Security situation awareness response method and device based on multi-iteration verification

Abstract

The invention discloses a security situation awareness response method and device based on multiple iteration verification. The method comprises the steps of obtaining related data of a network outlet and an internal boundary, obtaining related network session metadata and a network sampling packet, obtaining related information such as a process, a port change, a file change and a registry change of host operation, obtaining related configuration information of a host, and collecting related content for a special application; performing feature analysis on the security problem according to the collected related information; clustering analysis is carried out according to safety problems found in the environment and static, semi-static and dynamic data, and hosts with similar characteristics are screened out for clustering evaluation; and analyzing the influence degree according to the hosts similar to the problem hosts obtained by clustering evaluation, and generating a disposal request. According to the method and the device, the technical problem that the disposal effect cannot be evaluated basically due to low automation capability, difficulty in tracing and difficulty in repeated verification is solved.

Description

technical field [0001] The present application relates to the field of network security, in particular, to a security situation awareness response method and device based on multiple iterative verification. Background technique [0002] Network security situational awareness is to acquire, understand, and display security elements that can cause changes in the network situation in a large-scale network environment, and to predict future network security development trends accordingly. [0003] As mentioned above, the main content of network security situational awareness includes the acquisition of security situation, the understanding of security situation and the prediction of security situation; in addition, based on the above three main contents, network security situational awareness should also include processing, and related responses to network security situations, so as to realize the so-called PPDR model (ie Policy, Prevention, Detection as well as Response ),...

AI Technical Summary

Problems solved by technology

[0005] 1. An automated response and disposal plan is proposed, but in fact the automated disposal capability is relatively low, and semi-automatic or manual disposal still dominates;

[0006] 2. It is impossible or very difficult to find similar problems that may exist in similar devices or applications, making it difficult to trace the source, and it is difficult to obtain a complete attack chain or the root cause of the problem;

[0007] 3. When a safety problem occurs, it is difficult to repeatedly verify and compare if the problem occurs after a certain treatment, so it is basically impossible to evaluate the treatment effect

[0008] Aiming at the relatively low automatic processing capability in related technologies, the difficulty in tracing the source of safety problems, and the basic inability to evaluate the solution effect, no effective solutions have been proposed so far.

Images