A security management center system

Abstract

An embodiment of the present invention provides a security management center system, which includes: an event collection module, a unified interface, a management service module, a data module and an alarm service module; the event collection module receives security event data and audit event data sent by the Internet application platform and the visual network application platform, and sends them to the data module; the data module stores the security event data and the audit event data. The unified interface receives a login request carrying target user information sent by the Internet application platform and the visual network application platform, and sends the login request to the management service module. The management service module authenticates the target user information. The management service module also performs a security audit on the audit event data. The security management center system provided by the embodiment of the present invention can not only uniformly authenticate each visual network application platform and the Internet application platform; it can also perform a security audit.

Description

Technical Field

[0001] The present invention relates to the field of network security management, and in particular to a security management center system. Background Art

[0002] Security Operation Center (SOC) is a term used to describe a management platform that can collect, analyze and respond to a variety of information security incidents. SOC analyzes the massive security incidents collected from various information security devices, determines the security status and security trends of the information systems it manages, and responds promptly to serious security incidents.

[0003] Currently, the security management centers on the market are more inclined to manage security events, such as monitoring the processes of various application platforms and analyzing security logs, etc. This makes them lacking in auditing functions and unable to provide better security auditing functions. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a security management center system that overcomes the above problems or at least partially solves the above problems.

[0005] The embodiment of the present invention discloses a security management center system, which includes: an event collection module, a unified interface, a management service module, a data module and an alarm service module;

[0006] The event collection module is connected to the Internet application platform and the visual network application platform respectively, and is used to receive the security event data and audit event data sent by the Internet application platform and the visual network application platform, and send the security event data and audit event data to the data module;

[0007] The data module is connected to the event collection module, and the data module is used to receive and store the security event data and the audit event data; the data module pre-stores the user information of the Internet application platform and the visual network application platform; the unified interface is used to receive the login request carrying the target user information sent by the Internet application platform and the visual network application platform, and send the login request to the management service module;

[0008] The management service module is connected to the unified interface and the data module respectively; the management service module authenticates the target user information; the management service module is also used to perform security audit on the audit event data in the data module;

[0009] The alarm service module is connected to the data module; the alarm service module is used to perform security analysis based on the security event data in the data module, and issue a security alarm when the security event data meets preset conditions.

[0010] Optionally, the system further includes: a business module, wherein the business module is respectively connected to a plurality of visual network business platforms;

[0011] The business module is used to receive business data sent by the visual network business platform and perform business management on the business data.

[0012] Optionally, the business module includes: at least one of a network management unit, a conference management unit, and a monitoring management unit;

[0013] Wherein, the network management unit is used to manage the terminals connected to the visual network service platform;

[0014] The conference management unit is used to access the video conference service data of the visual network service platform and manage the video conference service data;

[0015] The monitoring management unit is used to access the monitoring business data of the visual network business platform and manage the monitoring business data.

[0016] Optionally, the security event data includes: abnormal alarm information generated when the Internet application platform and the visual network application platform operate abnormally;

[0017] The audit event data includes: log files and operation records generated by the operation of the Internet application platform and the visual network application platform.

[0018] Optionally, the event collection module includes: a security event collection unit and an audit event collection unit;

[0019] The audit event collection unit is used to receive the audit event data forwarded by the probe management from the visual network application platform; wherein the visual network application platform transmits the audit event data to the probe management via the visual network protocol; the probe management transmits the audit event data to the audit event collection unit via the visual network protocol;

[0020] The security event collection unit is used to receive security event data forwarded by probe management from the visual networking application platform; wherein, the visual networking application platform transmits the security event data to the probe management via the visual networking protocol; and the probe management transmits the security event data to the security event collection unit via the visual networking protocol.

[0021] Optionally, the management service module includes: an audit management unit and a user management unit;

[0022] The user management unit is used to query whether the data module stores user information consistent with the target user information according to the target user information, and return the query result to the Internet application platform and the visual network application platform through the unified interface;

[0023] The audit management unit is used to perform audit analysis on the audit event data in the data module according to a pre-stored audit policy.

[0024] Optionally, the management service module also includes: a resource management unit; the resource management unit is used to predict resource usage risks based on the security event data and audit data in the data module, and determine the usage of hardware resources on the Internet application platform and the visual network application platform within a future preset time period.

[0025] Optionally, the management service module further includes: a security management unit; the security management unit is used to add a unique security identifier to the security object in the data module; wherein the security object at least includes: the entity device, platform process and user appearing in the security event data and the audit event data;

[0026] And / or, the security management unit is further used to configure a security policy for each security object and set a usage scope of each security object.

[0027] Optionally, when storing the security event data and the audit event data, the data module adds a time stamp field to each event data in the security event data and the audit event data; wherein the time stamp field includes the time when the event data is stored in the data module;

[0028] The data module is also used to perform verification according to the content in the time stamp field of the event data and the current time after storing each piece of the event data.

[0029] Optionally, the unified interface includes: at least one of a database operation interface, an audit data interface, and a platform push interface, and a login interface;

[0030] Wherein, the login interface is used to receive a login request carrying target user information sent by a target application platform, and send the login request to the management service module; the target application platform is one of the Internet application platform and the visual network application platform;

[0031] The database operation interface is used to query or configure the data module when called by a third-party platform;

[0032] The audit data interface is used to control the management service module to perform audit analysis on the audit event data in the data module when called by the third-party platform, and send the results of the audit analysis to the third-party platform;

[0033] The platform push interface is used to push messages to the third-party platform when called by the third-party platform.

[0034] The security management center system provided by the embodiment of the present invention includes: an event collection module, a unified interface, a management service module, a data module and an alarm service module; wherein the event collection module is connected to the Internet application platform and the visual network application platform respectively, and the event collection module is used to receive the security event data and audit event data sent by the Internet application platform and the visual network application platform, and send the security event data and audit event data to the data module. The event collection module can be connected to multiple application platforms, and can be connected to the visual network application platform and the Internet application platform at the same time, and can collect data on the visual network application platform and the Internet application platform. The data module is connected to the event collection module, and the data module is used to receive and store security event data and audit event data; the data module pre-stores user information of the Internet application platform and the visual network application platform; the unified interface is used to receive the login request carrying the target user information sent by the Internet application platform and the visual network application platform, and send the login request to the management service module; the management service module is connected to the unified interface and the data module respectively; the management service module authenticates the target user information. Through the unified interface, unified authentication of multiple application platforms can be achieved. The management service module is also used to perform security audits on the audit event data in the data module; the alarm service module is connected to the data module; the alarm service module is used to perform security analysis based on the security event data in the data module, and issue security alarms when the security event data meets the preset conditions. The embodiments of the present invention can not only collect data on the Internet application platform, but also collect data on the visual network application platform. And it can realize security audits on the collected audit event data. At the same time, it can also perform unified authentication on different application platforms, thereby enhancing and expanding the functions of the security management center system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a schematic diagram of a security management center system provided by an embodiment of the present invention;

[0036] Figure 2 This is one of the functional module diagrams of the security management center system provided by an embodiment of the present invention;

[0037] Figure 3 This is the second functional module diagram of the security management center system provided by the embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0039] Figure 1 The security management center system provided by an embodiment of the present invention is shown, and the security management center system includes: an event collection module 11, a unified interface 12, a management service module 13, a data module 14 and an alarm service module 15;

[0040] The event collection module 11 is connected to the Internet application platform and the visual network application platform respectively, and is used to receive the security event data and audit event data sent by the Internet application platform and the visual network application platform, and send the security event data and audit event data to the data module 14;

[0041] The data module 14 is connected to the event collection module 11, and is used to receive and store security event data and audit event data; the data module 14 pre-stores user information of the Internet application platform and the visual network application platform; the unified interface 12 is used to receive login requests carrying target user information sent by the Internet application platform and the visual network application platform, and send the login requests to the management service module 13;

[0042] The management service module 13 is connected to the unified interface 12 and the data module 14 respectively; the management service module 13 authenticates the target user information; the management service module 13 is also used to perform security audit on the audit event data in the data module 14;

[0043] The alarm service module 15 is connected to the data module 14; the alarm service module 15 is used to perform security analysis based on the security event data in the data module 14, and to issue a security alarm when the security event data meets the preset conditions.

[0044] It should be noted that the security management center system is deployed on the management server. The event collection module 11 includes: a security event collection unit and an audit event collection unit; wherein the audit event collection unit is used to receive the audit event data forwarded by the probe management from the visual network application platform; wherein the visual network application platform transmits the audit event data to the probe management through the visual network protocol; the probe management transmits the audit event data to the audit event collection unit through the visual network protocol. The audit event collection unit is also used to receive the audit event data sent by the Internet application platform through the Internet protocol. The audit event collection unit supports both the visual network protocol and the Internet protocol, so it can collect data from the visual network and the Internet.

[0045] The security event collection unit is used to receive security event data forwarded by the probe management from the visual network application platform; wherein the visual network application platform transmits the security event data to the probe management via the visual network protocol; the probe management transmits the security event data to the security event collection unit via the visual network protocol. The security event collection unit is also used to receive security event data sent by the Internet application platform via the Internet protocol. The security event collection unit supports both the visual network protocol and the Internet protocol, so it can collect data from the visual network and the Internet. Multiple network cards can be set up, such as a visual network network card for collecting data sent by the visual network protocol; and an Internet network card for collecting data sent by the Internet protocol.

[0046] Preferably, a security event is an abnormal alarm reported when a business platform or social security runs abnormally or is threatened with security. Therefore, security event data includes: abnormal alarm information generated when the Internet application platform and the visual network application platform run abnormally. For example, business abnormality alarm information reported by the application platform, hardware over-limit threshold alarm reported by the monitoring probe, server offline alarm, process offline alarm, abnormal port alarm, abnormal process alarm, etc. In addition, the monitoring probe can also call the external interface opened by the firewall and antivirus software to obtain security intrusion and protection alarms.

[0047] Audit events are the original data or records of business platforms and devices in the visual network or Internet. Therefore, audit event data includes: log files and operation records generated by the operation of Internet application platforms and visual network application platforms. For example, the operation records of application platforms reported by each application platform, the equipment hardware occupancy information reported by monitoring probes, operating system log files, platform log files, database log files, etc.

[0048] The data module 14 has the characteristics of data confidentiality, backup and recovery, data integrity and residual information protection. That is, before storing the data, the data module 14 can encrypt the stored data and then store the encrypted data. While the encrypted data is stored locally in the data module 14, it also needs to be backed up to the remote server. After the data in the data module 14 is deleted, the cached data in the memory and on the disk are cleared together. When encrypting the data, the security event data and the audit event data can be encrypted by calling the existing third-party platform for providing encryption services.

[0049] The alarm service module 15 can also implement security incident response, event correlation analysis, and alarm statistical analysis reports.

[0050] Of course, the security management center system may also include a display module for displaying the data in the data module 14, other collected data, and data processing results, so as to facilitate viewing of the data.

[0051] In the embodiment of the present invention, the security management center system includes: an event collection module 11, a unified interface 12, a management service module 13, a data module 14 and an alarm service module 15; wherein the event collection module 11 is connected to the Internet application platform and the visual network application platform respectively, and the event collection module 11 is used to receive the security event data and audit event data sent by the Internet application platform and the visual network application platform, and send the security event data and audit event data to the data module 14. The event collection module 11 can be connected to multiple application platforms, and can be connected to the visual network application platform and the Internet application platform at the same time, and can collect data on both the visual network application platform and the Internet application platform. The data module 14 is connected to the event collection module 11, and the data module 14 is used to receive and store security event data and audit event data; the data module 14 pre-stores user information of the Internet application platform and the visual network application platform; the unified interface 12 is used to receive the login request carrying the target user information sent by the Internet application platform and the visual network application platform, and send the login request to the management service module 13; the management service module 13 is connected to the unified interface 12 and the data module 14 respectively; the management service module 13 authenticates the target user information. Through the unified interface 12, unified authentication of multiple application platforms can be achieved. The management service module 13 is also used to perform security audits on the audit event data in the data module 14; the alarm service module 15 is connected to the data module 14; the alarm service module 15 is used to perform security analysis based on the security event data in the data module 14, and issue a security alarm when the security event data meets the preset conditions. The embodiment of the present invention can not only collect data on the Internet application platform, but also collect data on the visual network application platform. And it can realize security audits on the collected audit event data. At the same time, unified authentication can be performed on different application platforms, thereby enhancing and expanding the functions of the security management center system.

[0052] In order to increase the business functions of the security management center system, based on the above-mentioned embodiment of the invention, in the embodiment of the present invention, the system further includes: a business module, the business module is respectively connected to multiple visual network business platforms;

[0053] The business module is used to receive business data sent by the visual network business platform and perform business management on the business data.

[0054] It should be noted that the business module includes: at least one of a network management unit, a conference management unit, and a monitoring management unit; wherein the network management unit is used to manage the terminals connected to the visual network service platform. For example, the gateway unit can manage the physical terminals and virtual terminals in the visual network, manage the visual network numbers, open and close the terminals, upgrade the terminal version, limit the terminal bandwidth usage, etc. It can also manage the visual network core switching server and upgrade the server version.

[0055] The conference management unit is used to access the video conference service data of the visual network service platform and manage the video conference service data. For example, the conference management unit can manage the reservation of the video conference service of each service platform in the visual network. It can be responsible for the data display of the video conference service, the opening of the video conference service, and the scheduling of the terminals in the meeting.

[0056] The monitoring management unit is used to access the monitoring business data of the visual network business platform and manage the monitoring business data. For example, the monitoring management is responsible for the monitoring access, monitoring scheduling, monitoring control and other business management of multiple business platforms in the visual network. The display module is also used to display the data of each business, or to display the business status of each business, or to display the statistical data of each business, or to display the specific business information that is running. Preferably, the display module is also used to display the bandwidth occupancy of the specific business of each server that currently occupies the network bandwidth of the visual network, as well as the bandwidth statistics of the visual network control instructions.

[0057] Continue to see Figure 1 , based on the above-mentioned embodiments of the invention, in the embodiment of the present invention, the management service module 13 includes: an audit management unit and a user management unit;

[0058] The user management unit is used to query the data module 14 according to the target user information whether there is user information consistent with the target user information stored, and return the query result to the Internet application platform and the visual network application platform through the unified interface 12;

[0059] The audit management unit is used to perform audit analysis on the audit event data in the data module 14 according to the pre-stored audit policy.

[0060] It should be noted that the management service module 13 also includes: a resource management unit; the resource management unit is used to predict resource usage risks based on the security event data and audit data in the data module 14, and determine the usage of hardware resources on the Internet application platform and the visual network application platform in the future preset time period. The security management center system can connect multiple visual network application platforms and multiple Internet application platforms, so as to manage all software and hardware information in the entire Internet system and the visual network system, such as relevant information of each process and service, relevant information of each business, etc. The resource management unit performs risk prediction in different directions based on this information. For example, the operating status of each business in a certain time period in the future; CPU disk and memory usage, visual network bandwidth usage risk, etc.

[0061] The management service module 13 also includes: a security management unit; the security management unit is used to add a unique security identifier to the security object in the data module 14; wherein the security object at least includes: the physical device, platform process and user appearing in the security event data and the audit event data;

[0062] And / or, the security management unit is also used to configure security policies for each security object and set the scope of use of each security object. A security object can be a physical device or software, and is an object that needs to be managed. Each security object is allowed to be used only within its scope of use. For example, a user is set to be able to log in on device A and device B. When the user logs in to device C, the login is not allowed and the user cannot log in successfully. The security management module can also query the configured security policies.

[0063] In order to ensure the data integrity of security event data and audit event data when they are stored in the data module, based on the above-mentioned embodiments of the invention, in the embodiment of the present invention, when the data module stores the security event data and the audit event data, a time stamp field is added to each event data in the security event data and the audit event data; wherein the time stamp field includes the time when the event data is stored in the data module;

[0064] The data module is also used to verify each event data after storing it according to the content in the time stamp field of the event data and the current time.

[0065] It should be noted that the process of verifying a certain target event data can be to obtain the moment in the timestamp field of the target event data and the current moment; compare whether the two moments are consistent, if the duration between the two moments is within a preset range, the two moments are considered to be consistent and the verification is successful; otherwise, the verification fails. Preferably, when storing security event data and audit event data, a status field is added for each event data in the security event data and the audit event data, and the status field contains an identification of whether it has been deleted. After the target event data is stored in the data module, the content in the status field is set to not deleted; if the target event data is deleted, that is, the data module performs a deletion operation on the target event data; the content in the status field of the target event data is set to deleted.

[0066] Continue to see Figure 1 , based on the above-mentioned embodiments of the invention, in the embodiment of the present invention, the unified interface 12 includes: at least one of a database operation interface, an audit data interface, and a platform push interface, and a login interface;

[0067] The login interface is used to receive a login request carrying target user information sent by a target application platform, and send the login request to the management service module 13; the target application platform is one of the Internet application platform and the visual network application platform;

[0068] The database operation interface is used to query or configure the data module 14 when called by a third-party platform;

[0069] The audit data interface is used to control the management service module 13 to perform audit analysis on the audit event data in the data module 14 when called by the third-party platform, and send the audit analysis results to the third-party platform;

[0070] The platform push interface is used to push messages to third-party platforms when called by the third-party platform.

[0071] It should be noted that the third-party platform calls the database operation interface to query the data stored in the data module 14, configure the data module 14, and other operations. Since the database operation interface is a unified interface 12 for querying or configuring the data module 14 in the security management center system, multiple third-party platforms can call the database operation interface to operate the data module 14.

[0072] The audit event data in the data module 14 can be directly sent to the third-party platform through the audit data interface. Since the audit data interface is a unified interface 12 related to the audit data in the security management center system and provided to the outside, multiple third-party platforms can call the audit data interface.

[0073] Push messages can be alarms, work orders, etc. pushed outward. The platform push interface is a unified interface 12 in the security management center system that is related to push messages and provided to the outside world, so multiple third-party platforms can call the platform push interface. Preferably, the interfaces involved in the embodiments of the present invention require security control, and all interfaces must be encrypted and ensure the integrity of the transmission process and the integrity of the data. For example, the interface is called and a request is received, which is an encrypted request. The interface needs to decrypt the request and return an encrypted request response message when responding to the request. The integrity of the transmission process includes confirmation of receipt of the response message after sending the packet.

[0074] like Figure 2 The figure shows one of the functional module diagrams of the security management center system provided by the present invention; it includes: a display module, a management service module, a data center, an alarm service center, a unified interface and a collection service.

[0075] Among them, the display modules include: perception center, alarm center, display center, business control and traffic audit.

[0076] Among them, the perception center is used to display the real-time business status of each application platform server based on the data support of the security management center system.

[0077] The alarm center is used to display the alarm information generated by the security management center system.

[0078] The display center is used to display the statistical data of each application platform business based on the data support of the security management center system.

[0079] Business control is based on the data support of the security management center system, and displays the specific business information in operation, such as video business, conference business, monitoring business, etc.

[0080] Traffic audit: Based on the traffic data collected by the traffic probes deployed on each server and key network nodes, it displays the bandwidth usage of the specific services currently occupying the network bandwidth of the visual network on each server, as well as the bandwidth statistics of the visual network control instructions.

[0081] The unified interface includes: login interface, audit data interface, platform push interface, and data collection interface;

[0082] Among them, the login interface is used for each application platform to call this interface to upload user data and provide a unified login interface for each platform.

[0083] The audit data interface, platform push interface, and database operation interface are used for calls by third-party platforms.

[0084] Specific:

[0085] The audit data interface is used by third-party platforms to implement statistical analysis of some security data in the data center. The analysis method is implemented by the audit analysis function of audit management. All collected data such as logs and operation records of each application platform can be audited and analyzed.

[0086] Platform push interface: used to push messages to the outside, such as alarms, work orders, etc.

[0087] Database operation interface: The data center can be understood as a database. When this interface is called, operations such as data query and database configuration are implemented. Preferably, each interface needs to be subject to interface security control. Specifically, all interfaces must be encrypted and the integrity of the transmission process and data integrity must be guaranteed. For example, when an interface is called and a request is received, the request is encrypted. The interface needs to decrypt the request and return an encrypted request response message when responding to the request. The integrity of the transmission process includes confirmation of receipt of the response message after sending the packet.

[0088] The collection service includes security event collection and audit data collection, which is used to collect data information from multiple networked application platforms and multiple visual network application platforms, and then store it in the data center.

[0089] Data centers must perform data protection, including: data confidentiality, backup and recovery, data integrity, and residual information protection;

[0090] Among them, backup and recovery: the data center needs to perform regular preservation and backup, and regularly back up the original data files to the remote server through the backup service. Residual information protection mainly includes clearing the cached data in the memory and on the disk after the data is deleted. Data integrity: After the data is stored in the database, the database will respond to the storage operation, but in order to ensure the data storage process and ensure whether the data is completely stored in the database, the present invention needs to perform a secondary verification. The verification method is: after the data is stored, a data query operation is automatically initiated, and the time stamp field of the key business data is queried to determine whether the data has been written normally.

[0091] The alarm service center is mainly used to manage security incidents, including security incident alarms, security incident responses, event correlation analysis, and alarm statistical analysis reports.

[0092] The management service module includes user management, resource management, audit management, and security management.

[0093] User management: Each application platform performs login verification through the unified login interface of the security management center, and users can be managed in the security management center.

[0094] Resource management: The security management center can manage the software and hardware resource information used in the entire Internet system and the visual network system. Resource management includes: risk management, which refers to risk prediction based on resource usage, as well as collected log data, operation records and other information, such as high CPU usage, disk, memory, etc., visual network bandwidth usage risk, etc.

[0095] Audit management: The security management center can maintain and manage audit strategies and analyze and audit various types of collected data in the visual network system. Audit strategies mainly refer to some formulated audit rules.

[0096] Security management: The security management center can conduct security audits and management on the software and hardware resources, networks, and security devices in the visual networking system. Security management mainly refines the permissions of each security object, including:

[0097] Security tag: All security objects (devices, platforms, platform processes, users) have a security tag (a unique ID).

[0098] Authorization management: who uses the security object and in what scope;

[0099] Policy management: configure and query security policies of security objects.

[0100] like Figure 3 FIG. 2 is a schematic diagram of the function modules of the security management center system provided by the present invention, see Figure 2 , Figure 3 is Figure 2 The security management center system is further refined on this basis, and the same parts will not be repeated here. Among them, the functions implemented by the data center can be implemented by a third-party platform (key management center). User management includes: unified login, identity management and access control. Resource management includes: risk management, resource monitoring. Audit management includes audit strategy, audit analysis, log audit and data audit. The security management center system analyzes the original data of the application platform, operating system, database, and network equipment in the platform, and determines whether the original data exceeds the warning value through the threshold. If it exceeds the warning value, an alarm is reported in the alarm center. Some business modules can also be deployed in the security management center system, such as conference management systems, monitoring management systems, network management systems, etc. about the visual network, which can be achieved through function migration.

[0101] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0102] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

Claims

1. A security management center system, characterized in that: The system includes: an event collection module, a unified interface, a management service module, a data module and an alarm service module; The event collection module is connected to the Internet application platform and the visual network application platform respectively, and is used to receive the security event data and audit event data sent by the Internet application platform and the visual network application platform, and send the security event data and audit event data to the data module; The data module is connected to the event collection module, and the data module is used to receive and store the security event data and the audit event data; the data module pre-stores the user information of the Internet application platform and the visual network application platform; the unified interface is used to receive the login request carrying the target user information sent by the Internet application platform and the visual network application platform, and send the login request to the management service module; The management service module is connected to the unified interface and the data module respectively; the management service module authenticates the target user information; the management service module is also used to perform security audit on the audit event data in the data module; The alarm service module is connected to the data module; the alarm service module is used to perform security analysis based on the security event data in the data module, and issue a security alarm when the security event data meets the preset conditions; When storing the security event data and the audit event data, the data module adds a time stamp field to each event data in the security event data and the audit event data; wherein the time stamp field includes the time when the event data is stored in the data module; The data module is also used to perform verification according to the content in the time stamp field of the event data and the current time after storing each piece of the event data.

2. The system according to claim 1, characterized in that The system further comprises: a business module, wherein the business module is respectively connected to a plurality of visual network business platforms; The business module is used to receive business data sent by the visual network business platform and perform business management on the business data.

3. The system according to claim 2, characterized in that The service module includes: at least one of a network management unit, a conference management unit and a monitoring management unit; Wherein, the network management unit is used to manage the terminals connected to the visual network service platform; The conference management unit is used to access the video conference service data of the visual network service platform and manage the video conference service data; The monitoring management unit is used to access the monitoring business data of the visual network business platform and manage the monitoring business data.

4. The system according to claim 1, characterized in that The security event data includes: abnormal alarm information generated when the Internet application platform and the visual network application platform operate abnormally; The audit event data includes: log files and operation records generated by the operation of the Internet application platform and the visual network application platform.

5. The system according to claim 1, characterized in that The event collection module includes: a security event collection unit and an audit event collection unit; The audit event collection unit is used to receive the audit event data forwarded by the probe management from the visual network application platform; wherein the visual network application platform transmits the audit event data to the probe management via the visual network protocol; the probe management transmits the audit event data to the audit event collection unit via the visual network protocol; The security event collection unit is used to receive security event data forwarded by probe management from the visual networking application platform; wherein, the visual networking application platform transmits the security event data to the probe management via the visual networking protocol; and the probe management transmits the security event data to the security event collection unit via the visual networking protocol.

6. The system according to claim 1, characterized in that The management service module includes: an audit management unit and a user management unit; The user management unit is used to query whether the data module stores user information consistent with the target user information according to the target user information, and return the query result to the Internet application platform and the visual network application platform through the unified interface; The audit management unit is used to perform audit analysis on the audit event data in the data module according to a pre-stored audit strategy.

7. The system according to claim 6, characterized in that The management service module also includes: a resource management unit; the resource management unit is used to predict resource usage risks based on the security event data and audit data in the data module, and determine the usage of hardware resources on the Internet application platform and the visual network application platform within a preset time period in the future.

8. The system according to claim 6, characterized in that The management service module also includes: a security management unit; the security management unit is used to add a unique security identifier to the security object in the data module; wherein the security object at least includes: the entity device, platform process and user appearing in the security event data and the audit event data; And / or, the security management unit is further used to configure a security policy for each security object and set a usage scope of each security object.

9. The system according to claim 1, characterized in that The unified interface includes: at least one of a database operation interface, an audit data interface, and a platform push interface, and a login interface; Wherein, the login interface is used to receive a login request carrying target user information sent by a target application platform, and send the login request to the management service module; the target application platform is one of the Internet application platform and the visual network application platform; The database operation interface is used to query or configure the data module when called by a third-party platform; The audit data interface is used to control the management service module to perform audit analysis on the audit event data in the data module when called by the third-party platform, and send the results of the audit analysis to the third-party platform; The platform push interface is used to push messages to the third-party platform when called by the third-party platform.

Images