Multi-dimensional event correlation analysis method

Abstract

The invention discloses a multi-dimensional event correlation analysis method. A retrieval engine is utilized to list events related to suspicious events from a plurality of dimensions. According to the scheme, the efficient retrieval engine is creatively used for the suspicious events, the events related to the suspicious events are quickly listed through a plurality of dimension (IP addresses, ports, time and the like), the correlation between the events can be conveniently presented, and the relevant events can be tracked and traced.

Description

technical field [0001] The present invention relates to event retrieval technology, in particular to multi-dimensional event correlation analysis technology Background technique [0002] Using a high-performance search engine for fast event retrieval has become an indispensable means in people's work. A combination of multiple conditions including source address, source port, destination address, destination port, time range, event level, event category, etc. can be used for retrieval. [0003] When the data query time interval is relatively large, such as data within one year. Since there are hundreds of millions of event storage entries, the query performance is reduced, and the data return time cannot be less than a second-level response. Contents of the invention [0004] Aiming at the problems existing in the existing suspicious event correlation analysis technology, an efficient and accurate suspicious event correlation analysis scheme is needed. [0005] Therefor...

AI Technical Summary

Problems solved by technology

Since there are hundreds of millions of event storage entries, the query performance is reduced, and the data return time cannot be less than a second-level response

Images