Network security situation awareness system and method based on information correlation

Abstract

The invention relates to a network security situation awareness system and method based on information correlation. The system comprises a data acquisition module, a network security situation evaluation module, a network security situation prediction module and a network situation visualization module, wherein the data acquisition module is used for acquiring network essential information; the network security situation evaluation module is used for quantitatively analyzing threat, frangibility and stability of the network by utilizing the network essential information, thereby analyzing the current network security situation; the network security situation prediction module is used for predicting the network security situation according to historical information and current state of the network security situation; and the network situation visualization module is used for visually displaying network security indexes according to the analysis and prediction result of the network security situation. The invention solves the problem that the existing network situation awareness system lacks data validity verification, data correlation and quantitative analysis, so that the network security situation awareness is more accurate.

Description

technical field [0001] The invention relates to the field of information security, in particular to an information association-based network security situation awareness system and a method thereof. Background technique [0002] At present, many scientific research institutions are conducting research and development of network situational awareness tools, and have made some progress. SiLK developed by CERT NetSA (Network Situational Awareness Team) is a traffic analysis tool. It can perform security analysis in large-scale networks, supports efficient collection, storage and analysis of network flow data, and enables network security analysts to quickly query relevant information from a large number of historical data sets, and evaluate network security situation based on the query results. Silk consists of two parts: collection system and analysis system. The collection system is responsible for receiving Netflow, converting it into a more reasonable format, and storing ...

AI Technical Summary

Problems solved by technology

[0016] An object of the present invention is to provide a network security situational awareness system and method based on information association, which is used to overcome the problems of existing network situational awareness systems that lack data validity verification, data correlation and quantitative analysis, thereby making network security Situational awareness is more accurate

Images