An intelligent network security function management method and system based on a container

Abstract

The invention discloses an intelligent network security function management method and system based on a container, and the method comprises the steps: the cold start of the intelligent network security function management is completed through an initial configuration process; When a potential safety risk is confronted, collaborative protection is carried out through safety level improvement; Andwhen the potential safety risk is not found for a long time, the safety level is relieved. The invention supports a design mode and an implementation system for dynamically updating, rapidly deploying, globally cooperating, and controlling the security of the security capability.. the flow and the configuration of the security resources in the global system can be realized; Therefore, dynamic definition and reconstruction of the safety function are achieved, effective cooperation and connection of links of safety risk and safety perception, safety perception and safety decision, safety decision, safety response and the like are achieved, jump of the capacity of safety software and hardware equipment from single point defense, local defense to overall defense is achieved, and the effect ofsafety resource maximization is achieved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a container-based intelligent network security function management method and system. Background technique [0002] Cyberspace has infiltrated into the political, economic and cultural fields of the country in all aspects, as well as the operation and life of society and the public. Since cyberspace contains huge energy and benefits, it has also become a key target of attackers in the new era. Attackers' malicious means are varied, updated rapidly, and destructive, posing a great threat to networks, computers, and information systems. Traditional security mechanisms such as firewalls, intrusion detection, and security audits have been difficult to guarantee the security of cyberspace. the reason is: [0003] One is the static solidification of network security defense capabilities. The security protection capabilities of information systems come from the security soft...

AI Technical Summary

Problems solved by technology

Usually, due to network isolation, complex configuration, policy conflicts, self-protection and other reasons, the deployed security software and hardware cannot be continuously upgraded and maintained with security policies. Therefore, the functions remain as they were at the time of initial deployment, and it is difficult to resist the increasingly abundant technical means. cyber attack

[0004] Second, local security functions are disconnected from overall security capabilities

A single security device usually has a single function and can only achieve single-point protection in the network. Different software and hardware methods are responsible for threat detection, traffic filtering, policy judgment, behavior management, data encryption and other functions. They lack connection and coordination with each other, making it difficult to To realize a complete protection process from discovery, identification, decision-making to disposal, there is a big disconnect between local security functions and overall security capabilities, and even a "1+1<2" protection capability conflict phenomenon

[0005] Third, the speed of detection and response cannot meet the requirements for safe disposal

In the current "edge-center" security architecture, the security software and hardware devices deployed in the user network are weak in data association analysis and attack depth mining capabilities, so security events are usually reported to the cloud for analysis and then received by the cloud. The judgment and control of the security policy complete the response to the issued security policy, but due to a certain delay in communication and processing, it is difficult to meet the response speed requirements under the conditions of high throughput and real-time processing requirements

Images