Eureka AIR delivers breakthrough ideas for toughest innovation challenges, trusted by R&D personnel around the world.

Industrial internet alarm log association analysis method and system based on graph method

A technology of industrial Internet and correlation analysis, which is applied in the field of correlation analysis of industrial Internet alarm logs based on graph methods, can solve the problems of difficult alarm data analysis and processing, low-risk alarms and false positives, etc., achieve small computing overhead, improve processing efficiency, The effect of low algorithm complexity

Active Publication Date: 2022-04-08
XI AN JIAOTONG UNIV
View PDF10 Cites 8 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

This multi-source, heterogeneous data feature brings additional difficulties and challenges to security analysts' monitoring, analysis, and disposal work. The deployment method that is distributed in different partitions of the network and applies different rules also increases the use of separate networks. Difficulty for security systems or devices to understand the overall security posture of the network
[0004] In addition, because the Industrial Internet applies relatively strict security rules, and network construction prioritizes production efficiency rather than security requirements, the network security systems and devices deployed in the Industrial Internet will generate a large number of low-risk alarms and false alarms
A large number of low-risk alarms and false positives are mixed with a small number of alarms with greater security risks, which also makes the analysis and processing of alarm data more difficult

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Industrial internet alarm log association analysis method and system based on graph method
  • Industrial internet alarm log association analysis method and system based on graph method
  • Industrial internet alarm log association analysis method and system based on graph method

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0046] The implementation of the present invention will be described in detail below in conjunction with the accompanying drawings and test data.

[0047] figure 1It is the overall flow chart of the correlation analysis method of Industrial Internet alarm logs based on the graph method, showing the basic framework of the process of correlation analysis of Industrial Internet multi-source heterogeneous network security alarm logs, where the input test data is excerpted from a power company network security alarm A small amount of alarm log data in the log database, the source IP address and destination IP address have been desensitized; the test alarm log data is deployed by the DP IPS deployed at the exit of the company's network, the Shengbang WAF deployed in the server area, and the deployed Produced in the sky eye system in the terminal area, it meets the requirements of multi-source and heterogeneity.

[0048] A kind of graph method-based industrial Internet alarm log ass...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention provides an industrial internet alarm log association analysis method and system based on a graph method. The method comprises the following steps: step 1, obtaining a network attack alarm log; step 2, analyzing the obtained network attack alarm log to obtain a characteristic quantity corresponding to each network attack alarm; 3, creating a network security event graph according to the obtained characteristic quantity, and dividing the network security event graph into a plurality of alarm clusters; 4, extracting statistical characteristics and topological structure characteristics corresponding to each alarm cluster; 5, analyzing and identifying each alarm cluster according to the obtained statistical characteristics and topological structure characteristics; according to the method, the influence of multi-source and heterogeneous characteristics of alarm log data is avoided, the processing efficiency of common security event alarms and the recognition capability of high-risk events can be effectively improved, and the perception capability of the overall security situation of the industrial internet can be provided.

Description

technical field [0001] The invention belongs to the field of industrial Internet intrusion detection, and in particular relates to a method and system for correlation analysis of industrial Internet alarm logs based on a graph method. Background technique [0002] The Industrial Internet combines advanced sensing and measurement technology, information communication technology and automatic control technology with the process industry, uses the Industrial Internet to sense the state information and parameter data of the process industry, and issues control instructions to realize remote real-time control of industrial processes . The application of advanced industrial Internet technology has improved the controllability, observability and real-time performance of industrial production, and has the trend of resource integration, remote control and interconnection with portal websites and the Internet. The application of the Industrial Internet has improved the production eff...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): H04L9/40H04L67/12G06F16/22G06F16/28G06K9/62
CPCY02P90/30
Inventor 刘杨刘烃王云姜宝翔任泽华刘慧翔
Owner XI AN JIAOTONG UNIV
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Eureka Blog
Learn More
PatSnap group products