Analysis method of analysis engine with node thread level non-redundancy calculation

Abstract

The invention discloses an analysis method of an analysis engine with node thread level non-redundancy calculation, and belongs to the technical field of information network security analysis. The working principle of the analysis engine is as follows: a strategy analysis part analyzes and loads strategies with different external view angles and different external filtering characteristic conditions; the loaded strategy is distributed to each concurrent statistical analysis module through a strategy distribution module; in individual node, the engine view angle classification processing logicalgorithm performs independent logic processing according to different view angle fields in the custom strategy; feature filtering conditions in the strategy are logically processed; and the analysisengine performs duplication elimination processing on all groups and individual statistical algorithms, filtering conditions and research and judgment conditions of the strategy allocated to the nodeto ensure that the filtering conditions, feature statistics and the research and judgment conditions in the single node are only processed once, and calculated feature values are stored in a calculated feature value set.

Description

technical field [0001] The invention belongs to the technical field of information network security analysis, and in particular relates to an analysis method with an analysis engine with node thread level non-redundant calculation. Background technique [0002] The logs generated by the business and system under the jurisdiction of the enterprise are very important to the enterprise. It can not only analyze the business requirements of the business system, but also use these log data to analyze the possible security problems of the business system. The analyzed business requirements can improve the relevant functions of the system, enhance the stability and reliability of the system; through the analysis of business system security issues, the security level of the business system can be strengthened, that is, the security of user information data and assets can be guaranteed while ensuring a good user experience reliable. [0003] At present, there are many log analysis pr...

AI Technical Summary

Problems solved by technology

[0010] The purpose of the present invention is to provide an analysis method with an analysis engine with no redundant calculation at the node thread level. This patent adopts multi-view, self-defined filter features, merged group statistics module and individual analysis module to carry out multi-node concurrent statistical analysis design and implementation methods, which solve the defects that the existing rule analysis engine can only analyze a single perspective, and the statistical analysis features are simple and cannot be applied to complex business application scenarios

Images