Alarm linkage method, device and system, computer equipment and storage medium

Abstract

The invention relates to the technical field of communication, in particular to an alarm linkage method, device and system, computer equipment and a storage medium. The method comprises the followingsteps: receiving alarm information sent by an alarm source, and identifying a network attack type; Obtaining a candidate linkage strategy set according to the network attack type; Calculating a network risk value for executing each linkage strategy in the candidate linkage strategy set, and taking the corresponding linkage strategy as a target linkage strategy when the network risk value is minimum; And executing a corresponding alarm linkage action according to the target linkage strategy. According to the alarm linkage method provided by the embodiment of the invention, when the alarm is received, all matched strategies are inquired, and then the optimal strategy is selected through the evaluation and selection steps, so that the global optimal effect can be achieved, and a better attackresponse result can be obtained in a relatively short time.

Description

technical field [0001] The present invention relates to the field of communication technology, in particular to an alarm linkage method, device, system, computer equipment and storage medium. Background technique [0002] As network attack methods become more and more complex, especially advanced persistent threat attacks become more and more normalized, enterprises need effective monitoring methods to discover abnormal behaviors in the network and quickly and accurately detect and monitor large-scale network management problems. Take emergency measures to avoid further economic losses and block network attacks as soon as possible. [0003] At present, many enterprises have deployed network security management systems and even situational awareness systems to monitor the security status of network assets, but they are often helpless in the face of tens of thousands of security alarms, and lack effective means of emergency response. For the processing of such alarms in the p...

AI Technical Summary

Problems solved by technology

[0003] At present, many enterprises have deployed network security management systems, and even situational awareness systems to monitor the security status of network assets, but they are often helpless in the face of tens of thousands of security alarms, and lack effective means of emergency response.

For the processing of such alarms in the prior art, on the one hand, the expert manual emergency response method is generally adopted, which mainly relies on expert experience; on the other hand, through the security protection equipment deployed in the network, such as firewall, intrusion detection and

Images