Intranet security expert analysis method and system

Abstract

The invention relates to an intranet security expert analysis method and system. The intranet security expert analysis method comprises the steps of: data acquisition: collecting data transmitted on atarget network segment; data detection: carrying out real-time tracking detection on behaviors from the intranet and the internet, wherein the detected data is divided into normal data and abnormal data and the abnormal data is data related to an intrusion behavior; and data analysis and calculation: carrying out analysis on the abnormal data to establish a plurality of analysis items related tothe intrusion behavior, carrying out layer grading on the analysis items, setting an occupied security weight value Ai of each analysis item, carrying out analysis on each analysis item, setting a security level value Bi of each analysis item, calculating a total security level value Ci of each analysis item and calculating a total analysis value C, wherein Ci=Ai*Bi, and C=C1+C2+...+Ci. The intrusion behavior of the intranet can be analyzed, a related model is established, grading is carried out and security levels are set, so that the intranet security expert analysis method and system are convenient to carry out analysis on the intrusion behavior of the intranet and determine a protection direction, thereby carrying out purposive defense on the intrusion behavior of the intranet.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an analysis method and system for intranet security experts. Background technique [0002] With the rapid development of network technology, we pay more and more attention to network security. However, computer and network attacks are increasing in sophistication, making them increasingly difficult to detect and block using traditional firewalls and intrusion detection systems. With the proliferation of viruses, worms, Trojan horses, backdoors, and blended threats, security threats at the content and network layers are becoming commonplace. Sophisticated worms and e-mail viruses such as Slammer, Blaster, Sasser, Sober, MyDoom, etc. will spread quickly, usually sweeping the world within a few hours. In order to combat security threats, security technologies are also constantly evolving, including new technologies such as deep packet inspection firewall, appl...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide an intranet security expert analysis method and system to solve the existing technical problem of unclear division of intranet security levels