Security risk detection processing system and method thereof

Abstract

The invention relates to a security risk detection processing system and a method thereof. The system comprises an overall analysis module, an Flink streaming processing module and a linkage processing module which are connected in sequence. The overall analysis module is connected with a plurality of security devices and used for receiving log information sent by the security devices in real time, the received log information is processed, the processed log information is published to a kafka message queue for other information consumers to consume, and data analysis is carried out in an Flink streaming processing module; the Flink streaming processing module is used for analyzing and judging whether the data is a network threat and sending the data judged to be the network threat to the linkage processing module for processing; and the linkage processing module carries out forbidding processing on the data which is judged to be the network threat in combination with preset white list data. Compared with the prior art, the security attack is detected based on the directed graph, the risk can be timely and accurately detected, and the risk can be automatically handled so as to realize automatic defense.

Description

technical field [0001] The invention relates to the technical field of network security risk detection and security protection, in particular to a security risk detection and disposal system and method thereof. Background technique [0002] With the establishment of the current security situational awareness platform, security alarm logs are sent to the situational awareness platform for centralized analysis and disposal. Usually, most situational awareness platforms use correlation analysis methods to analyze security alarms. This method relies heavily on the accuracy of various security alarm data and log specifications, and it is difficult to guarantee the accuracy of risk detection. [0003] In addition, the traditional method of dealing with information security risks is realized through IPS (Intrusion Prevention System) equipment. The traditional method is the fourth layer (network layer) active protection means. This method has the problems of being unable to unders...

AI Technical Summary

Problems solved by technology

This method has the problems of being unable to understand the upper layer protocols of the network, and the matching of network threat features is not accurate. The main reason for the above problems is that the intrusion prevention system works at the network layer, so it has no awareness of the protocols above the network layer; secondly , IPS mainly uses regular methods to match network attack payloads, which is prone to false positives or missed negatives

Images