Collaborative defense method for network protection and system

Abstract

The invention discloses a collaborative defense method for network protection and system. The system comprises a decision-making and deployment layer and a collaboration and monitoring layer, whereinthe decision-making and deployment layer uses an acquired network security early warning event, a defense intension is formulated according to the defense purpose of the network security and the current situation of the network security, a network defense strategy is later generated by a decision-making engine, and a defense task is deployed according to the defense strategy; the collaboration andmonitoring layer comprises a control center and network security devices, thereby realizing collaborative task deployment between network security devices and real-time monitoring on the network defense condition; the control center is in communication connection with the decision-making and deployment layer and the network security devices for data flow control and logical control; and the control center comprises a collaborative defense strategy analysis module, a collaborative defense strategy subscription module and a collaborative defense strategy distribution module. A collaborative defense solution with security perception, collaborative protection and centralized management as the core can be given, and an active, integrated and comprehensive dynamic security protection system isrealized.

Description

technical field [0001] The invention relates to network security protection technology, in particular to a collaborative defense method and system for network protection. Background technique [0002] With the rapid development of network services in recent years, the network security situation presents the following characteristics. The main manifestations are as follows: 1. The number of security vulnerabilities continues to grow rapidly. Due to the high complexity of network protocols, operating systems, and application software, as well as the uneven technical level of users, various security vulnerabilities inevitably exist in the network and host systems. The existence of loopholes is the main source of various security threats. The most fundamental reason why the current system security problems are intensifying is that the existence of loopholes cannot be completely avoided, and the loopholes are becoming more and more serious. the trend of. 2. The attack rhythm i...

AI Technical Summary

Problems solved by technology

2. Accelerate the attack rhythm and increase the degree of harm

3. Frequent occurrence of network security incidents

Enterprises invest a lot in equipment upgrades, but lack of attention to information interoperability, resulting in long-term problems in information systems that cannot be interoperable and interconnected. For example, their security defense equipment continuously generates a large number of security logs and events during operation. Providing data support for security operation and maintenance is not helpful for network security decision-making, asset management and real-time monitoring of equipment, forming a "so-called information island" effect

[0006] 2. Passive defense-based security status quo

[0007] 3. The security devices of the internal network of the enterprise lack coordination, and it is impossible to track and comprehensively analyze security events, and effectively utilize the protection capabilities of each security device. Since a large number of network security protection devices are deployed in the internal network of the enterprise, the network security strategy Deployment must optimize the overall configuration of security devices to ensu

Images