Network attack monitoring method based on multi-source information analysis

Abstract

The invention belongs to the technical field of computers, and particularly relates to a network attack monitoring method based on multi-source information analysis. The method is implemented based ona network attack monitoring system. The network attack monitoring system comprises a rule making module, a flow acquisition module, a flow processing module, a malicious code sample acquisition module, a flow scanning and analysis module and a threat evaluation and early warning release module. The method has the technical effects that the network threats are comprehensively perceived, specifically, based on flow analysis, network potential safety hazards are accurately recognized, sensitive network threat perception capacity is constructed, and the comprehensive network security situation isdisplayed. Timely loss stopping and quick response: providing a network security threat assessment report through network attack security analysis, assisting network security management personnel totake corresponding treatment measures in time, and preventing the situation from continuing to develop.

Description

technical field [0001] The invention belongs to the technical field of computers, and in particular relates to a network attack monitoring method based on multi-source information analysis. Background technique [0002] With the continuous development of computer technology, network security issues have become more and more concerned, and information networks and security systems have gradually become the basis and guarantee for the healthy development of informatization. As far as the current situation is concerned, there are generally unknown vulnerabilities in operating systems, application software, network equipment, and business systems. This makes network security face more severe challenges in the context of civilian use of network arms and organized network attacks. Higher requirements are put forward for network security monitoring. [0003] At present, traditional network security monitoring methods are mostly based on known rule bases, which can detect known sec...

AI Technical Summary

Problems solved by technology

[0003] At present, traditional network security monitoring methods are mostly based on known rule bases, which can detect known security threats, but are powerless to unknown threats, and cannot completely trace the source of intrusions that are occurring or have caused losses Forensics and Damage Assessment

Images