Method and system for decomposing threat dispose strategy in network

Abstract

Embodiments of the invention provide a method and a system for decomposing a threat dispose strategy in a network. The method comprises the steps of: determining a threat dispose area according to a threat dispose strategy, a network topological structure, a threat feature and an asset feature; determining a candidate dispose object of the threat dispose area and a second linkage relationship setthereof according to the threat feature, a dispose object capability and a first linkage relationship set; decomposing a security guarantee target according to a security guarantee target decomposition mapping relationship, a target priority, a target achievement degree, a target achievement cost and available resources, so as to obtain a security guarantee sub-target of the threat dispose area; and decomposing a dispose command in the threat dispose strategy and / or determining a dispose object according to the candidate dispose object and the second linkage relationship set thereof, the security guarantee sub-target, the dispose object capability, the threat feature, a dispose cost and a dispose effect. Through adoption of the method of the invention, unified management and control for equipment of the whole network, threat differentiated linkage dispose and collaborative response are achieved, and a network management and control capability is improved.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of network security, and in particular, to a method and system for decomposing threat handling strategies in a network. Background technique [0002] The dynamic interconnection of large-scale and complex heterogeneous networks requires hierarchical management of network security and hierarchical deployment of heterogeneous network command in the process of threat handling. Different networks have different technical systems, different security protection capabilities between networks, and management rights belong to different departments. There are many types of security equipment in each network, and there are many manufacturers of similar security equipment. The functions and command methods of different security equipment are different. Different security equipment Disposal instructions are different and have to be generated separately. It is necessary to automatically decompose the...

AI Technical Summary

Problems solved by technology

[0004] Embodiments of the present invention provide a method and system for decomposing threat handling strategies in a network, which are used to solve the defects in the prior art that the threat handling methods have poor handling effects, low handling efficiency, and inability to support differentiated linkage handling of threats, and improve handling Efficiency can also minimize the extent to which the network is affected by threats, thereby ensuring network security

Images