Intelligent safety event closed-loop disposal system and method thereof

Abstract

The invention relates to the field of information security, and discloses an intelligent security event closed-loop processing system and method. The intelligent safety event closed-loop disposal system comprises a safety protection and monitoring module, a safety monitoring center, an event analysis and response center, a user alarm and notification terminal and a human-computer interaction interface. Through a set of complete technical architecture, safety event generation, alarming, processing and recording, closing and summarizing are effectively combined to form a closed loop. A traditional loose security event disposal and management mode is unified and intelligentized, and event disposal and management are integrated into an enterprise overall security framework in a program architecture mode. Intelligent processing and full-process closed management and control of the security events are realized, the management cost of security personnel is reduced, the disposal efficiency andquality of the security events are improved, and a quantifiable evaluation index is provided for the value of information security work in an enterprise.

Description

technical field [0001] This application relates to the field of information security, in particular to an intelligent closed-loop processing technology for security incidents. Background technique [0002] In many enterprises or organizations, after receiving alarms from various security devices or monitoring centers, security personnel usually need to judge by their own experience or accept monitoring alarm content to manually analyze security events, and then contact them through internal communication tools or telephone. It is not only inefficient, but also difficult to guarantee the integrity of event information and the accuracy of communication records, and it is easy to There are situations such as chaotic incident handling procedures and unclosed loops or no one to follow up. [0003] For the above problems, there are mainly the following two solutions in the prior art: [0004] a. No intelligent solution, mainly through offline communication, referring to some bes...

AI Technical Summary

Problems solved by technology

[0005] b. There are some intelligent solutions, that is, the entire event analysis and response process, some of which are realized through automated programs, such as event recording, content display, etc., and the original alarm information found online is analyzed offline and then manually submitted online , only used as a content management platform, not tightly integrated into the overall security monitoring architecture of the enterprise, automatic correlation and transfer of events cannot be achieved, and there may be high learning and use costs for relevant personnel

[0006] From the above introduction, it can be seen that the existing technical solutions have different degrees of security incident handling and management flow defects, and it is impossible to use a complete set of technical architecture to control security incidents—alarm—handling and recording—closing— —Summaries are effectively combined to form a closed loop, making the formulated event handling plans superficial on paper, and cannot provide complete and effective security situation feedback for enterprises

[0007] Under the current trend of the Internet, Internet of Things, and industrial control networks becoming more and more developed, the traditional security incident handling methods based on online alarms, offline handling, and recording in the past are obviously unable to meet the needs of technological development.

Images