Information security event automatic association and rapid response method and system based on big data analysis

Abstract

The invention discloses an information security event automatic association and rapid response method and system based on big data analysis. The method and the system comprise an offline association module, an online association module, an element alarm comparison module, an element alarm priority module, an element alarm clustering module, an attack mode discovering module and an alarm response system / work order module. Through adoption of the method and the system, alarms reported by a security device are aggregated into element alarms for correlation analysis by using a big data technique, thus generating multiple element alarms. Element alarm priority analysis is carried out after alarm correlation analysis is carried out; alarm priorities corresponding to element alarms are distributed; an alarm response system informs related personnel and the delegates related personnel to check and repair faults according to the alarm level priorities; the alarm response time is remarkably shortened; and misinformation generated by information security devices such as IDS (Intrusion Detection Systems) is eliminated.

Description

technical field [0001] The invention relates to the fields of information security technology and big data technology, in particular to a method and system for event correlation and rapid response of an information system. . Background technique [0002] The English abbreviation included in the present invention is as follows: [0003] IDS: Intrusion Detection Systems intrusion detection system. [0004] LOF: Local Outlier Factor local abnormal factor [0005] TTL: Time to Live This field refers to the maximum number of network segments allowed to pass before the IP packet is discarded by the router [0006] TOS: Type of Service business type [0007] ACG: Alert Correlation Graph [0008] GED: Graph Edit Distance graph edit distance [0009] DMZ: demilitarized zone isolation area, or demilitarized area [0010] App: Application application [0011] Recent research results show that almost all information security devices use log files as evidence of being attacked (V...

AI Technical Summary

Problems solved by technology

In a complex network environment, due to the influence of network transmission delay and front-end processing delay, the timing of security events entering the engine may be reversed, resulting in the failure of the "state machine" to be triggered, and false positives or false negatives in the correlation analysis engine

Therefore, the accuracy of the existing rule-based correlation analysis technology is flawed, and it is difficult to meet the large data volume correlation analysis requirements such as information security operation and maintenance management cloud platform environment.

Images