Network event association analysis method and device, and computer equipment

Abstract

The invention relates to a network event association analysis method and device, computer equipment and a computer readable storage medium. The method comprises the following steps: setting an event association description file; updating rule information according to the event association description file, and initializing the obtained rule information into an internal rule path diagram; obtaining the reported event, generating a state machine, enabling the state machine to run on the internal rule path diagram according to the reported event, and storing the running record of each step; when the state machine advances to the event node used for reporting the alarm, uploading the alarm information, and destroying the state machine; and judging whether the detection is continued or not: if so, returning to wait for triggering of a newly reported event. According to the method, intrusion event detection can be realized, and the method has the advantages of being diversified in rule condition, clear in intrusion route, low in false alarm rate and clear in context relationship.

Description

technical field [0001] The invention relates to the technical field of computer and network security, in particular to a network event correlation analysis method and device, computer equipment, and a computer-readable storage medium. Background technique [0002] With the development of computer technology and network technology, the diversity of business systems makes the way of intrusion complex and hidden. Common security devices such as firewalls, intrusion detection systems, certificate authorization systems, integrity check tools, anti-virus software, etc., the independence of these security components produces redundant alarms, and the alarms have no context. The huge number of information sources makes the information that security personnel need to process more and more complicated, making it impossible for them to effectively judge the importance of alarms and the path of problems. [0003] Most of the attack (intrusion) events in the network environment do not o...

AI Technical Summary

Problems solved by technology

Huge and complex information sources make the information that security personnel need to process more and more complicated, making it impossible for them to effectively judge the importance of alarms and the path of problems

[0003] Most of the attack (intrusion) events in the network environment do not occur independently, and there is an inevitable relationship between them, and this relationship cannot form an effective record because of the independence and isolation between components

At present, most intrusion detection technology rules are simple in logic, simply recording the occurrence and location of the event, and triggering an alarm when the threshold is reached by setting a threshold. The large amount of alarm information sent interferes with effective alarms, causing event alarm storms, and when matching alarms, because the rules are simple, many matching operations result in false alarms, and the rate of event false alarms is high.

Images