Host safety protection method and system based on log analysis

The invention discloses a host safety protection method and system based on log analysis. The host safety protection method based on log analysis comprises the steps of: carrying out classified sorting on service logs in a system according to regulations; defining different screening rules for different categories of service logs; according to the screening rules, screening contents of the service logs, and recording data which accords with the screening rules; and setting screening parameters according to regulations, carrying out secondary screening on the data which accords with the screening rules according to the screening parameters, recording an IP address corresponding to the data which meets secondary screening conditions, and writing the IP address into access forbidding rules of a firewall. According to the host safety protection method and system based on the log analysis, which are disclosed by the invention, a network safety policy in the firewall is completed by analysis on the service logs in