Defense method, device and system based on existing threats in target node

Abstract

The invention provides a defense method, device and system based on an existing threat in a target node, and relates to the technical field of network security. The processing method comprises the following steps: acquiring log information and threat intelligence information of network nodes in a network environment; the network nodes comprise a to-be-defended target node and an associated network node; selecting any to-be-defended target node, determining a threat item of the target node based on the threat intelligence information of the target node, and calling a defense scheme for defense; obtaining access information of interaction between the target node and the associated network node from the log information of the network node; and in combination with the access information and the threat intelligence information of the target node, obtaining a threat item corresponding to the associated network node, and calling a defense scheme for defense. According to the method, the target node and the associated network node thereof are effectively defended by acquiring the log information and the threat intelligence information of the network node, so that resources consumed during network security defense are reduced.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a defense method based on existing threats in target nodes. Background technique [0002] In the existing technology, the situational awareness system integrates multiple data information systems such as anti-virus software, firewall, network management system, intrusion monitoring system, and security audit system to complete the assessment of the current network environment, and the future changes of the aforementioned network environment trend forecasting. [0003] In order to realize the precise defense emphasized by network security, it is necessary to ensure network security’s ability to perceive network threats. After obtaining network threats through the situational awareness system, find out the threat items from a large number of network nodes, and call the corresponding defense plan for defense , In order to achieve the desired defensive effect, it will undou...

AI Technical Summary

Problems solved by technology

[0004] In actual operation, when defending against network nodes with threat items, it is often ignored that the associated network nodes are affected by the aforementioned network nodes

When it is detected that the aforementioned associated network node also has the same threat item, it is also necessary to invoke the defense plan against the aforementioned threat item for defense, which causes the system to repeatedly defend against the same threat in order to completely eliminate the impact of the threat item on the network in the network environment. Nodes and associated network nodes, which undoubtedly cause a waste of network resources and an increase in defense costs

Images