Intranet network security monitoring method and system and related components

Abstract

The invention discloses an intranet network security monitoring method and system and related components. The method comprises the following steps: acquiring virus alarm information on a target host; performing automatic alarm analysis on the target host according to all the virus alarm information to obtain an alarm reference score; when the alarm reference score exceeds a first threshold value, executing a semi-blocking access isolation action to block a communication behavior within a first traffic range of the target host; and if the alarm reference score exceeds a second threshold value, executing a full-blocking access isolation action to block a communication behavior in a second traffic range of the target host, and triggering searching and killing software to perform safe searching and killing. The automatic alarm analysis result is comprehensive, reliable, efficient and accurate, a corresponding isolation action is adopted by using the alarm reference score, related communication behaviors of the target host are quickly blocked, the possibility of transverse diffusion of viruses through an intranet is eliminated, normal operation of other communication is ensured, the blocking action is effective and accurate in range, and the communication efficiency is improved. And the method has extremely high application value.

Description

technical field [0001] The invention relates to the field of network security, in particular to an intranet network security monitoring method, system and related components. Background technique [0002] At present, the internal network environment of an enterprise is usually relatively complex and involves a large number of people. At the same time, the host computer has a weak awareness of prevention, which makes the host computer very susceptible to viruses that are highly contagious and difficult to cure, such as ransomware and mining Trojans. Such viruses are extremely difficult to completely clean up. [0003] The traditional cleaning method is mainly manual, which requires manual inspection of all hosts one by one and installation of anti-virus software. The execution efficiency and risk isolation effect are poor, and it is difficult to block the spread of infected hosts through the intranet, and it is very easy to kill Unclear boundaries lead to repeated infections...

Images