信息网络安全

信息网络安全 ›› 2014, Vol. 15 ›› Issue (10): 70-76.doi: 10.3969/j.issn.1671-1122.2014.10.013

• • 上一篇    

基于Web应用的安全日志审计系统研究与设计

段娟1,2, 辛阳1,2, 马宇威1,2   

  1. 1.北京邮电大学信息安全中心,北京 100876
    2.灾备技术国家工程实验室,北京 100876
  • 收稿日期:2014-09-01 出版日期:2014-10-01 发布日期:2015-08-17
  • 作者简介:

    段娟（1986-）,女,陕西,硕士研究生,主要研究方向：Web安全、Webshell;辛阳（1977-）,男,北京,副教授,博士,主要研究方向：虚拟化安全、云安全、Web安全;马宇威（1988-）,男,河北,硕士研究生,主要研究方向：网络攻防、移动互联网、IDS技术。

  • 基金资助:
    国家自然科学基金[61121061、61161140320]、中央高校基本科研业务费专项资金[2012RC0215、2012RC0216]

Research and Design of Security Audit Log System Based on Web Application

Juan DUAN1,2, Yang XIN1,2, Yu-wei MA1,2   

  1. 1. Information Security Center, Beijing University of Posts and Telecommunications, Beijing 100876, China
    2. National Engineering Laboratory for Disaster Backup and Recovery, Beijing 100876, China
  • Received:2014-09-01 Online:2014-10-01 Published:2015-08-17

RichHTML

17

PDF (PC)

244

摘要：

近年来随着Web应用技术的不断进步和发展,针对Web应用业务的需求越来越多,随之而来的Web应用安全攻击也呈上升趋势。目前针对网络攻击的防护技术手段也是层出不穷,但一般都是事前检测和事中防护,事后检测维护的则相应比较少。在网络中心有大量的服务器设备,Web日志文件作为服务器的一部分,详细记录设备系统每天发生的各种各样的事件,如客户端对服务器的访问请求记录、黑客对网站的入侵行为记录等,因此要想有效的管理维护设备和在攻击事件发生后及时的降低风险,分析审计日志对于事后检测和维护设备的安全是非常必要的。基于此,文章主要对基于Web应用安全日志审计系统进行研究和设计,日志审计系统主要分为三个子系统：日志采集子系统、分析引擎子系统和日志告警子系统。日志采集子系统采用多协议分析对日志进行收集,并进行相应的日志规范化和去重等处理。分析引擎子系统采用规则库和数理统计的方法,对日志特征进行提取和设置相应的统计量参数,进行比较分析。日志告警子系统则是主要配置相应策略并下发任务,对于审计结果进行界面展示或生成报告并以邮件的方式发送给用户等。

关键词: 日志采集, 多协议采集, 分析引擎, 审计管理

Abstract:

In recent years, with the Web applications technology continuing to progress and develop, there are more and more demands development about Web application services, and then the attendant Web application security attacks are also on the rise. The technical means for cyber attacks are endless at present, but they are generally pre-detection and deal with things in the progress, the corresponding post-detection for less maintenance. In the network center, there are a large number of the server’s equipments, Web log files as part of the server detail a variety of events happening every day of equipment system, such as client access to the server request records, hacker intrusion on the site records, and so on. Therefore, in order to effectively manage the maintenance of equipment and timely reduction in the risk of attacks, analyze audit log for later inspection and maintenance of safety equipment is necessary. Based on this, mainly research and design of security audit log system based on Web application, log audit system consists of three subsystems: the subsystem of log acquisition, the subsystem of analysis engine and the subsystem log alarm. The subsystem of log acquisition uses multi-protocol analysis to collect log, and to process the corresponding log normalization and de-emphasis. The subsystem of analysis engine uses the rule base and mathematical statistics method to extract the log feature and set the appropriate statistic parameters, and then to do the comparative analysis. The subsystem log alarm is the main configuration tasks appropriate policy and issued for the audit results show interface, or generate reports and send messages to users.

Key words: log collection, multi-protocol collection, analysis engine, audit management

中图分类号: