Detecting probe interlock based network security event tracking system and method

Abstract

The invention discloses a tracking system for network security event based on monitoring probe linkage and a method thereof, which can track the network security event precisely. According to the technical proposal, the method comprises the following steps: a. according to relevant information of the network security event to be traced, suitable monitoring probes are chosen and applicable tracking rules are determined; b. the tracking rules are released to the monitoring probes; the monitoring probes are collected; according to the monitoring data collected by the tracking rules, information including IP address of the initiating source of the network security event is extracted from the monitoring data; c. if the track completing condition is satisfied, transferring to a step d; otherwise, after the information of the network security event is updated, transferring to the step a; d. the current initiating source is submitted as the final initiating source of the network security event; the flow is finished. The invention is used in a the field of network security.

Description

technical field [0001] The invention relates to the field of network information security, in particular to a network security monitoring system and method. Background technique [0002] The rapid development of information technology has greatly promoted social production, causing great changes in people's work and lifestyle, but at the same time it has also brought certain negative impacts on society. Crimes targeting networks and information systems have increased significantly, and incidents such as network intrusions, online attacks, and information theft have occurred from time to time. Events such as the intrusion of information systems, malicious damage by insiders, and unauthorized operations have always interfered with the normal operation of enterprises and institutions. Contacting, planning and implementing criminal activities through the network has become one of the characteristics of criminal behavior in the new situation. Moreover, new computer network meth...

AI Technical Summary

Problems solved by technology

Moreover, some NATs are functions provided by network devices, and basically do not keep all address conversion logs

[0011] 2. Many proxy and springboard machines are overseas nodes and are not controlled. Even if there are log information on these machines, they cannot be obtained under normal circumstances

[0012] 3. On the springboard, basically all log information about the attacker’s activities will be deleted by the attacker

[0013] 4. Most of the analysis of various logs can only be done after the event, and real-time source tracing cannot be realized

[0014] Therefore, it is difficult to accurately trace the source of a large number of online attack events. In many cases, a large number of manual side investigations are required, which greatly affects the success rate and efficiency of accurate source tracing.

Images