Device and method for network security management based on alarm strategy

Abstract

The invention discloses a device and a method for network security management based on an alarm strategy. The device for network security management comprises a receiving unit, an alarm generation unit, a matching unit and an execution unit, wherein the receiving unit is used for receiving a security incident generated by the device for network security management; the alarm generation unit is used for generating an alarm based on the security incident with a greater risk value than a preset threshold; the matching unit is used for matching the alarm and an alarm strategy table to obtain an alarm strategy corresponding to the alarm; and the execution unit is used for executing the alarm according to the alarm strategy. According to the device and the method, the alarm information can be corrected and managed, controllability, real-time performance and flexibility of network security are improved, meanwhile, reliability for outputting the alarm information is guaranteed, and the security threat in the network is effectively blocked.

Description

technical field [0001] The invention relates to the technical field of network security management, in particular to a network security management device and method based on an alarm strategy. Background technique [0002] With the continuous development of the Internet age, network security has been paid more and more attention. Although network security products continue to mature, there are more and more security threats from the network. In order to give full play to the role of various security products and increase the network's ability to actively respond to security incidents, a network security management platform emerges as the times require. The security management platform integrates firewalls, anti-virus equipment, intrusion detection equipment, vulnerability scanning equipment, etc., correlates security events generated by various security products, uses correlation analysis algorithms and risk estimation methods to discover risks in the network, and generates ...

AI Technical Summary

Problems solved by technology

[0003] The existing security management platform integrates various security products and facilities, builds a huge database, and supports the correction of the priority level of security events, which provides a good data source for event correlation analysis and risk assessment, but lacks Correction and management of alarm information itself

The existing security management platform does not have the flexibility to change the system in real time, resulting in alarms that may be outdated and unimportant

Images