A network event correlation analysis method and device, computer equipment

Abstract

The present invention relates to a network event correlation analysis method and device, computer equipment, and a computer-readable storage medium. The method includes: setting an event correlation description file; updating rule information according to the event correlation description file, and initializing the obtained rule information as internal Rule path diagram; obtain the reported event, generate a state machine, make the state machine run on the internal rule path diagram according to the reported event, and save the record of each step of operation; when the state machine advances to the event node for reporting an alarm, Then send the alarm information and destroy the state machine; judge whether to continue the detection, if so, return to wait for the trigger of the newly reported event. The invention can realize intrusion event detection, and has the advantages of diverse rule conditions, clear intrusion lines, low false positive rate and clear context relations.

Description

technical field [0001] The invention relates to the technical field of computer and network security, in particular to a network event correlation analysis method and device, computer equipment, and a computer-readable storage medium. Background technique [0002] With the development of computer technology and network technology, the diversity of business systems makes the way of intrusion complex and hidden. Common security devices such as firewalls, intrusion detection systems, certificate authorization systems, integrity check tools, anti-virus software, etc., the independence of these security components produces redundant alarms, and the alarms have no context. The huge number of information sources makes the information that security personnel need to process more and more complicated, making it impossible for them to effectively judge the importance of alarms and the path of problems. [0003] Most of the attack (intrusion) events in the network environment do not o...

AI Technical Summary

Problems solved by technology

Huge and complex information sources make the information that security personnel need to process more and more complicated, making it impossible for them to effectively judge the importance of alarms and the path of problems

[0003] Most of the attack (intrusion) events in the network environment do not occur independently, and there is an inevitable relationship between them, and this relationship cannot form an effective record because of the independence and isolation between components

At present, most intrusion detection technology rules are simple in logic, simply recording the occurrence and location of the event, and triggering an alarm when the threshold is reached by setting a threshold. The large amount of alarm information sent interferes with effective alarms, causing event alarm storms, and when matching alarms, because the rules are simple, many matching operations result in false alarms, and the rate of event false alarms is high.

Images