Collaborative analysis method of information security operation centers

Abstract

The invention relates to the technical field of information safety, in particular to a collaborative analysis method of information security operation centers. An internetwork collaborative module of one of the security operation centers sends suspected threat information, then a safety event management module analyzes the suspected threat information, and it is determined that a threat is found if the threat meets the standard of a certain attack event; a receiver finding the threat informs a sender of the suspected threat and other security operation centers of confirmation information through the internetwork collaborative module; a requester takes corresponding measures through a safety strategy library; if the sender does not find the threat by himself, correlation analysis of the second stage is carried out by communication between the sender and other receivers; all the security operation centers take corresponding measures for response after receiving the information. The collaborative analysis method of the information security operation centers achieves the collaborative analysis of the information security operation centers and can be used for the security operation centers for information security operation.

Description

Technical field [0001] The invention relates to the technical field of information security, in particular to a collaborative analysis method of an information security management center. Background technique [0002] Security Operation Center (SOC) is a term describing a management platform that can collect, analyze and respond to a variety of information security incidents. The core function of SOC is the detection and response function, which is based on collecting information from various information security equipment Analyze massive security incidents to determine the security status and security trends of the information system under its management, and respond to serious security incidents in a timely manner. [0003] Information security events: log information and alarm information generated by various information security equipment. [0004] With the advancement of my country's informatization construction and the increasing importance of information security from all wal...

AI Technical Summary

Problems solved by technology

[0016] The technical problem solved by the present invention is to propose a collaborative analysis method for the information security management center, which can fully mobilize the various SOC For the suspected or undiscovered threats discovered by each SOC, t

Images