Network security situation awareness early warning system and method based on big data

Abstract

The invention discloses a network security situation awareness early warning system and method based on big data. The system comprises a data collection unit used for collecting data information, an analyzing and processing unit used for processing the data information, a service function unit used for achieving various related functions and an interface display unit for displaying. By adoption of the network security situation awareness early warning system and method, all kinds of viruses, Trojan horses, unexpected attacks and malicious violations caused by network devices and terminal hosts and other abnormal behaviors are monitored so as to help users to find the intrusion behaviors and access anomalies in the intranet in time.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security situational awareness early warning system and method based on big data. Background technique [0002] With the continuous deepening of the application of emerging Internet technologies such as big data, cloud computing, Internet of Things, and industrial Internet, the degree of informatization of enterprises is becoming higher and higher, and the degree of dependence on information systems has reached an unprecedented height. At the same time, it has also led to Malicious information security incidents such as various new types of network attacks and sensitive information leakage occur frequently. According to the survey by the National Internet Emergency Response Center, in 2015, the number of high-risk vulnerability incidents involving important industries and government departments increased, the risk of basic application or general software vulner...

AI Technical Summary

Problems solved by technology

However, the situation is not optimistic, and the defense capabilities of the existing power system security defense facilities are still insufficient, mainly in the following three aspects: These traditional security products can only resist security threats from certain aspects, forming a "Security and defense islands" lack effective fusion and correlation analysis of massive multi-dimensional information security data, which cannot produce synergistic effects, and cannot make these security monitoring data an effective resource for upper-level security decision-making

[0003] Most of these traditional security defense facilities analyze and monitor the attacks that have occurred by analyzing the logs of certain security devices. They basically adopt the idea of ​​passive defense and lack the ability of network security situation awareness and linkage early warning. It is often too late to take corresponding emergency measures after a cyber attack, because the cyber attack has already happened and caused irreparable losses

[0004] To sum up, the security early warning method of intrusion detection technology can easily lead to missed and false alarms due to certain defects in the detection method. The accuracy of the early warning is not high, and it also has an impact on performance.

Images