A distributed information security operation and maintenance management platform system based on big data

Abstract

The invention discloses a distributed information security operation and maintenance management platform based on massive data. The distributed information security operation and maintenance management platform supports a single-user mode and a multi-user mode and comprises a customer service module, a security operation and maintenance management module, an acquisition terminal module, a distributed storage module and a security operation and maintenance APP store module. In the multi-user mode, the security operation and maintenance management module of each enterprise is autonomous; and one customer service module can simultaneously provide security operation and maintenance management services for a plurality of enterprises. APPs provided by the security operation and maintenance APP store on the platform include those cooperating with various information security operation and maintenance service providers together; and the distributed information security operation and maintenance management platform is convenient for users to use and can help the enterprises to rapidly position and solve problems.

Description

technical field [0001] The invention relates to the fields of information security, network management, business management, data exchange platform and big data technology, and in particular to a system of distributed information security operation and maintenance management platform architecture. Background technique [0002] The English abbreviation included in the present invention is as follows: [0003] SOC: Security Operation Center Security Management Center [0004] IDS: Intrusion Detection Systems intrusion detection system [0005] MIS: Management Information System Management Information System [0006] DMZ: demilitarized zone isolation area, or demilitarized area [0007] APP: Application application [0008] SNMP: Simple Network Management Protocol Simple Network Management Protocol [0009] HDFS: Hadoop Distribute File System Hadoop Distributed File System [0010] ODBC: Open Database Connectivity open database interconnection [0011] WMI: Windows Manag...

AI Technical Summary

Problems solved by technology

[0022] 1. There are many types of information security products and network equipment, widely distributed, and lack of unified data analysis and management;

[0023] 2. The knowledge base of information security products and network equipment is not unified, and there is a lack of unified solutions;

[0024] 3. Safety responsibilities are unclear, and specific responsibilities have not been implemented;

[0025] 4. Information security operation and maintenance management assessment is not detailed, lacking some necessary and key indicators;

[0026] 5. There is a lack of more advanced intelligent analysis and aggregation correlation between events of different security devices or even events of the same security device, resulting in a huge amount of data, making it difficult to analyze and discover potential safety hazards, so as to prevent problems before they happen;

[0027] 6. Information security incidents are not reported in time, fault diagnosis is not timely, processing efficiency is low, and the effect is poor;

[0028] 7. Information security incidents and asset vulnerabilities have not been correlatively analyzed, resulting in no further analysis and processing of many incidents;

[0033] The above-mentioned problems exist to varying degrees in the business and network that the enterprise has built, which will become an obstacle to the stable improvement of the enterprise's business security operation and maintenance management in the future

Images