A network event monitoring and analysis method and system, and an information data processing terminal

Abstract

The invention belongs to the technical field of network security, and discloses a network event monitoring and analysis method and system, an information data processing terminal, a data collection layer for realizing the collection of mirrored data traffic and deep packet detection; a data sharing layer for data processing The mirrored data flow processed by the acquisition layer is analyzed in multiple dimensions, and the external output interface is provided with data sources; the business display layer is used to realize the security event view, network view, terminal view, early warning view, disposal event view, and work order view. The invention can effectively discover illegal assets, behaviors, strategies and threats inside the network, and timely warn of attacks and threats outside the network; provide multiple response methods to help enterprises discover security threats and risks in advance, and timely notify enterprise managers or The security equipment completes the blocking of threats and the spread of risks, ensures the security of assets and information, and controls security incidents to a minimum.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network event monitoring and analysis method and system, and an information data processing terminal. Background technique [0002] At present, the closest existing technology: With the deepening of informatization construction and the emergence and development of information technology such as big data, Internet of Things, cloud computing and mobile Internet, my country's government and enterprise customers are facing more severe problems in the field of IT network security than ever before. For the complex situation, new information security issues continue to surface. There are not only endless intrusions and attacks from outside enterprises and organizations, but also violations and information leakage from within enterprises and organizations. Although many government and enterprise customers have established a complete network isolation and protection...

AI Technical Summary

Problems solved by technology

[0005] (1) The existing network isolation and protection system is difficult to detect and prevent illegal operations and information leakage from within the organization

[0006] (2) In the existing security event processing methods, events cannot be responded to in a timely manner, cannot be processed in the first time, and it is difficult to effectively process massive logs

Images