Method, system and detecting device for network security interaction

Abstract

The invention provides a method, a system and a detecting device for network security interaction. The method comprises the following steps: determining whether an invasion action type in a network belongs to known invasion actions; sending a first instruction carried with a processing mode to a response module if the invasion action type in the network belongs to the known invasion actions; sending unkown invasion action related information to an analysis module if the invasion action type in the network does not belong to the known invasion actions, and acquiring a corresponding processing mode after the analysis module analyzes the related information; and sending a second instruction carried with the processing mode to the response module. The embodiment of the invention realizes safety information and safety response through the upper and under layer relation of the analysis module and the detection module, and can realize the real-time response to safety events through the parallel response relation between under layers of the detecting module and the response module to ensure the effectiveness of the interaction and reduce the rate of false alarm.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of network security, in particular to a network security linkage method, system and detection device. Background technique [0002] With the continuous development of network technology, network security has become an important issue that people pay attention to. The existing security protection technology relies on a single security device to complete network security protection, but each security device is independent of each other and cannot interoperate. Any problem with any security device may lead to a security incident. Faced with network security issues, many organizations have configured network security products, such as firewalls (Fire Wall, FW), system scanners, system real-time monitors, virtual private network (Virtual Private Network, VPN) gateways, and network antivirus software. Network security is a comprehensive issue, and the simple superposition of network secu...

AI Technical Summary

Problems solved by technology

Although the OPSEC and TOPSEC linkage technology system can respond efficiently, it is a relatively closed system that lacks interaction with upper-level analysts, making it difficult to guarantee the effectiveness of linkage, and has a high false alarm rate

In addition, the entities of the linkage system need to be configured in advance, and in most cases it can only solve problems within the same network, and cannot achieve linkage across network domains

Images