Cloud and local combined data processing method and device

Abstract

The embodiment of the invention discloses a cloud and local combined data processing method and device. The method comprises the steps of: performing data acquisition of local internet export flow data, cloud intelligence data, third-party data and grade protection management data, so that cloud and local combined data is obtained; analyzing the cloud and local combined data to obtain an abnormalthreat behaviour; and, performing security service closed-loop warning threat disposal of the abnormal threat behaviour. The device is used for executing the method. In the embodiment of the invention, the local data, the cloud data, the third-party data and the grade protection management data are acquired; therefore, the data acquisition is relatively comprehensive; the coverage rate is relatively high; discovery, detection and security analysis on an important event can be ensured; simultaneously, the security service closed-loop warning threat disposal is carried out for the abnormal threat behaviour; a whole set of staged flexible scheme, which is continuously expanded, is provided; and the management and maintenance cost of a system is reduced.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of data security, and in particular to a data processing method and device combining cloud and locale. Background technique [0002] For a long time, network and information security systems have followed three important guiding models (PDR, P2DR, and IATF) in the design and construction process, all of which emphasize the importance of detection and defense in security systems without exception. For example, defense based on signatures and rules, use MD5 codes to judge the characteristics of viruses and malicious files, rely on rules to do simple blocking, and highly rely on network border devices to protect key information infrastructure. Critical information infrastructure refers to the information infrastructure that may seriously endanger national security, national economy and people's livelihood, and public interests once it is damaged, loses its function, or leaks data. [...

AI Technical Summary

Problems solved by technology

Not only that, the analysis, traceability, and line extension in business work still rely on locally collected data, most of which are concentrated in traffic data, etc., and the threat parties basically survive in the Internet world, causing business work to be passive

[0009] In the process of realizing the embodiment of the present invention, the inventor found that the existing methods lack technical means for guaranteeing major events and technical means for security analysis, and the means of detection and discovery are still single, and at the same time, there is a lack of mass data and big data analysis technology support

Images