Event processing method and system based on risk level

Abstract

The invention provides an event processing method and an event processing system based on the risk level; a state automation machine is established by extracting the state of an event; the state automation machine processes the input event, and the method comprises steps of quickly judging whether the input event is in an event list or not, finding a corresponding state transfer function if the input event is in the event list, judging whether the event is a risky event or not through the state transfer function and feeding back to a client terminal; the system comprises a receiving module, an establishing module, an inquiry module and a judging module; the state of the event is extracted through the receiving module and the state automation machine is established by the establishing module; and the inquiry module determines whether the input event is in the event list in the station automation machine and carries out corresponding operation; the judging module determines whether a current file is a timeout file or not and processes correspondingly; and finally a processing module analyzes which events need to be sent to the client terminal.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a method and system for event processing based on risk levels. Background technique [0002] In the current network security processing system we use, a corresponding risk level is configured for each event. After the occurrence of the event is detected, it only needs to look up the table to obtain the risk level of the event. When users view event records, they often ignore some events, that is, risk events that users think are of low risk level, and users may even filter out these low-risk events through settings. It is because of the neglect of these low-risk events that some more advanced events may be blocked. At the same time, engine detection often only judges one thing and cannot make a judgment on the relevance of things. Then, how to make a comprehensive analysis of network behavior, so that network security can be supervised more effectively and comp...

AI Technical Summary

Problems solved by technology

It is because of the neglect of these low-risk events that some more advanced events may be blocked. At the same time, engine detection often only judges one thing and cannot make a judgment on the relevance of things

Images