Network event monitoring and analyzing method and system and information data processing terminal

Abstract

The invention belongs to the technical field of network security, and discloses a network event monitoring analysis method and system, an information data processing terminal. A data acquisition layeris used for realizing acquisition of mirror image data traffic and deep packet detection. A data sharing layer is used for carrying out multi-dimensional analysis on the mirror image data traffic processed by the data acquisition layer and providing a data source for an external output interface; and the business display layer is used for realizing a security event view, a network view, a terminal view, an early warning view, a disposal event view and a work order view. According to the invention, illegal assets, behaviors, policies and threats in the network and attacks and threats outside the network can be effectively discovered and early warned in time; various response modes are provided to help enterprises to discover security threats and risks in advance, timely inform enterprise managers or security equipment to complete blocking of the threats and spreading of the risks, ensure asset and information security and control security events within a minimum range.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network event monitoring and analysis method and system, and an information data processing terminal. Background technique [0002] At present, the closest existing technology: With the deepening of informatization construction and the emergence and development of information technology such as big data, Internet of Things, cloud computing and mobile Internet, my country's government and enterprise customers are facing more severe problems in the field of IT network security than ever before. For the complex situation, new information security issues continue to surface. There are not only endless intrusions and attacks from outside enterprises and organizations, but also violations and information leakage from within enterprises and organizations. Although many government and enterprise customers have established a complete network isolation and protection...

AI Technical Summary

Problems solved by technology

[0005] (1) The existing network isolation and protection system is difficult to detect and prevent illegal operations and information leakage from within the organization

[0006] (2) In the existing security event processing methods, events cannot be responded to in a timely manner, cannot be processed in the first time, and it is difficult to effectively process massive logs

Images