A method and an apparatus for deploying a network safety probe

Abstract

Embodiments of the invention disclose a method and an apparatus for deploying network safety probes. The method comprises: acquiring network nodes, where network safety devices have been deployed, in a network; executing respectively, for each of the network nodes where the network safety devices have been deployed, statistics on traffic information for both each of the network nodes and a father node and on the number of leaf nodes owned by each of the network nodes, to obtain a network topology characteristic and a traffic characteristic; obtaining an attribute value for each of the network nodes according to the network topology characteristic and the traffic characteristic; selecting critical nodes from the network nodes where the network safety devices have been deployed according to the size of the attribute value for each of the network nodes; and deploying the network safety probe respectively on the critical nodes. According to the embodiments of the method and the apparatus for deploying network safety probes, mass redundant alarm information of the network safety devices can be reduced greatly, processing efficiencies of subsequent network transmission and subsequent analysis and computation can be increased, and guarantee response speed of service safety can be improved.

Description

Technical field [0001] The invention relates to communication technology, in particular to a method and device for deploying network security probes. Background technique [0002] The rapid development of the Internet has profoundly changed the way people live and work, and the safe operation of the Internet has become an important condition for the daily operation of human society. [0003] Awareness of the security status of the entire network is a prerequisite for achieving network security operations, manageability and control. The real-time perception of the security status of the entire network depends on the reasonable deployment of network security probes. The existing common network security probe deployment method is to deploy the network security probe synchronously according to the deployment status of the network security equipment. [0004] In the process of implementing the present invention, the inventor found that the existing method of synchronous deployment of ne...

AI Technical Summary

Problems solved by technology

On the one hand, a large number of network security probes will generate a large amount of alarm information, which will bring massive real-time data processing problems, and bring unnegligible pressure on network transmission and subsequent analysis and calculation; on the other hand, once a network attack occurs, business If there is a fault, so many network security devices will send out alarm information one after another. There is correlation between these alarm information. The alarm information of many network security devices does not indicate that the fault is on it. The information helps to quickly troubleshoot faults. However, a large number of network security probes will bring a large amount of redundant alarm information. These redundant alarm information will easily lead to the flooding of key information. Security managers need to further analyze the alarm information of many network security devices. Only through analysis can an effective security strategy be formulated, which greatly delays the response speed of business security assurance

Images