Cross-domain data exchange supervision system and method

Abstract

The invention discloses a cross-domain data exchange supervision system and method, and belongs to the technical field of data exchange. The supervision system comprises a data acquisition module, a data preprocessing module, a data storage and retrieval module, a big data calculation module, a historical data calculation module and a data mining module. The supervision method comprises the following steps: S1, acquiring information of network equipment, security equipment, an information system and various network attack knowledge systems; S2, completing distinguishing, extracting and cleaning operations of the data acquired by the data acquisition module; S3, performing data storage by adopting a heterogeneous non-relational database mode, and self-adapting to data sources of any format;adopting a real-time distributed search and analysis engine for retrieval; S4, calculating the correlation, the influence degree and the regularity among the security events in a relatively long timeperiod; and adopting a data analysis method to carry out automatic learning and model induction on data such as event logs and the like, and summarize and analyze the rule trend of occurrence and development of the network security events.

Description

technical field [0001] The invention relates to the technical field of data exchange, in particular to a monitoring system and method for cross-domain data exchange. Background technique [0002] Current network security protection covers not only basic firewalls, intrusion detection, and antivirus systems, but also online behavior auditing, bastion host systems, database design systems, web application firewalls, anti-denial of service systems, and advanced persistent threat defense systems. It can complete individual protection, and can only be remedied after a security incident occurs. This "remedial" lagging protection method results in more and more patches, larger and larger virus databases, heavier and heavier system burdens, and higher operating expenses. The more expensive it is, it not only affects the operating efficiency of the system, but also the normal system functions cannot be used due to measures such as closing the network port, which is unacceptable. Co...

AI Technical Summary

Problems solved by technology

[0002] Current network security protection covers not only basic firewalls, intrusion detection, and antivirus systems, but also online behavior auditing, bastion host systems, database design systems, web application firewalls, anti-denial of service systems, and advanced persistent threat defense systems. It can complete individual protection, and can only be remedied after a security incident occurs. This "remedial" lagging protection method results in more and more patches, larger and larger virus databases, heavier and heavier system burdens, and more and more operating expenses. The more expensive it is, it will not only affect the operating efficiency of the system, but also cause the normal system functions to be unusable due to measures such as closing the network port, which is unacceptable.

Images