network security detection method according to an embodiment of the present invention; FIG4 is a structural block diagram of a network security detection device according to an embodiment of the present invention; FIG5 is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Description of the Embodiments

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. Based on the embodiments of this invention, those skilled in the art will understand without...All other embodiments obtained under the premise of creative labor are within the scope of protection of this invention.

[0024] It is understood that before using the technical solutions disclosed in the various embodiments of this invention, users should be informed of the type, scope of use, and usage scenarios of the personal information involved in this invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0025] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this invention, "multiple" means two or more, unless otherwise explicitly and specifically defined.

[0026] Currently, in the enterprise network security operation and maintenance environment, it is necessary to protect its internal network through network security detection, establish an enhanced SIEM system based on OpenSearch, collect log data from multiple sources and analyze the log data to perform risk detection and alarm prompts.

[0027] Currently, enterprise network security operation and maintenance faces the dual challenges of a surge in log data volume and the increasing complexity of threats. Mainstream SIEM solutions fall into two categories. On the one hand, there are traditional commercial SIEMs (such as Splunk): relying on proprietary storage engines, which, while feature-rich, have high licensing fees and limited scalability due to hardware architecture. On the other hand, there are open-source solutions (such as OpenSearch): although cost-effective, their design is for general log retrieval and lacks optimization for security scenarios. Specifically, the Dashboard has limited functionality and cannot automatically associate multi-source logs to generate an attack situation view; report generation is inefficient, requiring manual data export and template splicing, which is time-consuming; and OpenSearch's native aggregation API does not support nested multi-condition alarm rules.

[0028] In addition, in processing logs in hybrid cloud environments, the heterogeneous data formats further increase the complexity of analysis. Therefore, there is an urgent need for a SIEM platform that can integrate the low-cost advantages of open-source systems while providing automated operation and maintenance capabilities.

[0029] This embodiment of the invention provides a network security detection method that, by extending the data visualization and automation functions of OpenSearch, enables real-time monitoring, alarming, and report generation of security events. By using a dynamic dashboard, a customizable report generation system, and SQL-extended alarm rule methods, the technical deficiencies of existing security operation and maintenance tools in terms of visualization, automated report generation, and nested multi-condition alarm rules are addressed.

[0030] According to an embodiment of the present invention, a network security detection method embodiment is provided. It should be noted that, in the accompanying drawings...The steps shown in the flowchart can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0031] In this embodiment, a network security detection method is provided, which can be used in the above-mentioned network security operation and maintenance scenarios, such as network security maintenance systems. Figure 1 is a flowchart of a network security detection method according to an embodiment of the present invention. As shown in Figure 1, the process includes the following steps: Step S101, obtain log data from multiple source devices.

[0032] It should be noted that multiple source devices refer to security devices from multiple vendors, such as firewalls from different vendors. Sort out all network assets, including firewalls, switches, routers, Windows / Linux servers, databases, application systems, etc., to form a detailed log source list. For example, a certain enterprise sorted out 237 types of log sources, covering network devices, security devices, operating systems, databases, middleware, business systems, etc.

[0033] Step S102, analyze and monitor the log data to obtain security events.

[0034] It should be noted that the log data is dynamically displayed on the dashboard based on customizable rules. The log data is analyzed and monitored according to different rules to extract security events. The data in the dashboard is automatically updated with new log updates.

[0035] Step S103: Associate security events with historical events to obtain potential attack targets within the security events.

[0036] Historical events refer to events that have occurred in the past, i.e., events that have triggered alarms within a certain period. Potential attack targets are threats present in the current security event. For example, a single failed login attempt might be due to a user entering the wrong password, but if the same account fails to log in multiple times within a short period, followed by a successful login, this could be a brute-force attack. For instance, if the current security event is that the antivirus software on the server is disabled, associating with historical events and detecting through preset rules reveals that disabling the antivirus software is not a scheduled task, then the current event can be identified as a potential attack target.

[0037] Step S104: Based on the preset risk assessment value between historical events and potential attack targets, determine the risk value of potential attack targets. When the determined risk value reaches a preset threshold, issue a network security alarm.

[0038] It should be noted that the preset risk assessment value is a risk value that can be used to judge potential attack targets based on the data type and threat type results, reducing the system false alarm rate.

[0039] Specifically, in the absence of associated historical events, a basic risk score is set for each abnormal behavior based on the data type and threat type. Log data is analyzed and monitored to obtain security events and obtain the risk description of the security events (page 4 / 12, page 7).CN 121664535 A score, for example, 60 points; the security event is associated with historical events to obtain potential attack targets in the security event. For example, after associating with historical events, it is found that the security event was marked as a suspicious IP login in the previous time period, and no alarm was issued in the previous time period. At this time, the risk score of the potential attack target after associating with historical events is 100 points. The preset threshold for issuing a network security alarm is above 70 points, so a network security alarm needs to be issued at this time.

[0040] The preset threshold can also be divided by setting risk levels. The potential attack target is evaluated based on the risk level to which the risk score of the potential attack target belongs. When the risk level reaches the preset threshold, a network security alarm is issued. For example, when the detected risk score is in the range of 40-70, it is considered medium risk; 0-40 is low risk; 70-100 is high risk. The security event obtained in the above example is medium risk, and the risk assessment value of the potential attack target obtained after associating with historical events is high risk.

[0041] The network security detection method provided in this embodiment obtains multi-source log data, associates the multi-source data, extracts security events, and distinguishes event types by associating security events with historical events, thereby obtaining potential attack targets in security events. It does not require manual association of historical events, improving decision-making efficiency. Based on a preset risk assessment value, it determines the risk value of potential attack targets, improving decision-making accuracy. Thus, when the risk value is determined to be a preset threshold, a network security alarm is issued, improving threat detection accuracy and realizing threat detection based on multi-condition alarm rules.

[0042] This embodiment provides a network security detection method that can be used in network security operation and maintenance scenarios, such as network security maintenance systems. Figure 2 is a flowchart of the network security detection method according to an embodiment of the present invention. As shown in Figure 2, the process includes the following steps: Step S201, obtain log data from multi-source devices. For details, please refer to step S101 of the embodiment shown in Figure 1, which will not be repeated here.

[0043] Step S202, classify, clean, and uniformly format the log data based on the log type in the log data.

[0044] Wherein, the uniform formatting process is to convert log data of different data types into a specific data format. Custom parsing patterns were developed for logs of specific formats. For example, custom logs from a business system could be parsed to extract key information such as user IDs and operation types. Log fields from different sources could be mapped to standard fields, unifying log field representation and facilitating subsequent analysis and correlation. For instance, the source IP address field `src_ip` in various logs could be uniformly mapped to `source_ip`. This simplifies the analysis process; regardless of which IP's activity is being investigated, only `source_ip` needs to be searched in the system, which automatically searches for all mapped log sources. Cross-log correlation was also implemented.

[0045] By classifying and cleaning log data from multiple sources, security devices from multiple vendors can be classified and cleaned according to different tenants, preventing log data from being stored together simply because it comes from the same type of device, thus improving the ability of automated operation and maintenance.

[0046] Step S203: Analyze and monitor the log data to obtain security events.

[0047] Specifically, step S203 includes: Step S2031: In response to receiving user-defined filtering rules, filter the log data based on the filtering rules to obtain security log data.

[0048] It should be noted that security analysts flexibly define filtering rules according to actual network security operation and maintenance needs, which means that this network security detection method has strong adaptability. For example, when it is necessary to focus on web application attack logs, the customized filtering rules focus more on data access logs. Filtering rules refer to the filtering conditions when querying log data. Security log data filtered according to the filtering rules is more in line with actual needs.

[0049] Step S2032: In response to receiving user-defined alarm rules, monitor the security log data based on the alarm rules to obtain security events. Instruction manual, page 5 / 12, CN 121664535 A

[0050] It should be noted that users collect and write SPL rules that conform to OpenSearch, covering common security scenarios such as brute-force attacks, abnormal logins, and malicious software activities, import them into the SIEM platform, connect multiple commands to realize the detection of security events, and thus filter out security log data; configure the integration of the threat intelligence database with the SIEM platform, compare threat indicators such as malicious IPs, domain names, and file hashes with log data, and discover potential security threats. By customizing alarm rules, the security events that really need to be alarmed are filtered out, reducing unnecessary alarms.

[0051] By customizing the filtering rules, the data that the user needs to analyze is filtered out from the log data, reducing unnecessary analysis and decision-making processes and data processing volume. A single security log data needs further analysis to determine whether it constitutes a real threat. Therefore, based on the custom alarm rules, the security log data is further monitored to obtain security events, making the network security detection method adaptable to the security detection of enterprises of different industries and sizes; by adaptively adjusting the security log filtering rules and alarm rules, potential attack targets are obtained.

[0052] In some optional embodiments, step S2031 above includes: Step a1, performing brute-force attack detection, abnormal login detection, and malicious software activity detection on the log data based on filtering rules to obtain security event monitoring results.

[0053] Step a2, determining security log data based on the security event monitoring results.

[0054] Specifically, performing brute-force attack detection on the log data based on brute-force attack alert rules. For example, defining brute-force...The alarm rule for cracking is: within 5 minutes, the number of failed login attempts for the same user account from the same source IP address exceeds 10. Alarm rules based on abnormal login detection are used to detect abnormal logins in the log data. For example, abnormal login time includes users logging in outside of working hours; abnormal login location includes users logging in from two different geographical locations sequentially, such as logging in first in the first city and then in the second city; or abnormal login device includes users logging in on a device they have never used before. Alarm rules based on malware activity are used to detect malware activity in the log data. For example, detecting a process creating a suspicious child process to access internal data, detecting a host communicating with a malicious server, etc. Based on the above detection results, secure log data is determined. In one optional implementation, the above three types of detection behaviors can be performed simultaneously, finally generating a unified detection result. The detection result includes brute-force detection results, abnormal login detection results, and malware activity detection results.

[0055] By detecting the number of login attempts from the same source address, suspicious processes, abnormal accounts, etc., in the log data, brute-force detection, abnormal login detection, and malware detection are achieved, thereby determining secure log data and reducing the system's false alarm rate.

[0056] Step S204: Associate the security event with historical events to obtain potential attack targets in the security event. Specifically, step S204 includes: Step S2041: Obtain the alarm events that have been triggered in the historical events.

[0057] It should be noted that historical events are events that have triggered alarm information in the previous time period.

[0058] Step S2042: Based on preset query rules, filter out specific interference events in the security event that are the same as the alarm events that have been triggered in the historical events, and exclude specific interference events.

[0059] Specifically, for each newly generated security event, run the preset query rules to determine whether it matches the previously confirmed alarm events. If it matches, it is determined to be a specific interference event and the event is excluded. If it does not match, it is marked as a potential attack target that needs attention. Specifically, this can be determined by extracting key characters in the security event, such as the event source IP, event type, etc.

[0060] Step S2043: Call the preset multi-level nested alarm query conditions in the alarm rules to query non-specific interference events existing in the security events and obtain potential attack targets. Manual 6 / 12 page 9 CN 121664535 A

[0061] It should be noted that after excluding specific interference events, non-specific interference events are queried using preset multi-level nested alarm query conditions. The preset multi-level nested alarm query conditions are complex judgments composed of multiple layers of logic, which associate logs from different data sources and different time points to form a complete attack chain. For example, the system identifies the attack intent and locks the attack target after identifying the risk value by associating the event.

[0062] A security event is an event that occurs within a specific time period. By associating a security event with an event that has been triggered and issued an alarm in the previous time period or earlier, specific interfering events that have already triggered alarms are excluded, thereby improving the system's detection performance and efficiency and reducing the system's false alarm rate.

[0063] Step S205: Based on the preset risk assessment value between historical events and potential attack targets, the risk value of the potential attack target is determined. When the determined risk value reaches a preset threshold, a network security alarm is issued.

[0064] Specifically, the above step S205 includes: Step S2051: Obtaining the data type and threat type of the potential attack target.

[0065] It should be noted that the data type is log data source, such as network device logs, operating system logs, application logs, and security device logs; the threat type is the type of security event, such as malware activity, intrusion attempts, insider threats, and data breaches.

[0066] Step S2052: Based on the preset risk assessment value corresponding to the preset data type and preset threat type, the risk value of the data type and threat type is calculated to determine the risk value of the potential attack target.

[0067] It should be noted that the basic risk score of the security event is obtained based on the data type and threat type. The risk value of the security event after excluding specific interference events is calculated based on the determined threat type, thereby determining the risk value of the potential attack target.

[0068] By setting different risk assessment values ​​for different data types and threat types, multi-condition alarms for multi-source log data can be realized, enabling the system to issue targeted alarms based on different rules. Alarms are only issued after the threat data that needs to be alarmed is determined, thereby optimizing the alarm volume and reducing the false alarm rate of the system.

[0069] Step S206: Obtain the number of failed login attempts and sensitive data access records in the security event.

[0070] It should be noted that the number of failed login attempts is a result of brute-force attack detection. For example, within 5 minutes, the number of failed login attempts by the same source IP address to the same user account exceeds 10. Sensitive data access records are a result of malware activity detection. For example, it is detected that a process creates a suspicious child process to access internal data.

[0071] Step S207: Based on the preset report generation template, input the number of failed login attempts and sensitive data access records into the preset report generation template to generate an alarm notification analysis report.

[0072] It should be noted that the preset report generation template is used for dynamic display of dashboard data. For example, multiple operational dashboards can be designed, including a security event overview dashboard, a real-time attack monitoring dashboard, and a system performance monitoring dashboard, etc., to intuitively display key indicators such as security event trends, attack source analysis, and system resource usage. Compliance requirements covering log retention, access control, and security event handling are generated, and automatic email sending in PDF format is supported for easy viewing by management and auditors.

[0073] Users design templates according to their own business needs, customize data display content, and extract key indicators to improve system flexibility.

[0074] This embodiment provides a network security detection method. Figure 3 is a schematic diagram of the reasoning process of the network security detection method according to an embodiment of the present invention. As shown in Figure 3, it includes the following steps: Step S301: Obtain log information from multiple security devices, clean the log data according to different device tenants, and uniformly format and store it. Specification 7 / 12 pages 10 CN 121664535 A

[0075] Wherein, the log data from multiple sources includes firewalls, switches, routers, Windows / Linux servers, databases, application systems, etc., forming a detailed log source list (multi-source log data).

[0076] Step S302: Dynamically display Dashboard data based on customizable rules, and perform real-time monitoring and analysis of security events according to different rules.

[0077] To address the issue of traditional SIEM Dashboards having limited functionality and being unable to automatically correlate multi-source logs, this system adopts a modular front-end architecture, allowing security analysts to customize views (such as attack chain graphs and real-time threat heatmaps) through drag-and-drop. The back-end, based on OpenSearch's log correlation metrics, automatically identifies attack paths between discrete security events, improving efficiency compared to traditional manual correlation analysis.

[0078] Step S303: Correlate current events with historical events and exclude interference from specific events to analyze potential attack information. To address the issue that OpenSearch's native API cannot support complex alert rules, this system is designed to allow users to define multi-level nested conditions using standard SQL syntax.

[0079] Step S304: Combine real-time anomaly information and potential attack information for comprehensive analysis. When a threshold is reached, an alert is issued and a detailed analysis report is sent via email.

[0080] To solve the problem of low report generation efficiency, this system supports custom report templates, enabling highly customized end-to-end processing from log query to compliance report. The specific process includes: Custom template design: Users design templates according to their own business needs, customize data display drag-and-drop modules and extract key indicators (such as the number of failed login attempts, sensitive data access records); Dynamic template filling: Automatically match OpenSearch query results to preset templates, and support PDF format output.

[0081] In actual application, the following preparatory work needs to be done, including the requirements analysis and asset sorting stage: sorting out log lists, log types and formats, log volume assessment and other information.

[0082] The log source list includes: firewalls, switches, routers, Windows / Linux servers, databases, application systems, etc., forming a detailed log source list (multi-source log data). For example, a company sorted out 237 types of log sources, covering networkNetwork equipment, security equipment, operating systems, databases, middleware, business systems, etc.

[0083] Log type and format: Determine the log type generated by each asset, such as system logs, security logs, application logs, etc., and analyze their formats, such as Syslog, Windows Event Log, JSON, XML, etc.

[0084] Log volume assessment: Assess the number of log events generated per second (EPS). For example, a certain enterprise has a peak EPS of 55k and an average daily log volume of 1.2TB, providing a basis for subsequent storage and computing resource planning.

[0085] Resource assessment and selection stage includes: Hardware resources: Configure sufficient hardware resources based on the log volume assessment results. For example, select a server with a 16-core CPU, 64GB memory, and 2TB SSD to ensure that it can handle high-concurrency log data.

[0086] Network resources: Ensure sufficient network bandwidth, such as 2Gbps, for log transmission to avoid network bottlenecks.

[0087] SIEM platform selection: Comprehensively consider factors such as functionality, performance, cost, and after-sales service to select a suitable SIEM platform. For example, the open-source Elastic Stack is combined with the commercial Splunk Cloud to balance cost and functionality.

[0088] Network and host preparation stage: Network isolation: Divide the SIEM platform into an independent network area, isolated from the business network, to ensure the security and stability of log transmission.

[0089] Time synchronization: Configure an NTP server to ensure that the time of all log sources and the SIEM platform is consistent, which is convenient for subsequent log correlation analysis.

[0090] Certificate and encryption: Configure SSL / TLS certificates for log transmission to encrypt log data and prevent it from being stolen or tampered with during transmission.

[0091] RAID configuration: Configure the disk for storing logs with RAID10 to improve data reliability and read / write performance.

[0092] Core component installation: OpenSearch: Install the OpenSearch cluster, configure an appropriate number of shards and replicas to ensure high availability and query performance of data.

[0093] Logstash: Deploy Logstash nodes for log collection, parsing, and forwarding, and configure rich plugins such as grok, date, and geoip to meet the parsing needs of different log formats.

[0094] Log Access: Windows Log Access: Install a self-developed agent on the Windows server, configure it to collect security logs, system logs, application logs, etc., and set log filtering conditions to reduce invalid log transmission.

[0095] Network Device Log Access: Configure network devices such as firewalls and switches to send Syslog logs to the SIEM platform.The Logstash node of the platform receives logs through port 514 and uses a plugin to parse the log content and extract key fields such as source IP, destination IP, port, and protocol.

[0096] Application log access: For JSON format logs generated by application systems, configure the log path and JSON parsing plugin, and transmit the logs to OpenSearch to ensure correct parsing and indexing of log fields.

[0097] Parsing standardization: Custom parsing mode: For logs of specific formats, write custom parsing modes, such as parsing custom log formats of a certain business system to extract key information such as user ID and operation type.

[0098] Field mapping: Map log fields from different sources to standard fields to achieve the unification of log fields, which facilitates subsequent analysis and correlation, such as mapping the source IP field in various logs to source_ip.

[0099] Detection rules: Rule writing: Collect and write SPL rules that conform to OpenSearch, covering common security scenarios such as brute-force attacks, abnormal logins, and malicious software activities, and import them into the SIEM platform to achieve the detection of security events.

[0100] Threat Intelligence Integration: Configure the integration of the threat intelligence database with the SIEM platform, compare threat indicators such as malicious IPs, domain names, and file hashes with log data to discover potential security threats.

[0101] Operational Dashboards: Design multiple operational dashboards, including a security event overview dashboard, a real-time attack monitoring dashboard, and a system performance monitoring dashboard, to intuitively display key indicators such as security event trends, attack source distribution, and system resource usage.

[0102] Compliance Reports: Generate five types of compliance reports, such as the Information Security Level Compliance 2.0 compliance report, covering compliance requirements for log retention, access control, and security event handling, and supporting automatic email sending in PDF format for easy viewing by management and auditors.

[0103] Configure OpenSearch cross-cluster replication function to achieve a dual-active architecture, ensuring real-time data synchronization across multiple data centers. When the primary cluster fails, the backup cluster can seamlessly take over, ensuring high availability of services.

[0104] Snapshot Backup: Set up regular snapshot tasks to back up OpenSearch index data to object storage, retaining it for 180 days, supporting incremental backups, saving storage space and costs.

[0105] Red Team / Blue Team Exercise: A red team / blue team exercise was organized to simulate 20 common attack scenarios, such as SQL injection, DDoS attacks, and phishing emails, to test the detection capabilities and response speed of the SIEM platform.

[0106] Detection Rate and MTTR: ​​The exercise results showed that the SIEM platform achieved a detection rate of 96% and an average response time (MTTR) of 28 minutes, completing the entire process from alarm detection to IP blocking and account disabling within as little as 5 minutes.

[0107] Source tracing analysis: Utilizing the log association and attack chain timeline functions of the SIEM platform, the attack source is quickly located, and the attack path is traced to provide a basis for subsequent security hardening and incident handling.

[0108] Standard Operating Procedures (SOPs): Standard operating procedure documents are written, covering all aspects of daily operation and maintenance, security incident handling, system upgrades, etc., of the SIEM platform, to standardize the operation process of operation and maintenance personnel.

[0109] Training courses: Three training courses are conducted, including basic operation of the SIEM platform, security incident analysis, emergency response procedures, etc., to improve the professional skills of the enterprise's internal security team.

[0110] Operation manual: A detailed operation manual is compiled, summarizing the best practices, common problems and solutions, performance tuning techniques, etc. of the SIEM platform.

[0111] The enhanced SIEM system based on OpenSearch in this invention not only significantly improves security operation and maintenance efficiency, but also brings multi-dimensional comprehensive benefits: compared with commercial SIEM solutions, it can reduce costs and reduce the demand for operation and maintenance manpower, enabling small and medium-sized enterprises to afford professional-grade security protection; its modular architecture not only improves attack detection efficiency, but also supports rapid adaptation to compliance requirements of industries such as finance and healthcare, shortening audit preparation time; the system supports highly modular custom technology combinations, which not only solves the pain point of the single function of traditional solutions, but also lays the foundation for future intelligent security operation, truly achieving a four-in-one value breakthrough of "cost reduction, efficiency improvement, compliance, and forward-looking". This invention, based on OpenSearch, enhances the efficiency of security operations and maintenance, while also bringing multi-dimensional comprehensive benefits: compared with commercial SIEM solutions, it can reduce costs and maintenance manpower requirements, enabling small and medium-sized enterprises to afford professional-grade security protection; its modular architecture not only improves attack detection efficiency but also supports rapid adaptation to compliance requirements in industries such as finance and healthcare, shortening audit preparation time; the system supports highly customizable modular technology combinations, which not only solves the pain point of traditional solutions having single functions but also lays the foundation for future intelligent security operations, truly achieving a four-in-one value breakthrough of "cost reduction, efficiency improvement, compliance, and forward-looking".

[0112] In this embodiment, a network security detection device is also provided, which is used to implement the above embodiments and preferred embodiments, and will not be repeated for those already described. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0113] This embodiment provides a network security detection device, as shown in FIG4. The device includes: an acquisition module 401, used to acquire log data from multiple source devices; and an analysis module 402, used to analyze and monitor the log data to obtain security events.The association module 403 is used to associate security events with historical events to obtain potential attack targets in security events; the alarm prompting module 404 is used to determine the risk value of potential attack targets based on the preset risk assessment value between historical events and potential attack targets, and to issue a network security alarm when the determined risk value reaches a preset threshold.

[0114] In some optional embodiments, the network security detection device further includes: a processing module, used to classify, clean and uniformly format log data based on the log type in the log data.

[0115] In some optional embodiments, the analysis module 402 includes: a first analysis unit, used to filter log data based on the filtering rules in response to receiving user-defined filtering rules, and filter out security log data.

[0116] A second analysis unit, used to monitor security log data based on the alarm rules in response to receiving user-defined alarm rules, and obtain security events.

[0117] In some optional embodiments, the first association unit includes: a first analysis subunit, used to perform brute-force attack detection, abnormal login detection, and malicious software activity detection on log data based on filtering rules, to obtain security event monitoring results.

[0118] A second analysis subunit, used to determine security log data based on the security event monitoring results.

[0119] In some optional embodiments, the association module 403 includes: a first association unit, used to obtain alarm events that have been triggered in historical events.

[0120] A second association unit, used to filter out specific interference events in security events that are the same as alarm events that have been triggered in historical events based on preset query rules, and exclude specific interference events.

[0121] A third association unit, used to call preset multi-level nested alarm query conditions in the alarm rules to query non-specific interference events existing in security events, and obtain potential attack targets.

[0122] In some optional embodiments, the alarm prompting module 404 includes: an information acquisition unit, used to acquire the data type and threat type of potential attack targets.

[0123] A risk assessment unit is used to calculate the risk value of a data type and a threat type based on a preset risk assessment value corresponding to a preset data type and a preset threat type to determine the risk value of a potential attack target.

[0124] In some optional embodiments, the network security detection device further includes a custom module, which includes: a data acquisition unit, which acquires the number of failed login attempts and sensitive data access records in a security event.

[0125] A report generation unit is used to generate an alarm prompt analysis report by inputting the number of failed login attempts and sensitive data access records into a preset report generation template based on a preset report generation template.

[0126] The network security detection device provided in this embodiment of the invention can execute the network security detection method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method. The further functional descriptions of the above modules and units are the same as those in the corresponding embodiments above, and will not be repeated here.

[0127] FIG5 is a schematic diagram of the structure of an electronic device provided in an embodiment of the invention.

[0128] Referring specifically to FIG5 below, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiment of the invention. The electronic device may include a processor (e.g., a central processing unit, a graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a memory 508 into a random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the electronic device. The processor 501, ROM 502 and RAM 503 are connected to each other through a bus 504. The input / output (I / O) interface 505 is also connected to the bus 504.

[0129] Typically, the following devices may be connected to I / O interface 505: input devices 506 including, for example, touch screens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication devices 509 can allow electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although FIG5 shows an electronic device with various devices, it should be understood that it is not required to implement or have all the devices shown, and more or fewer devices may be implemented or have alternatively.

[0130] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network via communication device 509, or installed from memory 508, or installed from ROM 502. When the computer program is executed by processor 501, it performs the functions defined in the network security detection method of this embodiment of the invention. Specification 11 / 12 pages 14 CN 121664535 A

[0131] The electronic device shown in FIG5 is merely an example and should not impose any limitation on the functions and scope of use of the embodiments of the present invention.

[0132] The embodiments of the present invention also provide a computer-readable storage medium, wherein the above-described method according to the embodiments of the present invention...The method described herein can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code that is originally stored on a remote storage medium or a non-transitory machine-readable storage medium and will be stored on a local storage medium after being downloaded via a network, so that such software processing can be stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that a computer, processor, microprocessor controller, or programmable hardware includes storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the network security detection method shown in the above embodiments.

[0133] A portion of the present invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Accordingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instruction, or the computer compiling the instruction and then executing the corresponding compiled program, or the computer reading and executing the instruction, or the computer reading and installing the instruction and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0134] Although embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and all such modifications and variations fall within the scope defined by the appended claims. Instruction manual, page 12 / 12, 15 CN 121664535 A, Figure 1; Instruction manual, Figure 1 / 4, page 16 CN 121664535 A, Figure 2; Instruction manual, Figure 2 / 4, page 17 CN 121664535 A, Figure 3; Instruction manual, Figure 3 / 4, page 18 CN 121664535 A, Figure 4; Figure 5; Instruction manual, Figure 4 / 4, page 19 CN 121664535 A, Abstract: Abdominal ultrasound examination method, system and device; Network, Security, Determination; Methods, Devices, Electron.EQUIPMENT, AND STORAGE MEDIA The invention relates to the field of network security technology and discloses a network security detection method, device, electronic equipment, and storage medium. The method includes: obtaining log data from multiple sources of devices; analyzing and monitoring the log data to obtain security events; correlating the security events with historical events to obtain potential attack targets within the security events; determining the risk value of the potential attack targets based on preset risk assessment values between the historical events and the potential attack targets, and issuing a network security alert when the determined risk value reaches a preset threshold; this solves the problem that traditional threat detection systems lack the capability of automatic correlation analysis of multi-source logs and cannot support multi-condition alerts.

Claims

1. A network security detection method, characterized in that, The method includes: Acquire log data from multiple sources; The log data is analyzed and monitored to identify security events. By associating the security events with historical events, potential attack targets within the security events can be obtained; Based on a preset risk assessment value between historical events and potential attack targets, the risk value of the potential attack targets is determined, and a network security alarm is issued when the risk value reaches a preset threshold.

2. The method according to claim 1, characterized in that, The analysis and monitoring of the log data yields security events, including: In response to receiving a user-defined filtering rule, the log data is filtered based on the filtering rule to filter out security log data; In response to receiving a user-defined alarm rule, the security log data is monitored based on the alarm rule to obtain the security event.

3. The method according to claim 2, characterized in that, The process of filtering the log data based on the filtering rules to select security log data includes: Based on the filtering rules, the log data is subjected to brute-force attack detection, abnormal login detection, and malicious software activity detection to obtain security event monitoring results. The security log data is determined based on the security incident monitoring results.

4. The method according to claim 2, characterized in that, The step of associating the security events with historical events to obtain potential attack targets in the security events includes: Retrieve the alarm events that have been triggered in the historical events; Based on preset query rules, specific interfering events that are the same as the alarm events that have been triggered in the historical events are filtered out from the security events, and the specific interfering events are excluded. The preset multi-level nested alarm query conditions in the alarm rules are invoked to query non-specific interference events existing in the security event, thereby obtaining the potential attack target.

5. The method according to claim 1, characterized in that, The process of determining the risk value of a potential attack target based on a preset risk assessment value between historical events and potential attack targets includes: Obtain the data types and threat categories of potential attack targets; Based on the preset risk assessment values ​​corresponding to preset data types and preset threat types, the risk values ​​of the data types and the threat types are calculated to determine the risk values ​​of potential attack targets.

6. The method according to claim 5, characterized in that, The method further includes: Obtain the number of failed login attempts and sensitive data access records from the security incident; Based on the preset report generation template, the number of failed login attempts and the sensitive data access records are input into the preset report generation template to generate an alarm prompt analysis report.

7. The method according to claim 1, characterized in that, Before analyzing and monitoring the log data to obtain security events, the method further includes: The log data is classified, cleaned, and uniformly formatted based on the log type in the log data.

8. A network security detection device, characterized in that, The device includes: The acquisition module is used to acquire log data from multiple sources. The analysis module is used to analyze and monitor the log data to obtain security events; The association module is used to associate the security event with historical events to obtain potential attack targets in the security event; The alarm notification module is used to determine the risk value of the potential attack target based on the preset risk assessment value between historical events and potential attack targets, and to issue a network security alarm when the risk value reaches a preset threshold.

9. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the network security detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the network security detection method according to any one of claims 1 to 7.

Images