Confidential active type strategy linkage method

Abstract

The invention relates to a credible active linked tactic method, which belongs to the information security field. It carries on the tactic rule distribution according to the distribution flow through the tactic managing device, the event adapter is used to detect the security event warning information, carries on the credible analysis flow of the warning information to acquire the credence parameter, sends information notice to the static engine, at the same time, waits for the response of the tactic engine, the event adapter transmits the warning event to the tactic rule localizer, the tactic rule localizer searches the event index table, the rule localizer finds out and activates the distributed tactic rules, the tactic engine calls the tactic rule executer to execute the tactic condition matching and tactic response according to the tactic condition, , realizes the link of tactic rules.

Description

technical field [0001] The invention relates to a strategy-based linkage method, in particular to a trusted active linkage strategy method. It belongs to the field of information security. Background technique [0002] At present, most large-scale networks are equipped with various security devices such as firewalls, intrusion detection, virus protection, etc. The development of these security products is developed in the process of people's gradual understanding of network security. Meet the needs of network security at that time. Moreover, when considering security at the beginning, it is generally from a single perspective, such as developing anti-virus products to deal with viruses, rather than considering the entire network system and network security risks, so it is one-sided. According to the "Barrel Theory", this simple heap and linear combination of network security products developed from a single perspective in different periods has some security loopholes in se...

AI Technical Summary

Problems solved by technology

However, the false alarm rate and false alarm rate of the current intrusion monitoring system are relatively high, and the alarm information of security events is unreliable, so the implementation of policy rules has certain risks.

Images