Security log collection and analysis method, device and equipment and medium

Abstract

The invention discloses a security log collection and analysis method, relates to the field of information security processing, and achieves the analysis of security logs in different formats through formulating different analysis rules. The method comprises the following steps: receiving a security log; generating an analysis configuration file according to the formulated analysis rule; and analyzing the security log by using the analysis configuration file, and storing the analyzed security log. The invention further discloses a security log collecting and analyzing device, electronic equipment and a computer storage medium, so that security logs of different formats are analyzed.

Description

technical field [0001] The present invention relates to the field of information security processing, in particular to a method, device, equipment and medium for collecting and analyzing security logs. Background technique [0002] The rapid development of the Internet has brought great convenience to the dissemination and utilization of information, but it has also brought about information security issues. In order to solve network security problems, security vendors provide a variety of security devices, such as firewalls, intrusion detection systems, security audit systems, etc., but with the widespread deployment of security devices, it also brings corresponding problems, such as continuous operation The security devices of different security devices will generate massive security logs, and the analysis of security logs is very complicated, and the formats of security logs generated by different security devices provided by different security vendors are also different,...

AI Technical Summary

Problems solved by technology

In order to solve network security problems, security vendors provide a variety of security devices, such as firewalls, intrusion detection systems, security audit systems, etc., but with the widespread deployment of security devices, it also brings corresponding problems, such as continuous operation The security devices of different security devices will generate a large amount of security logs, and the analysis of security logs is very complicated, and the formats of security logs generated by different security devices provided by different security vendors are also different, so it is difficult to use a unified method to analyze and use

[0003] The traditional log analysis solution generally uses XML configuration files to parse security logs, but there are the following problems in using XML configuration files to parse security logs: 1. The XML configuration files are cumbersome and inconvenient to maintain; 2. The regular expressions and Variables are separated and need to be specified by index. When the log is too long, it is easy to make mistakes; 3. The development cost is relatively high, and the configuration file is not easy to understand

Images