高噪声日志攻击源识别方法研究及实现OA

With the expansion of information system scale and the diversification of network attack methods,network security situation aware-ness platforms and other operation and support platforms generally suffer from problems such as alarm fatigue,high false alarm rates,and diffi-culty in attack attribution when facing massive heterogeneous logs.To address the challenges of attack source identification and threat attribu-tion in high-noise log environments,this paper proposes a method for identifying attack sources in high-noise logs.This method uses a dynamic scoring model of attack source IPs based on multi-dimensional rules to achieve dynamic assessment and updating of the threat level of attack sources.Simultaneously,the system utilizes knowledge graphs to complete attack chain reconstruction and visualization analysis,improving the interpretability and handling efficiency of security incidents.Experimental results show that this method achieves a log compression rate of 99.6%on real log data in the water conservancy industry,reducing the false alarm rate to 8.3%,significantly improving security operation effi-ciency and response capabilities.The research results provide a feasible technical path for intelligent operation of industry-level network security.