Variance-based firewall abnormal log detection method

Abstract

The invention relates to a variance-based firewall abnormal log detection method. The variance-based firewall abnormal log detection method comprises the following steps: (1) extracting a log set of all time values in a time range n from a firewall log according to the time range n; (2) classifying all different values of an analysis target A in the log set involved in the step (1) to generate a set {a1, a2, a3 ellipsis am} according to the analysis target A, wherein A is one of the four parameters, i.e., an IP (Internet Protocol), a source port, a destination IP address and a destination port; (3) extracting an element from the set {a1, a2, a3 ellipsis am}, counting in the unit of day according to the log set involved in the step (1) to obtain the frequency of occurrence of the element every day: x1, x2, x3 ellipsis xn; (4) performing analysis of variance on the x1, x2, x3 ellipsis xn and performing alarm processing if a variance value exceeds a variance threshold; (5) repeating the steps (3) and (4) until each element in the set {a1, a2, a3 ellipsis am} is processed. The variance-based firewall abnormal log detection method provides favorable technical support for a security management system and a network monitoring analysis system.

Description

technical field [0001] The invention relates to the field of information technology, in particular to an analysis method for firewall logs. Background technique [0002] Currently, firewalls are widely used in computer network security. All firewalls have a log recording function, which can record all access to the internal network and external network through the firewall. The content of the log mainly includes time, source IP address, source port, destination IP address, and destination port, collectively referred to as the five-tuple of network access. Collecting, managing, and analyzing firewall logs to discover abnormal network access behaviors is a common practice in network security management. Although firewall logs contain a lot of useful information, these logs are only useful after in-depth analysis. Although most firewall manufacturers provide firewall log management systems, they only focus on the unified collection, storage, query, and statistics of logs. Th...

AI Technical Summary

Problems solved by technology

[0003] Now there are some tools for managing firewall logs, but these tools usually only manage logs of a specific firewall, such as the log management system of Tianrongxin, which mainly manages logs of Log collection, storage, display and query, but without the analysis function of abnormal logs, it is impossible to mine abnormal behavior information from a large number of logs

Images