基于Drain3与Loganomaly的网络安全日志分析与事件响应

Network security log analysis and incident response based on Drain3 and Loganomaly

随着信息技术的发展,网络安全问题日益凸显,为了保障网络系统的稳定运行,对HDFS-v1日志进行研究。首先,利用Drain3算法对日志进行解析,有效避免了构造深度较大、不平衡的树,实验结果显示其精确率、召回率、F1度量及准确度均高达100%;其次,基于Loganomaly算法进行异常检测,训练结果训练集、验证集损失值分别为0.21、0.18,预测结果精确度为96.889%,召回率为93.604%,F1度量为95.218%;接着,再用Drain3算法对异常日志分类;最后,通过远程控制实现异常事件响应,发送报警邮件,确保在HDFS发生紧急情况时能够快速、有效地处理故障,保障大数据处理任务的稳定进行。

As network security issues become increasingly critical with the development of information technology,this study focuses on analyzing the logs of HDFS-v1 to ensure the stable operation of network systems.Firstly,the log is parsed by using Drain3 algorithm,which effectively avoids constructing a very deep and unbalanced tree.Experiment results show that its precision,recall,F1 score and accuracy are as high as 100%.Then,anomaly detection is carried out based on Loganomaly algorithm.The loss value of training set and validation set of training results is 0.21 and 0.18,respectively.The accuracy of prediction results is 96.889%,the recall rate is 93.604%,and the F1 metric is 95.218%.After that,the system uses the Drain3 algorithm to classify anomaly logs.Finally,the system uses remote control to implement rapid response to abnormal events and sends alarm emails to ensure rapid and effective fault handling in case of HDFS emergencies,ensuring the stable progress of big data processing tasks.