| As the Internet environment becomes more and more severe,the amount of network information grows exponentially.The traditional methods of network security analysis are not applicable to a series of network security problems that may occur in the current network.We urgently need to find a suitable way to discover a series of threats in the network more intuitively,conveniently and quickly.In order to find the potential security threats in the network,we needs to analyze a variety of network security log.This thesis fully considers the characteristics of the internal network security log in the enterprise,and adopts the big data visualization and big data analysis technology to design and develop the security log visual analysis system that of B/S(Browser/Server)architecture.The system implements visual analysis of work patterns in different departments and visualizes a series of threat behaviors within the company's internal network.The main work of this thesis are as follows:1.This thesis studies the development of the network security log visual analysis system and the technologies of the system at home and abroad.The main technologies of the system are: the SSH framework technology of the server,Hadoop big data processing technology,real-time indexing of the original log Elasticsearch technology,MySQL database storage technology.2.This thesis constructs a user portrait module that based on the behavior of users,which realizes horizontal comparison between users in a visual way,and can quickly locate users with abnormal network behavior.3.This thesis uses the way of a variety of network security log joint analysis to investigate internal network threats,and uses the scatter plot module to analyze internal server login abnormal behavior.This module can effectively finds internal server login abnormal behavior.4.This thesis uses Hadoop technology and Elasticsearch technology to deal with network security log,which can satisfies the calculation of large data volume and the real-time index requirement of the original log.5.This thesis implements the functions of each module and verifies it with real data.The evaluation results verify that the system meets the design requirements. |
