Distributed network situation awareness method and system, server and node equipment

Abstract

The invention belongs to the technical field of network security, and particularly relates to a distributed network situation awareness method and system, a server and node equipment, and the method comprises the steps: carrying out the data fusion for a network node security data source through calling an HADOOP interface and employing a MapReduce model, and obtaining a security event in a current time period; performing network security situation assessment by quantizing security event threat risks; and predicting the security situation according to the attack stage identified in the quantization process in combination with the network attack graph to obtain an attack intention. .Calculation and storage needing huge computing power in the system are expanded to each node in the HADOOP cluster, operation and processing are performed by utilizing the parallel computing and storage capacity of the cluster, parallel computing is realized by utilizing MapReduce, distributed network security situation awareness oriented to large-scale data can be realized The network security situation awareness storage scale and timeliness are optimized, and the awareness protection capability for hidden, cooperative, large-scale and multi-stage attacks such as APT attacks is improved.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a distributed network situation awareness method, system, server and node equipment. Background technique [0002] With the rapid development of information technology, cyberspace security is facing more and more attacks and threats, while traditional security products are increasingly unable to meet the protection needs. As a new means of protection, network security situational awareness technology is to recognize, understand and predict the security status and development trend of the network in a complex and changeable network environment, which helps managers to grasp the network security situation in a timely manner, and Protect against possible threats in the future. In order to realize the perception of network security situation in a comprehensive, accurate and real-time manner. Tim Bass of the U.S. Air Force Communications and Information Center f...

AI Technical Summary

Problems solved by technology

The characteristics of APT attacks, the existing large-scale data network and the integration of network multi-node devices require complex data calculation and processing, all of which have brought many challenging issues to network security situation awareness and protection.

Images