Key IP address safety alarm association analysis method based on fuzzy scene

Abstract

The invention discloses a key IP address safety alarm association analysis method based on a fuzzy scene. The method comprises the steps of: firstly, utilizing a statistic method to aggregate alarms, then utilizing a strategy to neglecting and filtering the alarms, finally utilizing an association analysis algorithm based on the fuzzy scene to calculate an event suspected degree corresponding to a source IP, and utilizing a big data analysis method to carry out statistic querying on alarm logs related to a suspected IP. According to the invention, the concept of fuzzy scene is innovatively provided, and a conventional analysis mode by constructing an attack scene is broken through, wherein the association analysis mode of the fuzzy scene is characterized in that deep excavation and association analysis are carried out on a large number of related safety alarm events with the IP address serving as the core. Related factors of the alarms, which may influence the IP safety, are analyzed, the factors are analyzed in an integrated manner, and a suspected degree value reflecting the safety condition of the IP is obtained by an event suspected degree calculation formula.

Description

technical field [0001] The invention belongs to the technical field of security alarm correlation analysis methods, and in particular relates to a key IP address security alarm correlation analysis method based on fuzzy scenes. Background technique [0002] In computer and network systems, behaviors such as network connection, sending data packets and browsing webpages occur all the time, and these behaviors can be monitored and recorded by security devices. Among these behaviors, some behaviors may affect the security of computer and network systems, and we define such behaviors as security incidents. In the security monitoring system, the final manifestation of security events is the alarm information and log information generated by security tools. When security tools detect interesting behaviors, security alarms will be generated. In the monitoring system, there are often a large number of repeated alarms and false alarms, resulting in an excessively large amount of sec...

AI Technical Summary

Problems solved by technology

[0016] The present invention is to solve the deficiency of correlation analysis technology in the prior art, so that the problem of insufficient correlation analysis ability of massive security alarm events is provided, and provides a key IP address security alarm correlation analysis method based on fuzzy scenes

Images