Security attack alarm positioning system based on Spark big data platform of Tachyou

Abstract

The invention discloses a security attack alarm positioning system based on a Spark big data platform of Tachyou and belongs to the field of big data and information security. The system comprises an acquisition module, a security attack alarm positioning module and a view module. The acquisition module gathers log information in an enterprise information system, preprocesses and pushes the log information to the security attack alarm positioning module in real time, the security attack alarm positioning module performs real-time analysis to generate alarm information, and sends the alarm information to a view front end page. Compared with the prior art, the security attack alarm positioning system can solve the problem that a large number of logs are difficult to analyze in real time and has excellent practicality and value of popularization and application.

Description

technical field [0001] The invention relates to the technical fields of information security, Spark big data platform, Flume log collection, kafka data exchange platform, HDFS and Tachyou distributed memory file system, and in particular relates to a security attack alarm positioning system. Background technique [0002] The English abbreviation included in the present invention is as follows: [0003] SOC: SecurityOperationCenter Security Management Center [0004] IDS: IntrusionDetectionSystems intrusion detection system [0005] DDOS: DDoS: DistributedDenialofService distributed denial of service attack [0006] MIS: Management Information System Management Information System [0007] DMZ: demilitarizedzone isolation area, or demilitarized area [0008] JMS: JavaMessageServiceJava Message Service [0009] APP: Application application [0010] SNMP: SimpleNetworkManagementProtocol Simple Network Management Protocol [0011] HDFS: HadoopDistributeFileSystemHadoop Dis...

AI Technical Summary

Problems solved by technology

[0019] 1. There are many types of information security products and network equipment, widely distributed, and lack of unified data analysis and management;

[0020] 2. The knowledge base of information security products and network equipment is not unified, and there is a lack of unified solutions;

[0021] 3. Safety responsibilities are unclear, and specific responsibilities have not been implemented;

[0022] 4. Information security operation and maintenance management assessment is not detailed, lacking some necessary and key indicators;

[0023] 5. There is a lack of more advanced intelligent analysis and aggregation correlation between different security device events and even the same security device events, resulting in a huge amount of alarm information, which is not convenient for the analysis and discovery of potential safety hazards, so as to prevent problems before they happen;

[0024] 6. Information security incidents are not reported in time, fault diagnosis is not timely, processing efficiency is low, and the effect is poor;

[0025] 7. Information security incidents and asset vulnerabilities have not been correlatively analyzed, resulting in no further analysis and processing of many incidents;

[0029] The above-mentioned problems exist to varying degrees in the business and network that the enterprise has built, which will become an obstacle to the stable improvement of the enterprise's business security operation and maintenance management in the future

Images