Enterprise network safety event management system and method thereof

Abstract

The invention relates to the network safety, and provides an enterprise network safety event management system comprising safety devices, a safety event data acquisition module, a safety event data standardization module, a safety event situation assessment and prediction module, a safety device management linkage defense strategy generation module, a state protection module and a system management module. The method comprises the following steps: the system automatically collects safety event information generated by the safety devices in the enterprise network; the system carries out standardization format transition for the collected safety event information; the system analyzes the safety event information after standardization format transition so as to obtain network information safety situation, and predicts network safety trends; the system carries out association analysis for safety devices disposition safety application strategy according to the network information safety situation and the predicted network safety trends, thus generating the linkage defense strategy and sending the strategy to the safety devices. The enterprise network safety event management system and method are suitable for enterprise network safety event management.

Description

technical field [0001] The invention relates to network security, in particular to the management and prediction of enterprise network security events. Background technique [0002] With the deepening of enterprise informatization, computer network plays an increasingly important role in the enterprise. However, due to the characteristics of interconnection and openness, computer networks are extremely easy to become the target and carrier of malicious attacks. Enterprise network security is also getting more and more attention. For this reason, many enterprises choose various security equipment from different manufacturers according to the actual situation, and build a security system that suits their own characteristics. In actual use, various security devices deployed in the network will generate a large number of security events and log records. However, since various security products are often provided by different manufacturers, and the data formats of various device...

AI Technical Summary

Problems solved by technology

In actual use, various security devices deployed in the network will generate a large number of security events and log records. However, since various security products are often provided by different manufacturers, and the data formats of various devices are different, resulting in various The lack of correlation between security event information and security log information of security devices makes it impossible for network managers to discover real security threats from these siled data

Images