Safe log analyzing method and system

Abstract

The invention discloses a method for analyzing a security log and a system thereof, which realizes filtration of invalid logs and misreported logs in mass logs, and discovers large-scale network security events and common attack sequences. The method comprises the following steps: the mass logs are subject to cluster analysis by the attribute-oriented inductive algorithm so as to generate class description of each class of log after clustering; an administrator sets filtration regulations according to the clustered class description, unrelated and misreported logs are removed from the current log base so as to simplify the mass logs; Internet Worms, distributed denial of service attacks and other large-scale network security events characteristics are extracted; the simplified log is subject to sequential pattern mining to find attack behavior sequence description commonly used by attackers to be finally submitted to the administrator. The system comprises a clustering analysis module, a filtration module and a sequential pattern mining module. The method and the system can be applied to information processing of the mass logs of security products.

Description

technical field [0001] The invention relates to the field of information security, in particular to a security log analysis method and system. Background technique [0002] The rapid development of the Internet has brought great convenience to the dissemination and utilization of information, but at the same time, human society is facing a huge challenge of information security. In order to alleviate the increasingly serious security problems, security products such as firewalls, intrusion detection systems, and security audit systems have been deployed more and more widely. However, the introduction of a large number of security devices has also brought new problems, which are mainly reflected in the following two aspects: [0003] 1. Continuously running security devices will generate a large amount of logs. In addition to the defects of the security products themselves, a considerable part of the alarms are false alarms, while the truly valuable alarm information is subm...

AI Technical Summary

Problems solved by technology

Due to the large number of alarms and many irrelevant alarms, most of the energy of security management personnel is spent on processing useless information, and it is difficult to understand the security threat status of the system

[0004] 2. Most of the existing security products are detected based on a single data packet, which is reflected in the form of expression. The alarm information of security products is an isolated intrusion event

This method directly performs data mining on the collected logs. If the log information contains a large number of invalid logs and false positive logs, the association rules mined will be meaningless and it is difficult to achieve the expected results.

Images