Network security emergency responding method

Abstract

The invention discloses a network security emergency responding method belonging to the technical field of networks. The method comprises the following steps of: (1) establishing a network security emergency strategy base at a server side, and setting the attribute of each strategy in the strategy base; (2) reporting a security event report detected from a network environment to be detected by a network probe to a server; (3) extracting information on the event type and the event attribute of the current security event report by the server; (4) finding a strategy with a matched type by the server according to the event type, if the strategy with the matched type is a universal strategy, adding the strategy into a selectable strategy list, or else, matching each attribute in security attributes of the strategy with each attribute of an event, if each attribute is matched with a certain attribute in the attributes of the event, adding the strategy into the selectable strategy list, and if each attribute is not matched with a certain attribute in the attributes of the event, giving up the strategy; and (5) returning the selectable strategy list of the current security event to a user by the server. The strategy recommended by the invention is accurate and optimized more and more.

Description

technical field [0001] The invention mainly relates to malicious code emergency response work in a large-scale network environment, in particular to a network security emergency response method, which belongs to the field of network technology. Background technique [0002] With the rapid development of computer technology, network applications have been recognized worldwide, and its rapid development is irresistible. At the same time, the security situation of the network is worrying. The top priority is how to ensure that personal data will not be stolen, important data will not be destroyed, and network services will not be interrupted. Therefore, network security issues are directly related to the further application and development of computer networks. In this way, emergency response to specific security events is particularly important. [0003] The key technologies of emergency response include: intrusion detection, event diagnosis, isolation and rapid recovery of...

AI Technical Summary

Problems solved by technology

However, the event diagnosis link in this technology cannot handle certain events in a humane manner, which directly leads to the error situation that the firewall cuts off all access rights of the IP due to suspected malicious actions of the IP.

The balance and coordination of false positives and false negatives and the difficulty of comprehensive analysis of the network situation lead to the unsatisfactory effect of the linkage system

Images