Security event response method and device

Abstract

The embodiment of the invention provides a safety event response method and device. The security event response method comprises the following steps of: when network equipment detects that a securityevent occurs, obtaining an event identifier of the security event and a current moment when the security event occurs, and according to the event identifier, searching a plurality of strategy identifiers corresponding to the event identifier and effective time periods respectively corresponding to the strategy identifiers from a configured security event response strategy list, determining a firststrategy identifier corresponding to the effective time period matched with the current moment, and executing a first response strategy with the strategy identifier being the first strategy identifier. A plurality of response strategies are configured for the same safety event, the effective time periods of the response strategies of the safety event do not coincide, different response strategiescan be executed for one safety event in different time periods, complex safety events are effectively coped with, and the response flexibility of the safety event is enhanced.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a security event response method and device. Background technique [0002] With the rapid development of Internet technology, the information carried by the network has become increasingly rich, and the Internet has become an important infrastructure for people's lives, bringing great convenience to people's lives. At the same time, network security issues are becoming more and more serious. Network viruses, worms, Trojan horses, and malicious software emerge in an endless stream, endangering the information security of network users. [0003] Security event analysis is an important means of network security technology. Common security events include remote Trojan horses, malicious program attacks, malformed message attacks, distributed services, brute force cracking, and lateral penetration. In the traditional security event analysis method, corresponding response stra...

AI Technical Summary

Problems solved by technology

[0004] However, security incidents are often very complex, relying only on a single response strategy is usually unable to deal with complex security incidents, resulting in poor flexibility in security incident response

Images