CN115964702A - A security log analysis system and method - Google Patents

Abstract

The present invention relates to the field of computer technology, and specifically discloses a security log analysis system and method, wherein the system includes: a behavior recording module for generating security logs; a user analysis module for determining user classification; user classification includes low Risk users, medium-risk users and high-risk users; log monitoring module, used to judge whether the number of security logs not currently uploaded is greater than the first threshold, if greater than the first threshold, upload the security logs not uploaded; if not greater than the first threshold Threshold, to determine whether the number of unuploaded security logs is greater than the second threshold, if greater than the second threshold, determine whether the classification of the user is a high-risk user, if it is a high-risk user, upload the unuploaded security logs, where the second threshold less than the first threshold. Adopting the technical solution of the invention can automatically determine the uploading time of the security log and improve the protection effect.

Description

A security log analysis system and method

technical field

The invention relates to the field of computer technology, in particular to a security log analysis system and method.

Background technique

With the rapid development of the Internet, many security applications, such as antivirus software and network security firewalls, will be installed on computers to prevent network attacks. These security applications can alarm and process most network security threats, monitor the operation of the network and contain attacks to a certain extent.

When the security application detects a virus and successfully prevents abnormal behavior, it will generate a security log. By analyzing the security log, you can understand the current risks of the computer, discover deep-seated attack intentions and behaviors, and improve the security protection effect.

The current security log analysis is usually after a certain amount of security logs have been accumulated or uploaded periodically for unified analysis. However, the generation of security logs is mainly due to the identification of risks by security applications. For attacks that successfully bypass security applications, often It cannot be fully reflected in the security log, and there is a certain "survivor bias". Therefore, it is easy to miss the best protection time only by accumulating a certain amount of security logs or uploading them regularly.

Therefore, a security log analysis system and method capable of automatically determining the timing of uploading security logs is needed.

Contents of the invention

One of the objectives of the present invention is to provide a security log analysis system, which can automatically determine the timing of uploading the security log and improve the protection effect.

In order to solve the above technical problems, the application provides the following technical solutions:

A security log analysis system, including a protection module, configured to perform preset protection operations when a virus or abnormal behavior is detected; it also includes:

The behavior recording module is used to record the protection operation of the protection module and generate a security log;

The user analysis module is used to record the user's computer operation behavior, analyze the user's computer familiarity according to the computer operation behavior, and determine the user's classification based on the preset classification rules and computer familiarity; the user's classification includes low-risk users and medium-risk users and high-risk users;

The log monitoring module is used to judge whether the number of currently unuploaded security logs is greater than a first threshold, and if it is greater than the first threshold, upload the unuploaded security logs; if not greater than the first threshold, determine whether the number of unuploaded security logs is greater than The second threshold, if it is greater than the second threshold, judge whether the classification of the user is a high-risk user, and if it is a high-risk user, upload the unuploaded security log, wherein the second threshold is smaller than the first threshold.

The principles and beneficial effects of the basic scheme are as follows:

In this solution, by recording and analyzing the user's computer operation behavior, the user's familiarity with the corresponding computer can be obtained, and combined with the preset classification rules, the classification of the user can be obtained. For example, if a user is familiar with computers, it can be seen from the side that the user has rich computer-related knowledge and has a certain awareness of risk prevention, so he can be identified as a low-risk user. If the user has a low familiarity with computers, he will actively identify Risk awareness is relatively poor and can be identified as high-risk users. When the number of unuploaded security logs is not greater than the first threshold, a second judgment condition is set up for high-risk users, that is, to determine whether the number of unuploaded security logs is greater than the second threshold. If it is greater than the second threshold, the The uploaded security logs are uploaded, so that the security logs of high-risk users can be analyzed in time, and if there are risks, they can be discovered in time.

In summary, this solution can automatically determine the timing of uploading security logs according to the user's situation, and improve the protection effect.

Further, it also includes a log analysis module, which is used to analyze the uploaded security logs and generate analysis results; it is also used to count the corresponding relationship between the number of security logs and the efficiency of the analysis results, and filter out the analysis with an efficiency greater than the first set value As a result, the number of security logs corresponding to the analysis result is determined, and the number of security logs is used as the first threshold; it is also used to filter out the analysis results whose efficiency is greater than the second set value, and the number of security logs corresponding to the analysis result is determined. The number of security logs serves as a second threshold, wherein the first set value is greater than the second set value.

Through this preferred solution, the most suitable first setting value can be determined on the premise of ensuring efficiency, and the situation of invalid analysis can be reduced. It can also balance security and computing resources to determine the second setting value, avoiding the security log of the second setting value being too inefficient, consuming computing resources for no reason, and avoiding the security log of the second setting value being too efficient High, it takes more time to accumulate the number of security logs, and risks cannot be detected early.

Further, the log analysis module is also used to filter out the analysis results whose effectiveness rate is greater than the first set value, and after determining the number of security logs corresponding to the analysis results, take the lowest number of security logs as the first threshold.

Using the lowest number of security logs as the first threshold can shorten the upload interval, thereby reducing the time to discover risks.

Further, the log analysis module is further configured to recalculate the first threshold and the second threshold every preset period.

Further, the log monitoring module is also used to analyze the number of unuploaded security logs of high-risk users and generate a curve when judging that the number of unuploaded security logs is not greater than the second threshold, and determine whether the generated curve is in a stable state. status, the unuploaded security logs will not be uploaded at this time.

Further, the log monitoring module is also used to judge whether the user’s single computer use time exceeds the set time, if it exceeds the set time, count the number of security logs generated by using the computer each time, and fit it into a curve;

If the set time is not exceeded, count the number of security logs generated by the computer within each set time and fit it into a curve.

According to the actual usage of the user, two methods are used to count the number of security logs and fit the curve, so that the curve can more accurately reflect the current risks faced by the user.

Further, the log monitoring module is also used to determine whether the generated curve is in a declining state when analyzing the generated curve of the security log that is not currently uploaded, and if it is in a declining state, to judge the number of times the security software is used within the set time in the computer operation behavior Whether it is higher than the preset number of times, if it is higher than the preset number of times, upload the unuploaded security logs.

The number of times the security software is used within the set time is higher than the preset number, indicating that the user frequently uses the security software, and the user is more likely to experience problems with the computer. Therefore, uploading the unuploaded security logs will help to discover risks in time.

Further, the log monitoring module is also used to determine whether the generated curve is in the rising state when analyzing the generated curve of the security log that has not been uploaded currently, and if it is in the rising state, judge whether the current maximum value exceeds the historical maximum value, and if so, set Unuploaded security log upload;

Wherein, the historical maximum value is the maximum value of the number of security logs generated by using the computer each time in history or the maximum value of the number of security logs generated by the computer within each set time period.

The curve is on the rise, and the current maximum value exceeds the historical maximum value. On the surface, the current security software protection behavior has increased, and the risks faced by the computer have increased. Uploading unuploaded security logs will help to discover risks in time.

Further, the log monitoring module is also used to judge whether the number of unuploaded security logs is lower than the third threshold when the judgment curve is in the rising state, and if it is lower than the third threshold, the unuploaded security logs are not uploaded.

For example, the effectiveness of the security log analysis results under the third threshold is extremely low, and the waste of computing resources can be reduced by not uploading unuploaded security logs below the third threshold.

The second object of the present invention is to provide a security log analysis method using the above system.

Description of drawings

Fig. 1 is a logical block diagram of a security log analysis system in Embodiment 1.

Detailed ways

The following is further described in detail through specific implementation methods:

Embodiment one

As shown in FIG. 1 , a security log analysis system in this embodiment includes a protection module, a behavior recording module, a user analysis module, a log monitoring module and a log analysis module.

The protection module is used to execute a preset protection operation when a virus or abnormal behavior is detected; in this embodiment, the abnormal behavior is defined by the developer of the security software, such as tampering with the browser homepage.

The behavior recording module is used to record the protection operations of the protection module and generate a security log; in this embodiment, the security log includes time, type and summary, wherein the types include virus protection, system protection and network protection.

The user analysis module is used to record the user's computer operation behavior, analyze the user's computer familiarity according to the computer operation behavior, and determine the user's classification based on the preset classification rules and computer familiarity; the user's classification includes low-risk users and high-risk users. In this embodiment, the computer operation behavior includes using security software, updating patches for the computer, downloading software from the official website, removing the option to install the accompanying software during the software installation process, and not setting during the software installation process, etc. Different computer operation behaviors are set differently. For example, +2 points for removing the additional software option during the software installation process, and -1 point for not setting it during the software installation process, and then reflect the user's computer familiarity based on the total score. The higher the score, the higher the user's computer familiarity. Then define different score intervals for low-risk users and high-risk users, determine the score intervals based on the above-mentioned total score, and find the corresponding classification.

The log monitoring module is used to judge whether the number of currently unuploaded security logs is greater than the first threshold; if it is greater than the first threshold, upload the unuploaded security logs; if not greater than the first threshold, judge whether the current unuploaded security logs are greater than The second threshold, if it is greater than the second threshold, judge whether the classification of the user is a high-risk user, and if it is a high-risk user, upload the unuploaded security log, wherein the second threshold is smaller than the first threshold.

The log analysis module is used to analyze the uploaded security logs and generate analysis results. In this embodiment, the analysis result is that the data is valid or the data is invalid, wherein the data is valid, and the further result is that there is no security risk or there is a security risk.

The log analysis module is also used to count the corresponding relationship between the number of security logs and the efficiency of the analysis results, filter out the analysis results whose efficiency is greater than the first set value, determine the number of security logs corresponding to the analysis results, and use the number of security logs as the first set value. A threshold; it is also used to filter out the analysis results whose efficiency is greater than the second set value, determine the number of security logs corresponding to the analysis results, and use the number of security logs as the second threshold, wherein the first set value is greater than the second set value Value.

For example, 1000 users each upload 100 security logs, among them, the analysis result of the security logs uploaded by 981 users is that the data is valid. It can be concluded that the effective rate of 100 security logs is 98.1%. If the first setting value is 98 %, the effective rate of 100 security logs is greater than the first set value, which meets the requirements. The number of security logs corresponding to the analysis result is 100, and 100 can be used as the first threshold.

In this embodiment, after filtering out the analysis results with an efficiency greater than the first set value and determining the number of security logs corresponding to the analysis results, the lowest number of security logs is used as the first threshold; the same is true for the second threshold. For example, the effective rate of 100 security logs is 98.1%, the effective rate of 150 security logs is 98.7%, and 100 is the lowest as the first threshold.

The log analysis module is also used to recalculate the first threshold and the second threshold every preset period. The preset period is 6-12 months, which is 6 months in this embodiment.

This embodiment also provides a security log analysis method using the above system.

Embodiment two

The difference between this embodiment and Embodiment 1 is that the log monitoring module in this embodiment is also configured to analyze the number of unuploaded security logs of high-risk users and generate a curve when judging that the number of unuploaded security logs is not greater than the second threshold.

Specifically, the log monitoring module judges whether the user's single computer use time exceeds the set time, if it exceeds the set time, counts the number of security logs generated by using the computer each time, and fits it into a curve; in this embodiment, set The time is 5 hours. If the set time is not exceeded, count the number of security logs generated by the computer within each set time and fit it into a curve. In this embodiment, in the fitted curve, the quantity is represented by the vertical axis, and the number of statistics is represented by the horizontal coordinate.

The log monitoring module is also used to judge whether the generated curve is in a stable state, and if it is in a stable state, the unuploaded security logs are not uploaded at this time. In this embodiment, the stable state means that the ratio of the difference between the maximum value and the minimum value of a single statistic to the average value is less than 5%.

The log monitoring module is also used to judge whether the generated curve is in a declining state. If it is in a declining state, it is judged whether the number of times the security software is used within the set time in the computer operation behavior is higher than the preset number of times. If it is higher than the preset number of times, it will not Upload Security log upload. In this embodiment, the preset number of times is 5, and in other embodiments, it can also be determined according to the length of the set time. In this embodiment, the declining state means that the condition of the steady state is not satisfied, and the number of security logs counted for at least three times has continuously decreased. In other embodiments, the decreasing amount of two counts can also be specified to determine the declining state.

The log monitoring module is also used to judge whether the generated curve is in the rising state. If it is in the rising state, it is judged whether the number of unuploaded security logs is lower than the third threshold. If it is lower than the third threshold, the unuploaded security logs are not uploaded. Based on the third threshold, it is judged whether the current maximum value exceeds the historical maximum value, and if so, the unuploaded security logs are uploaded; wherein, the historical maximum value is the maximum value or Use the maximum number of computer-generated security logs per set time. In this embodiment, the third threshold is the number of security logs with an effective rate of 0 determined by the log analysis module. In this embodiment, the rising state means that the condition of the steady state is not met, and the number of security logs counted for at least three times continues to rise. In other embodiments, the rising amount of two counts can also be specified to determine the rising state.

The above is only an embodiment of the present invention, and the invention is not limited to the field involved in this implementation case. The common knowledge such as the specific structure and characteristics known in the scheme is not described here, and those of ordinary skill in the art know the filing date or priority All ordinary technical knowledge in the technical field to which the invention belongs before the date, can know all the prior art in this field, and have the ability to apply the conventional experimental methods before the date, those of ordinary skill in the art can, under the inspiration given by this application, To perfect and implement this solution in combination with one's own ability, some typical known structures or known methods should not become obstacles for those of ordinary skill in the art to implement this application. It should be pointed out that for those skilled in the art, under the premise of not departing from the structure of the present invention, several modifications and improvements can also be made, and these should also be regarded as the protection scope of the present invention, and these will not affect the implementation of the present invention. Effects and utility of patents. The scope of protection required by this application shall be based on the content of the claims, and the specific implementation methods and other records in the specification may be used to interpret the content of the claims.

Claims (10)

1. A security log analysis system, comprising a protection module, configured to perform preset protection operations when a virus or abnormal behavior is detected; it is characterized in that it also includes: The behavior recording module is used to record the protection operation of the protection module and generate a security log; The user analysis module is used to record the user's computer operation behavior, analyze the user's computer familiarity according to the computer operation behavior, and determine the user's classification based on the preset classification rules and computer familiarity; the user's classification includes low-risk users and medium-risk users and high-risk users; The log monitoring module is used to judge whether the number of currently unuploaded security logs is greater than a first threshold, and if it is greater than the first threshold, upload the unuploaded security logs; if not greater than the first threshold, determine whether the number of unuploaded security logs is greater than The second threshold, if it is greater than the second threshold, judge whether the classification of the user is a high-risk user, and if it is a high-risk user, upload the unuploaded security log, wherein the second threshold is smaller than the first threshold. 2. The security log analysis system according to claim 1, characterized in that: it also includes a log analysis module, which is used to analyze the uploaded security logs and generate analysis results; it is also used to count the number of security logs and the efficiency of the analysis results Corresponding relationship, filter out the analysis results whose efficiency is greater than the first set value, determine the number of security logs corresponding to the analysis result, and use the number of security logs as the first threshold; it is also used to filter out the effective rate greater than the second setting value, determine the number of security logs corresponding to the analysis result, and use the number of security logs as a second threshold, wherein the first set value is greater than the second set value. 3. The security log analysis system according to claim 2, characterized in that: the log analysis module is also used to filter out the analysis results whose effective rate is greater than the first set value, after determining the number of security logs corresponding to the analysis results , taking the lowest number of security logs as the first threshold. 4. The security log analysis system according to claim 2, wherein the log analysis module is further configured to recalculate the first threshold and the second threshold every preset period. 5. The security log analysis system according to claim 2, characterized in that: the log monitoring module is also used to analyze that high-risk users have not uploaded security logs currently when judging that the number of unuploaded security logs is not greater than the second threshold Quantify and generate a curve to determine whether the generated curve is in a stable state. If it is in a stable state, do not upload unuploaded security logs at this time. 6. The security log analysis system according to claim 5, characterized in that: the log monitoring module is also used to judge whether the user's single computer use time exceeds the set time, and if it exceeds the set time, count each use Amount of computer-generated security logs, fitted to a curve; If the set time is not exceeded, count the number of security logs generated by the computer within each set time and fit it into a curve. 7. The security log analysis system according to claim 6, characterized in that: the log monitoring module is also used to determine whether the generation curve is in a descending state when analyzing the generation curve of the security log that is not currently uploaded, and if it is in a descending state , judging whether the number of times the security software is used within the set time in the computer operation behavior is higher than the preset number, and if it is higher than the preset number, upload the unuploaded security log. 8. The security log analysis system according to claim 7, characterized in that: the log monitoring module is also used to determine whether the generation curve is in a rising state when analyzing the generation curve of the security log that has not been uploaded at present, and if it is in the rising state , to determine whether the current maximum value exceeds the historical maximum value, and if so, upload the unuploaded security log; Wherein, the historical maximum value is the maximum value of the number of security logs generated by using the computer each time in history or the maximum value of the number of security logs generated by the computer within each set time period. 9. The security log analysis system according to claim 8, characterized in that: the log monitoring module is also used to judge whether the quantity of unuploaded security logs is lower than the third threshold when the judgment curve is in a rising state, if If it is lower than the third threshold, unuploaded security logs are not uploaded. 10. A security log analysis method, characterized in that the system according to any one of claims 1-9 is used.

Images