黑龙江科学2024,Vol.15Issue(20) :12-17.

基于孤立森林的Apache日志可视化分析与异常检测

ApacheLog Visualization Analysis and Anomaly Detection Based on Isolated Forest

嵇川航 赖明珠 段志鸣 刘素艳
黑龙江科学2024,Vol.15Issue(20) :12-17.

基于孤立森林的Apache日志可视化分析与异常检测

ApacheLog Visualization Analysis and Anomaly Detection Based on Isolated Forest

嵇川航 1赖明珠 2段志鸣 2刘素艳1
扫码查看

作者信息

  • 1. 石家庄铁道大学电气与电子工程学院,石家庄 050043
  • 2. 海南师范大学数学与统计学院,海口 571158
  • 折叠

摘要

Apache是一款流行的Web服务器端软件之一,是互联网基础设施的重要组成,其网络安全尤为重要.日志中记录了所有对服务器的请求,通过分析Apache日志可以及时发现安全威胁及潜在的安全威胁,从而保证网络和服务器安全.选取Apache日志文件,采用孤立森林算法用于日志分析及异常检测,结合Python的可视化功能库将结果进行可视化展示.日志类型分析显示非法日志占比达到7.93%,通过月流量趋势分析发现11月份访问量为2121次,访问量异常突出.统计IP访问量发现访问量排名第一的为1002次,是访问量排名第二的624次的将近两倍.异常日志频率检测找到该日志中凌晨3点存在异常行为,通过分析发现异常日志占比较小,但通过可视化分析可以对访问量异常的月份进行重点监测,可禁用异常IP防止恶意攻击行为.

Abstract

Apache is one of the popular Web server software.It is an important part of the Internet infrastructure.So its network security is particularly important.Apache logs record all requests to the server.By analyzing Apache logs,the study discovers security threats and potential security threats in a timely manner,so as to ensure network and server security.Then study selects Apache log files,uses isolated forest algorithm for log analysis and anomaly detection,and visually displays the results in combination with visualization function library of Python.Log type analysis shows that illegal logs account for 7.93%.According to the monthly traffic trend analysis,the number of visits in November is 2121,which is extremely prominent.Through statistics of IP visits,it is found that the number of visits ranked first is 1002 times,which is nearly twice the number of visits ranked second(624 times).Abnormal log frequency detection finds that abnormal behaviors exist at 3 am in the log,and the abnormal logs account for a relatively small proportion.However,visual analysis can be used to monitor the months with abnormal access and disable abnormal IP addresses to prevent malicious attacks.

关键词

网络安全/异常检测/孤立森林/可视化

Key words

Network security/Anomaly detection/Isolated forest/Visualization

引用本文复制引用

出版年

2024
黑龙江科学
黑龙江省科学院

黑龙江科学

影响因子:1.014
ISSN:1674-8646
段落导航相关论文