Civil aviation air traffic control network security detection early warning platform

Abstract

The invention discloses a civil aviation air traffic control network security detection early warning platform. The platform comprises a security information collector, a website and application monitoring unit, a situation analysis center and a distributed computing storage node; the security information collector comprises an asset collector, a log collector, a full-flow collection system, a vulnerability collector and a security configuration collector; the website and application monitoring unit provides real-time safety monitoring; the situation analysis center adopts multiple intelligent analysis methods to analyze situation elements, perceives various network security situations and carries out security monitoring, and provides a security situation visual display and application interaction interface; and the distributed computing storage node realizes distributed storage, full-text indexing and analysis of security events. By adopting the civil aviation air traffic control network security detection early warning platform of the technical schemes provided by the invention, a long-acting monitoring mechanism and unified website monitoring and early warning can be established, so that centralized management, batch processing and automatic safety monitoring of the safety of each website are realized, and the safety risks of important websites and information systems are comprehensively summarized.

Description

technical field [0001] This application relates to the technical field of network security, in particular to a platform for detection and early warning of network security of civil aviation control. Background technique [0002] Next-generation threats typically use multiple means and go through multiple stages as they penetrate a network to steal information. Attackers use a combination of web, email, and file-based attacks. Current firewalls, IPS, antivirus, and web security gateways have little ability to stop attackers using advanced zero-day exploits, one-off malware, and APTs. [0003] These hybrid, multi-stage attacks are successful because traditional security techniques rely on static signature-based or list-based pattern matching techniques. Many zero-day and targeted threats infiltrate systems by hiding new types of implanted malware on innocent web pages or in downloadable files such as JPEG images and PDF documents. Or they use personalized phishing emails se...

AI Technical Summary

Problems solved by technology

[0014] (1) The protection of traditional security equipment is insufficient: users deploy about dozens of different types of security equipment from different manufacturers, and there are a large number of alarms. The real threat is submerged in the massive alarm and log information and is difficult to find

[0015] (2) Abnormal files and new types of threats are difficult to find: file and email filtering and file dynamic detection capabilities are insufficient, and hidden malicious codes and behaviors cannot be found

[0016] (3) Threat intelligence capabilities are weak: data outreach malicious URLs or IPs, APT high-persistent attacks, low-frequency account brute force cracking and other new threats are not discovered in time

[0017] (4) Difficult to protect against insider threats: insider forwarding and springboard attacks cannot be effectively detected and found

[0018] (5) Lack of fast means to trace the source: the analysis efficiency of massive logs is low, the visualization ability is poor, and the difficulty and cycle of event source tracing will increase

Images