Remote network behavior real time monitoring method based on multilayer data interception

Abstract

The invention provides a remote network behavior real time monitoring method based on multilayer data interception. A plurality of monitor devices are connected with a security center, the design framework of the monitoring system is implemented based on B / S model distributed network behavior, and the network behavior real time monitoring is divided into two parts: the monitor devices analyze the messages in real time, and the messages in conformity with the monitoring strategy are reported to the security center; the security center issues the monitoring strategy to the monitor devices, the messages are analyzed and a search engine is provided, a user is connected with the security center by a terminal, and the user configures the monitoring strategy and queries the network behaviour to realize monitoring the remote network behavior in real time. The application of remote network behavior real time monitoring technology based on multilayer data interception can effectively manage the information security of the remote network, thus realizing information security uniform management and secondary mining and analyzing of data and improving the information security of the whole network.

Description

technical field [0001] The invention relates to a remote network behavior real-time monitoring method based on multi-layer data interception, belonging to the technical field of network behavior security. Background technique [0002] With the rapid development of the Internet, there are more and more network applications, and some key services of most enterprises are also provided through the Internet. A major feature of the Internet is its openness, which poses a serious threat to the security of services on the Internet. In order to ensure healthy and orderly development, it is necessary to provide a strong guarantee on network security. [0003] Since the traditional network behavior monitoring system is a terminal device, the message is discarded after analysis, and the monitoring result is stored in the database, which has serious limitations: the message cannot be analyzed twice, and the data between monitoring devices is not shared, which is safe. Information is bl...

AI Technical Summary

Problems solved by technology

[0003] Since the traditional network behavior monitoring system is a terminal device, the message is discarded after analysis, and the monitoring result is stored in the database, which has serious limitations: the message cannot be analyzed twice, and the data between monitoring devices is not shared, which is safe. Information occlusion, network behavior analysis can not better reflect the current network status

Images