Service safety analysis method and system thereof

Abstract

The invention discloses a service safety analysis method and a system thereof. The method comprises the following steps of receiving Netflow data sent by network equipment and simultaneously actively collecting all network flow data; analyzing the collected flow data and generating the Netflow data; carrying out flow filtering, flow polymerization and characteristic extraction on the acquired Netflow data, using a threat detection technology to carry out threat detection on the Netflow data after the flow filtering, the flow polymerization and the characteristic extraction, storing a detection result in black, white and grey lists and using a service view form to display the detection result of the Netflow data; and combining the service data to carry out association analysis on the detection result and acquiring a safety state of a service system in real time. In the scheme of the invention, in a complex network environment, an abnormal flow can be accurately analyzed.

Description

technical field [0001] The invention relates to computer system integration and application technology, in particular to a method and system for business security analysis. Background technique [0002] The rapid development of computer networks and mobile Internet applications has brought great convenience to social work and life. Correspondingly, enterprise networks are becoming more and more responsible, and the threats and losses caused by various network security issues are also increasing. With the continuous expansion of network scale, attack methods are becoming more and more diverse. Especially in recent years, advanced persistent threat (APT) attacks have become more and more common. Enterprise networks are facing more and more internal and external threats. Traditional security detection equipment such as firewalls, intrusion Detection systems such as IDS have shown many deficiencies in threat detection: [0003] 1. Firewalls, IDS and other security devices cann...

AI Technical Summary

Problems solved by technology

[0003] 1. Firewalls, IDS and other security devices cannot effectively detect internal network security threats. If you want to detect internal threats, you need to deploy nodes in different network areas, and the cost is high

[0004] 2. Rule-based detection methods such as IDS cannot detect 0day attacks in time

[0005] 3. IDS is based on deep packet inspection technology, which cannot cope with the data traffic of large-scale networks

Images