Security event analysis method and system in cloud computing network

Abstract

The invention provides a security event analysis method in a cloud computing network. The method comprises the following steps that the types of attack scenes are judged; when the type of the attack scenes is judged to be a simple attack process, a model based on character string matching is adopted for analyzing a security event stream. In addition, the invention also provides a security event analysis system based on the cloud computing network. The method and the system provided by the invention have the advantages that the effect of releasing the attack in the attack scene type of the simple attack process from a state machine model can be realized, so the security event analysis efficiency is improved.

Description

technical field [0001] The present invention relates to the field of cloud computing, and more specifically, to a security event analysis method in a cloud computing network and a security event analysis system based on a cloud computing network. Background technique [0002] At present, in SOC (Security Management Platform), commonly used security event correlation analysis models include state machine model and statistical model. The state machine model uses multiple associated state descriptions for multi-step attacks, and some conditions need to be met to switch from one state to the next, that is, the attack characteristics. Match the state transition conditions in the security event flow. If the conditions are matched, it means that the attack characteristics of this stage are satisfied, and the next state is changed. If not, it is discarded until the timeout or all state transitions are completed, indicating that the current state has occurred. The attack indicated b...

AI Technical Summary

Problems solved by technology

[0004] When using the state machine model to analyze security events, there are the following problems: 1. When too many security attack scenarios are defined, it is necessary to match each attack scenario to the security event, resulting in a significant decrease in the inspection efficiency of the system; 2. When the attacker cooperates When attacking, it is necessary to maintain too many security states, resulting in a decrease in the inspection efficiency of the system

When using the statistical model, there are the following problems: 1. Not real-time, because the statistical model is based on the database, security events are stored in the database and then counted according to statistical rules, which delays the time of attack discovery; 2. Efficiency issues, statistics is done in the file system, which is less efficient than memory-based analysis

Images