Network safety situation awareness early-warning method and system based big data

Abstract

The invention discloses a network safety situation awareness early-warning method and system based big data, and the method comprises the steps: collecting intelligence information from the Internet, non-governmental organizations, governmental agencies and interiors of companies; obtaining log and network flow generated by safety equipment, network equipment, a host and other safety protection systems, carrying out the real-time preprocessing of the collected original data, carrying out the standardization of the data after preprocessing, and converting the data into safety data with the unified standard; carrying out scene modeling according to different attack behaviors, carrying out correlation analysis through combining with the intelligence information and the safety data, and generating early-warning information; carrying out the check processing of the early-warning information, and carrying out the visualized display of the early-warning information after check. The method can achieve the complete sensing of a safety situation, the early warning of safety threats and the capability of timely handling and responding of a safety event, and improves the overall safety protection capability of a power system.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a big data-based network security situational awareness early warning method and system. Background technique [0002] With the continuous deepening of the application of emerging Internet technologies such as big data, cloud computing, Internet of Things, and industrial Internet, the degree of informatization of enterprises is becoming higher and higher, and the degree of dependence on information systems has reached an unprecedented height. At the same time, it has also led to Malicious information security incidents such as various new types of network attacks and sensitive information leakage occur frequently. According to the survey by the National Internet Emergency Response Center, in 2015, the number of high-risk vulnerability incidents involving important industries and government departments increased, the risk of basic application or general software vulnerabi...

AI Technical Summary

Problems solved by technology

[0003] These traditional security products can only defend against security threats from certain aspects, forming "islands of security defense" one by one, lacking effective integration and correlation analysis of massive multi-dimensional information security data, unable to produce synergistic effects, and unable to Make these security monitoring data an effective resource for upper-level security decision-making

[0004] Most of these traditional security defense facilities analyze and monitor the attacks that have occurred by analyzing the logs of certain security devices. They basically adopt the idea of ​​passive defense and lack the ability of network security situation awareness and linkage early warning. It is often too late to take corresponding emergency measures after a cyber attack, because the cyber attack has already happened and caused irreparable losses

[0005] These complex IT resources and their security defense facilities continuously generate a large number of security logs and events during the operation process, forming a large number of "information islands". Facing these huge and fragmented security big data, limited security managers, Operating the console interface and alarm window of various products is helpless, the work efficiency is extremely low, and it is difficult to find real hidden dangers

Images