An emergency response system and emergency response method for network security incidents

Abstract

The invention relates to an emergency response system and emergency response method for network security events. The system includes a data collection module, an event management module, an event processing module, an auxiliary tool module, and an expert knowledge base module; The auxiliary tool module conducts security detection, the data acquisition module collects information, uses the auxiliary tool module to search for implanted files and enters them into the system, and the event handling module analyzes the clue tree and attacker information, and confirms the analysis results based on the information of the expert knowledge base module , Qualify the incident, come up with suggestions for rectification and issue an incident disposal report, and rectify. The present invention establishes a standard network security event emergency disposal process, standardizes event disposal means and methods, improves disposal efficiency, avoids damage expansion, reduces economic losses, integrates information collection, analysis, and rectification, and automatically analyzes and generates rectification suggestions , Generate reports, and save the disposal results for easy reference.

Description

technical field [0001] The invention relates to the technical field of data exchange networks, in particular to an emergency response system and emergency response method for network security incidents, which streamline and systematize the emergency treatment of network security incidents. Background technique [0002] In today's society, the Internet has formed a scale, which is changing people's study, work and lifestyle more and more profoundly, and even affects the entire social process. The application of the Internet is becoming diversified, and the scale of Internet users continues to show a trend of sustained and rapid development. [0003] At this stage, my country's network security situation is becoming increasingly severe and complex, network security incidents are also more complex, and attack methods are more diverse. Faced with this situation, various enterprises or organizations are often helpless. They can only passively add some firewalls and anti-virus Tro...

AI Technical Summary

Problems solved by technology

[0010] The technical problem solved by the present invention is that in the prior art, the emergency response process of network security incidents has not been standardized and unified, resulting in unstable emergency response efficiency of network security incidents, inconsistent processing procedures, and inaccurate processing results , for this reason, the present invention provides an optimized emergency response system and emergency response method for network security incidents