Network security incident association analysis system

Abstract

The invention relates to a network security incident association analysis system comprising a network security incident collection layer, a communication network layer, an association analysis layer and a management presentation layer. A set of Web structure-based on-line association analyzing and monitoring system capable of distributed network security incident collection, multi-point implementation association analysis, center comprehensive judgment and real-time communication is built by carrying out digital management of whole processes of unified collection, transmission, analysis, distribution and the like to complex IT (Information Technology) resources in a computer network and various security logs and incidents which are continuously generated in the operational process of the security defense facilities of the computer network, utilizing an incident associativity prediction principle and combining incident flow space-time window filter, log string leading match quick dynamic analysis and a polydimensional mass incident strong algorithm to carry out association analysis on situations before, during and after network security incidents to the network security incidents. The network security incident association analysis system is used for effectively managing the security of complex IT resources in the computer network for a long term, can truly and accurately reflect the network information security of the computer network and the security situation of the business system data, and provides a quantitative standard for checking the information security level of the computer network.

Description

technical field [0001] The present invention relates to a correlation analysis system, specifically a real-time monitoring of IT resource operation, security real-time monitoring, and risk real-time monitoring in a computer network system, which realizes complex IT resources and their related information in computer networks of enterprises and organizations. All kinds of security logs and events that are continuously generated during the operation of security defense facilities are collected, transmitted, analyzed, and released in a comprehensive and real-time manner. Background technique [0002] Today's enterprises and organizations are facing a more complicated situation in the field of IT information security than ever before, which includes endless intrusions and attacks from outside enterprises and organizations, as well as violations and leaks from within enterprises and organizations. In order to continuously cope with new security challenges, enterprises and organi...

AI Technical Summary

Problems solved by technology

The security system established by this method can generally only prevent security threats from a certain aspect, thus forming isolated islands of security defense, which cannot produce synergistic effects

On the other hand, t

Images