Network security log key information extraction method and system

Abstract

The invention discloses a network security log key information extraction method and system, and relates to the field of network monitoring. The method comprises the following steps of S1, acquiring a firewall alarm log and an internal gateway login log from a network security log; S2, processing the firewall alarm log to obtain an intranet result IP list, wherein the intranet result IP list comprises a plurality of intranet IP addresses; S3, retrieving in the internal gateway login log according to the internal network result IP list, and generating an internal network user use record list according to a retrieval result, wherein the intranet user usage record list comprises each intranet IP address, and an allocation log and user login information corresponding to the intranet IP address; and S4, storing the intranet user use record list into a pre-generated to-be-analyzed database for further analysis and use. By combining the firewall alarm log and the internal gateway login information, the internal network IP address is matched, the analysis workload is reduced, the target is clear, and the directivity is high.

Description

technical field [0001] The invention relates to the technical field of network monitoring, in particular to a method and system for extracting key information from network security logs. Background technique [0002] Network security is an important issue related to national security and sovereignty, social stability, and national economic development. Its importance has become more and more important with the acceleration of global informatization. At the same time, with the deepening of information technology and the rapid development of the Internet, network intrusion incidents are increasing, which has brought huge economic losses to people. Some even threaten national security. The detection and defense of network intrusion events is a key issue in network security assurance. In traditional methods, researchers analyze network intrusion behaviors from network security logs, data traffic, malicious code, system vulnerabilities and other channels. However, traditional ...

AI Technical Summary

Problems solved by technology

However, traditional analysis methods cannot meet the security protection requirements of the current network environment

[0003] At present, there are already a large number of association analysis methods, such as IP association and domain name association, etc., but most of these association analysis methods start from the macro, such as the WHOIS information base, etc., such as exploring how many IP addresses a domain name has used, and how many The IP address layer has been used by multiple domain names, etc., but the same monitoring object (one unit) has not been analyzed and integrated

Images