Implementation method of security event monitoring in security center system

Abstract

The invention provides a design framework of a distributed network behavior real time monitoring system based on a B / S model in which a plurality of monitoring devices are connected with a security center, the security event monitoring is divided into two parts, and the security center is configured with security strategy which is issued to the monitoring devices and self-defines an alarm manner; the monitoring devices monitor the network behavior of a user in real time, and security event and local security strategy are submitted to the security center in real time; the security center analyzes the security event and informs a manager in a mail / short message way so as to realize the real time monitoring of the network behavior of the user. The invention adopts a remote communication way to realize the management of the security center on the monitoring devices, and collectedly manage the security event of the monitoring devices, thus realizing the security event monitoring of the security center on the plural monitoring devices.

Description

technical field [0001] The invention relates to a method for analyzing and processing network data, in particular to a method for realizing security event monitoring, and belongs to the technical field of network management systems. Background technique [0002] With the rapid development of the Internet, there are more and more network applications, and some key services of most enterprises are also provided through the Internet. A major feature of the Internet is its openness, which poses a serious threat to the security of services on the Internet. In order to ensure healthy and orderly development, it is necessary to provide a strong guarantee on network security. [0003] Because the traditional information security management is a terminal device, one device can only manage the specified network segment, and the security policy is set by the local administrator, so the information is relatively blocked. For multiple monitoring devices, the information cannot be shared...

AI Technical Summary

Problems solved by technology

[0003] Because the traditional information security management is a terminal device, one device can only manage the specified network segment, and the security policy is set by the local administrator, so the information is relatively blocked. For multiple monitoring devices, the information cannot be shared, and human resources are seriously wasted. If it is not synchronized, there will be serious information security problems

Images