通过设备日志分析识别业务流的方法

Method of Device Log Analysis to Identify the Traffic Flow

网络安全在企业信息化中的位置越来越重要,越来越多的网络和系统需要防火墙设备进行安全防护。防火墙设备上的安全策略部署质量的高低,是防火墙设备是否起到安全防护作用的关键。但对于企业网络中众多复杂的各种应用,其数据流向往往比较复杂。本文针对企业网防火墙策略发现问题,提出一种采用网络设备日志分析实现识别业务流的方法,该方法可以低成本、高效率的发现网络中的业务流,进而为防火墙策略的部署提供依据。

Network security in the enterprise information is more and more important, and more and more network and systems need firewall security for security protection. The level of security policy deployment quality is a key for whether the firewall device play the role of security protection. But for many complex applications in enterprise network, its data flow is often more complicated. According to the problems of enterprise network firewall policy, this paper proposes a method that using network device log analysis to identify the traffic flow. The method can discovery network traffic with low-cost, high-efficiency, and thus provide the basis for the deployment of firewall policy.