Security visible and situational awareness platform system

Abstract

The invention relates to a security visible and situational awareness platform system. The system comprises a data layer, an analysis layer, and an application and presentation layer, wherein the datalayer collects, processes, gathers, stores and searches various data related to threat sensing analysis, and provides an external data subscription interface; the analysis layer associates data sources and analyzes set under the support of big data analysis, machine learning and UEBA technology so as to discover and sense known and unknown security risks and threats of the whole network; and theapplication and presentation layer shows an analysis result of the analysis layer by monitoring a screen, a Web gate and a third-party interface. The platform can mine and analyze events based on massive data, and further provides necessary functions like network monitor, equipment management and operation and maintenance process management.

Description

technical field [0001] The invention relates to the field of information security, in particular to a security visualization and situation awareness platform system. Background technique [0002] With the advent of the Internet age, my country's network security issues have become increasingly prominent. The network security situation assessment technology can dynamically reflect the network security situation as a whole, predict and warn the development trend of the security situation, and provide a reliable reference basis for enhancing network security. [0003] At present, many scientific research institutions are conducting research and development of network situational awareness tools, and have made some progress. Wang Huiqiang from Harbin Engineering University combined various theories with situational awareness and proposed a variety of situational awareness models. Based on the network situational awareness model of simple weighting method and gray theory, the s...

AI Technical Summary

Problems solved by technology

[0005] The existing network security situational awareness system has the following deficiencies: 1) lack of data association, the existing network security situational awareness system tends to obtain multi-source data information, but lacks the analysis of the correlation between data information

2) The display form is single. At present, network security assessment generally uses qualitative or hierarchical methods to describe the security status of the network, lacking a more intuitive display form

Images