Network security integration and linkage platform

Abstract

The invention discloses a network security integration and linkage platform, which is characterized in that a sensor detects original events of each device or system and sends the original events to an event management module, and the event management module summarizes all the original events, extracts information of the original events and forms an event management list; the rule management module extracts information of original events through the event management list, performs logic association judgment according to a preset rule, associates the original events to form an associated event combination and outputs the associated event combination to form a platform event, and the decision management module extracts information of the platform event and outputs the information of the platform event. And establishing a mapping relationship between the platform event and the actuator to be acted according to a preset decision. The invention provides a network security integration and linkage platform, which not only can improve the overall security level of an enterprise, but also can promote the effective integration of security resources, reduce the operation cost and provide more stable and reliable security guarantee for the enterprise.

Description

Technical Field

[0001] The present invention relates to the technical field of complete enterprise network management, and more specifically, to a network security integration and linkage platform. Background Art

[0002] In recent years, ransomware attacks have occurred frequently, causing serious economic losses to enterprises and individuals. Although this type of attack is not a new phenomenon, the threat of ransomware is increasing due to the lack of effective defense measures, the expansion of the attack surface caused by the complexity of the supply chain, and the continuous evolution of attack technology. In order to effectively respond to this challenge, enterprises must fundamentally strengthen their security defense system, including establishing a multi-level security protection mechanism and improving internal security awareness, so as to better resist external threats.

[0003] With the rapid development of information technology, especially in the fields of mobile Internet, Internet of Things and artificial intelligence, data has become an indispensable resource in modern society. However, the rapid growth of data volume has also brought new challenges to network security. Traditional security technologies and methods are no longer able to cope with the current complex situation. In particular, with the development of artificial intelligence technology, network attacks are becoming more and more intelligent, which requires enterprises and organizations to adopt more advanced security strategies to protect themselves from harm.

[0004] In addition, as the government continues to increase its legal supervision of network security, data security and personal information protection, the risk of non-compliance faced by enterprises is also increasing, which has prompted enterprises to pay more attention to compliance with relevant laws and regulations and ensure data and information security while pursuing technological innovation and development. In the future, regulators may take more preventive measures to help enterprises establish a sound security management system to reduce the occurrence of security incidents.

[0005] Given that enterprises currently generally face problems such as decentralized security systems, high operation and maintenance costs, and poor interoperability between security products, it is particularly important to build a platform that can enable multiple security functions to work together. Summary of the invention

[0006] In order to solve the problem of decentralized security system management, the present invention provides a network security integration and linkage platform, which can not only improve the overall security level of the enterprise, but also promote the effective integration of security resources, reduce operating costs, and provide enterprises with more stable and reliable security protection.

[0007] The technical solution of the present invention is as follows:

[0008] A network security integration and linkage platform,

[0009] The sensor detects the raw events of each device or system and sends the raw events to the event management module.

[0010] The event management module aggregates all original events, extracts the information of original events and forms an event management list.

[0011] The rule management module extracts the information of the original event through the event management list, makes logical association judgments according to the preset rules, associates the original events to form a combination of associated events and outputs them to form platform events.

[0012] The decision management module extracts information about platform events and establishes a mapping relationship between platform events and actuators to be acted upon based on preset decisions.

[0013] The above-mentioned network security integration and linkage platform includes a sensor management module. Users can create, query, edit and delete each sensor through the sensor management module. The sensor is set at the end of the system, and all information entering or leaving the system is processed by the sensor.

[0014] In the above-mentioned network security integration and linkage platform, the event management module retrieves the content of the original event, analyzes, classifies, and organizes the original event, and establishes an event management list to display various information of the original event.

[0015] In the above-mentioned network security integration and linkage platform, the rule management module performs correlation matching on multiple different original events, redefines the original events by analyzing the characteristic attributes of each original event, and combines the associated original events into platform events in combination with its own set rules.

[0016] Furthermore, the platform events generated by the rule management module are stored in the event management module and displayed in the event management list.

[0017] In the above-mentioned network security integration and linkage platform, the decision management module sets a decision management list, and the decisions displayed in the decision management list are the mapping relationship between platform events and actuators, and the decisions connect platform events with actuators; the decision management module detects newly generated platform events in real time, obtains information about platform events, and matches existing decisions based on the information about platform events, manages platform events that meet the decisions and the actuators corresponding to the decisions, so that platform events trigger the actions of the actuators.

[0018] In the above-mentioned network security integration and linkage platform, the executor is a fixed running program, including complex operations composed of one or more of general operations, integrated operations, custom operations, program plug-ins, and script programs.

[0019] The above-mentioned network security integration and linkage platform also includes a permission configuration module, which sets different permission accounts according to different management devices or contents. A single permission account is only for the management of a single device or content.

[0020] The above-mentioned network security integration and linkage platform also includes an audit management module. The audit management module sets an audit management list. The audit management list displays all operation logs of the platform. Through the permission configuration of the permission configuration module, users can retrieve, view and send operation logs through the audit management list.

[0021] The above-mentioned network security integration and linkage platform also includes a system configuration module. The control, management and operation content of the system configuration module include the configuration of platform notification status, platform reminder method and email server information set by the platform.

[0022] The present invention according to the above scheme has the beneficial effect that:

[0023] 1. The platform of the present invention can help enterprises quickly extract security capabilities from existing software and hardware resources. Based on the requirements of the enterprise's own security construction system and the practical experience of senior security experts, it can help quickly realize cross-system automated collaboration through integrated and encapsulated visual orchestration methods and various rules and decision-making tools, thereby improving the work efficiency of security personnel and creating scenario-based and practical security solutions.

[0024] 2. Actuators are set in each system and guide the operation of the system. Similarly, sensors are set at the end of each system to receive information from each system. Therefore, using sensors and actuators as tools, this platform can achieve integration and association across systems.

[0025] 3. Preset event analysis scenarios through the rule management module to help initially filter, associate and define events from multiple device sources, thereby improving the efficiency of analysis and judgment by security operators, and use the orchestration engine to achieve automatic disposal and rapid loss stop, effectively improving the analysis and judgment of security operations.

[0026] 4. The platform realizes the automatic handling of various threat scenarios through the decision-making management module. After the platform analyzes the correlation of events, it uses the orchestration engine to automatically handle them to achieve rapid loss control, effectively improving the handling and response efficiency of security operations.

[0027] 5. The platform supports users to customize automated security scenario handling processes. Through the platform's core functions such as rules and decisions, as well as visual orchestration capabilities, it helps customers streamline event handling, provides a standardized framework for each link in network security operations, lowers the threshold for operations, and sustainably improves operational efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 It is a schematic diagram of the platform structure of the present invention.

[0030] Figure 2 A processing flow chart of an embodiment.

[0031] Figure 3 A processing flow chart of an embodiment.

[0032] Figure 4 A processing flow chart of an embodiment.

[0033] Figure 5 A processing flow chart of an embodiment. DETAILED DESCRIPTION

[0034] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0035] A network security integration and linkage platform, such as Figure 1 As shown, the sensor detects the original events of each device or system and sends the original events to the event management module. The event management module summarizes all the original events, extracts the information of the original events and forms an event management list. The rule management module extracts the information of the original events through the event management list, performs logical association judgment according to the preset rules, associates the original events to form an associated event combination output, and forms a platform event. The decision management module extracts the information of the platform event and establishes a mapping relationship between the platform event and the actuator to be acted according to the preset decision.

[0036] The network security integration and linkage platform includes a sensor management module. Users can create, query, edit and delete each sensor through the sensor management module. The sensor is set at the end of the system, and all information entering or leaving the system is processed by the sensor.

[0037] Sensors are service plug-ins for inbound or outbound integration, which have built-in sensor elements that can sense events. The platform uses sensors to integrate with external systems, receive alarms and events from security systems, C2SHELL bounce connections, chatbots, API calls, and actively detect changes in external system environment indicators. Supported sensor types include but are not limited to API, TCP\IP network services, C2 software, applications and other service types.

[0038] The sensor management module establishes a sensor list and related configurations. The sensor list allows you to clearly view all sensors, displaying information such as the types of sensor applications currently integrated in the system, sensor details, and sensor event descriptions. It also allows you to create, query, edit, and delete each sensor. You can select a sensor application to create a new sensor and support operations such as status start and stop and status modification.

[0039] Sensors are like the "guardians" of the system. All information that needs to pass through the system needs to be processed by sensors. Sensors organize this information into raw events and send them to the event management module.

[0040] The event management module of the network security integration and linkage platform retrieves the content of the original event, analyzes, classifies, and organizes the original event, and establishes an event management list to display various information of the original event.

[0041] The event management module displays all original events transmitted by sensors, including security events, threat events, hidden danger events, and events generated by system rules, etc. It records all perceived original events, dynamically displays original event status trends, event levels, and event classifications, etc. It also supports event information retrieval of basic information and original information of events and other details.

[0042] In the event management list, each original event can be searched and located according to the time range, event name, event level, event type, etc. The event management list supports viewing the basic information and original information of the event and other details.

[0043] The rule management module of the network security integration and linkage platform performs correlation matching on multiple different original events. By analyzing the characteristic attributes of each original event and combining its own set rules, it redefines the original event and combines the associated original events into platform events.

[0044] The rule management module uses rules to make logical association judgments on the original events sensed by the sensor, and combines and outputs the associated events to form platform events. The rule management module performs association matching on multiple original events, redefines key information such as event name, event level (processing priority level or importance level), event content, etc. through preset rules, and filters and blocks repeated events through frequency and repeated features. For an original event, it may be incorporated into different platform events because it has multiple characteristic attributes that meet multiple different preset rules.

[0045] The rule management module manages the preset rules in a list format and generates a rule management list. The rule management list is similar to the event management list and can display rule information, including rule name, rule type, rule creator, rule content, rule validity period, etc. The rule management list can be used to search for rules by name, manage rules by category, modify the start and stop status of rules, and add, delete, and modify rules.

[0046] The platform events generated by the rule management module are saved in the event management module and displayed in the event management list.

[0047] The rule management module is a processing module that integrates and processes the original events. Its processing content is saved in the event management module and displayed in the event management list. In the event management list, the attributes of the original event and the platform event are set, and the attribute identifier is assigned. The 0 or 1 of the identifier determines whether the event belongs to the original event or the platform event.

[0048] In one embodiment, the identifier value of an event in the event management list is 1, and the event is a platform event, which is an integrated event of multiple original events that conform to the same rule; the identifier value of another event in the event management list is 0, and the event is an original event, which is an event detected by a certain sensor at a certain time.

[0049] The decision management module of the network security integration and linkage platform sets up a decision management list. The decisions displayed in the decision management list are the mapping relationships between platform events and actuators. Decisions connect platform events with actuators. The decision management module detects newly generated platform events in real time, obtains platform event information, and matches existing decisions based on platform event information. It manages platform events that meet the decisions with the actuators corresponding to the decisions, so that platform events trigger the actions of the actuators.

[0050] The decision in the decision management module is used to establish a mapping relationship between platform events and the actuators to be acted upon. The operation of the decision is to connect the platform events with the actuators. The decision management module has a decision management list, and all decisions are displayed in the decision management list. The displayed content includes information such as the decision name, decision creator, decision content, and decision establishment event. In the decision management list, it supports classification management of decisions, modification of the start and stop status of decisions, and addition, deletion, and modification of decisions. In a single decision, multiple actuators that act simultaneously can be configured for a platform, that is, a series of actions are executed, and the decision supports independent one-click activation and deactivation to modify the content of the actuator in the decision.

[0051] The original events sensed by the sensor are constantly generated, so the corresponding platform events are in a state of continuous updating, whether the content of the generated platform events increases or the number of platform events increases. The decision management module matches the newly generated platform events with all decisions, and establishes the mapping relationship between the formed platform events and the actuators one by one. Once the mapping relationship between the two is confirmed, the original events contained in the newly generated platform events trigger the corresponding actuators, and the actuators perform corresponding operations. The generated platform events have been matched with decisions, and the platform events already have a mapping relationship with the actuators. Therefore, when the content of the platform events increases, that is, a new original event is added to the platform events, the original event triggers the action of the corresponding actuator, and the actuator performs the operation. In short, the trigger object for the operation of the actuator is actually the original event sensed by the sensor. The settings of platform events, rules, decisions, etc. are all for integration and linkage settings, providing users with more convenient management operations.

[0052] The executors in the network security integration and linkage platform are fixed running programs, including complex operations composed of one or more orchestration combinations of general operations, integrated operations, custom operations, program plug-ins, and script programs.

[0053] The actuator is the smallest executable specific operation. It can be run by inputting relevant configurations. It supports debugging and third-party expansion. Through the actuator, it can be connected to any external system and the expansion of inspection components. The content of the actuator includes common operations (ssh, REST calls), integration (Docker, awvs, Nessus) operations or custom operations. It can also be a Python plug-in or any script. A single actuator can execute a certain operation alone, or it can be a "complex action" formed by choreographing and combining multiple operations. It can execute multiple operations at the same time, so that platform events execute a series of configured actuators / workflows under the guidance of decisions. In terms of operation, since a decision can be configured with multiple different actuators, for better management, the actuator is preferably an operation rather than a combination of multiple operations.

[0054] The platform has an executor management list, which supports creating, querying, running, editing (editing the operations of the executor, such as modifying the running program code, introducing plug-in addresses, etc.), and deleting executors. At the same time, you can view the content and running records of the executor. The running records can support viewing the running records of the executor / workflow, and the records of the workflow can be expanded by node.

[0055] In terms of the formation of executors, the platform can preset executors, and the platform provides a visual drag-and-drop arrangement interface, where users can freely assemble and arrange executors to form new workflows. In one embodiment, in the visual drag-and-drop arrangement interface, the user drags the executors preset by the platform into the interface, and after saving, a new executor is formed, and the content of the newly generated executor includes the content of all executors dragged into the interface.

[0056] The network security integration and linkage platform also includes a permission configuration module, which sets different permission accounts according to different management devices or contents. A single permission account is only for the management of a single device or content.

[0057] The permission configuration of the permission configuration module is reflected in the account. The specific account types include system administrators, rule administrators, decision administrators, audit administrators, permission configuration administrators, account administrators, security administrators, etc. Among them, the system administrator has the authority to the platform settings and other related functions, and is responsible for the operation and maintenance of the platform program; the security administrator has the authority to the system security equipment and security operations and other related functions, and is responsible for the system security maintenance; the rule administrator has the authority to manage the rules through the rule management list; the decision administrator has the authority to manage the decisions through the decision management list; the audit administrator has the authority to operate, log in, and log out the logs, and also has the authority to send the logs; the permission configuration administrator has the authority to manage the account and account permissions, and there is an account management list that allows operations such as viewing, creating, deleting, enabling, and disabling users.

[0058] In actual operation, the type of account determines the account's permissions, which means that a single account only has permissions for a certain device or content. If the user needs multiple permissions, he or she can only log in to different accounts to manage them separately.

[0059] The network security integration and linkage platform also includes an audit management module. The audit management module sets an audit management list. The audit management list displays all operation logs of the platform. Through the permission configuration of the permission configuration module, users can retrieve, view, and send operation logs through the audit management list.

[0060] Audit management is to ensure the security of the system and operations. Through audit tracking and in conjunction with the corresponding accountability mechanism, it has a deterrent and warning effect on external intruders and malicious behavior of internal personnel. The audit management list set up in the audit management module records all operation logs of the platform and supports retrieval, viewing, and forwarding of operation logs.

[0061] The network security integration and linkage platform also includes a system configuration module. The control, management, and operation contents of the system configuration module include the configuration of the platform notification status, platform reminder method, and mail server information set by the platform.

[0062] In one embodiment, if Figure 2 As shown, sensors set up in different locations receive threat intelligence, including sensors set up in the internal environment, sensors set up in the external environment, and sensors that receive work orders (issued by the group). After receiving the threat intelligence, the sensor determines whether the attack source belongs to the blacklist according to the set blacklist IP denormalization rules. The rule management module integrates the information of all sensors and summarizes them into blacklist integration events. The blacklist integration event re-uses the rules of whether the attack source belongs to the blacklist, so that the blacklist integration event is associated with the global blacklist ban decision, so that the action of the sensor receiving the threat intelligence triggers the global blacklist ban decision and starts all actuators associated with the global blacklist ban decision.

[0063] Among them, threat intelligence is defined as the collection, processing and analysis of information from internal or external sources to identify and understand potential threats to an organization. It is usually based on the analysis of data collection and the identification of behavioral patterns, tools, techniques and procedures (TTPs), attackers' motives, etc. that may pose a threat. The sources of collected data include public Internet resources, underground forums, social media, security communities, partners, and specialized intelligence service providers.

[0064] In addition to the Internet resources, underground forums, social media, security communities, partners, and specialized intelligence service providers mentioned above, the content of the blacklist also comes from the IP addresses recorded in the system intrusion protection log.

[0065] The global blacklist ban decision obtains the IP individuals and their information belonging to the existing blacklist and blacklist integration events, and the executors in each functional module of the system perform the blocking operation on the IP. The blocking operation performed by one of the executors is to ban the IP on the firewall; the blocking operation performed by one of the executors is to ban the IP on the switch; the blocking operation performed by one of the executors is to ban the IP in the one-click blocking system; and the blocking operation performed by one of the executors is to ban the IP on the terminal protection device.

[0066] Generally speaking, the method of network security defense is basically only one way to block attacks. For businesses that are in operation for a long time, the basic operation of network security processing is to discover threats and solve threats, especially during the protection period, it is necessary to have real-time insight into the detection of attackers, and to block foreign and suspicious IPs comprehensively. Conventional operations are basically to write blocking strategies one by one manually after discovering the IP, or to add them in batches after gathering enough numbers, or to import them from existing databases (derived from Internet resources, underground forums, social media, security communities, partners, and specialized intelligence service providers), which cannot be real-time and targeted, and cannot achieve full system (all security protection, such as firewalls, switch ban lists, and protective equipment of various functional modules) linkage, and the efficiency is low. The present invention is based on the platform's automated arrangement, and various information sources are connected through sensors, and each node device of the linkage system is integrated based on threat intelligence of internal and external environments, work orders issued by the group, and intrusion protection decisions or intrusion protection logs updated in real time, etc., to establish actuators to jointly block at various points (functional modules) of the enterprise, and to prevent network dangers from breaking through the intranet and causing enterprise losses in a timely and effective manner.

[0067] In one embodiment, a sensor receives a fixed instruction sent by a mobile terminal. The fixed instruction complies with a preset instruction normalization rule, so it is set as a platform event by a rule management module. The platform event triggers different decisions, including a survival detection execution decision and a service detection execution decision.

[0068] Among them, the executor associated with the survival detection execution decision is used for network detection. The executor associated with the survival detection execution decision sends a network signal to each security device. After the network signal is received by the security device, it is returned to the executor without any changes. The executor determines whether there is a feedback signal omission based on the frequency and number of the received feedback signals, and whether the number of feedback signal omissions is within the tolerance range. If the number of feedback signal omissions is within the tolerance range, it determines whether the corresponding security device is alive, and then outputs the number of surviving security devices and the corresponding name list to the mobile terminal, and prompts the name list of non-surviving security devices. At this point, the content of the survival detection execution decision ends.

[0069] The actuator associated with the service detection execution decision is used to detect the service effect of the security device. The actuator associated with the service detection execution decision sends a digital detection signal to each security device. After the digital detection signal is received by the security device, it is processed by the security device computing center to generate a feedback signal, and the feedback signal is returned to the actuator. According to the frequency and number of the received feedback signals, it is judged whether there is a reasonable feedback signal (whether the feedback signal is reasonable is determined by judging whether the graph of the signal is within a preset reasonable range, such as whether the waveform amplitude range is within a reasonable range, whether the waveform is continuous, etc., or judging whether the value of the signal is within a preset reasonable range, such as judging whether the value is a reasonable type, whether the value is a reasonable object, etc.) omission, and whether the number of reasonable feedback signal omissions is within the tolerance range. If the number of reasonable feedback signal omissions is within the tolerance range, it is judged that the corresponding security device is in normal working state, and then the number and name list of security devices in normal working state are output to the mobile terminal, and the name list of security devices in abnormal working state is prompted to complete the service detection execution decision.

[0070] Regular security inspections help to timely discover long-term system security risks and new security vulnerabilities, and repair them in a timely manner, which can ensure the security and high availability of platforms and security equipment, grasp the threat status of current networks and platforms, and take targeted security measures. Due to security needs, some companies purchase too many and too many types of security equipment, resulting in the retention and storage of security equipment or infrequently used functional equipment. It is difficult for management personnel to manage them comprehensively, and the equipment is not reasonably used. It is difficult to debug one by one to confirm the status of the equipment, so that the equipment functions are not fully utilized, and the internal configuration is not updated in time. The platform of the present invention realizes human-computer interaction through core functions such as decision-making and workflow, and uses the sensors and actuators set at the end of the system by the platform to trigger multiple instructions through a single instruction, thereby coordinating various security capabilities of the enterprise, easily realizing security inspections in a semi-interactive manner, discovering system security risks in a timely manner, and being able to confirm the status of the equipment.

[0071] In one embodiment, if Figure 3As shown, the sensor senses the updated information in the system's intrusion protection log, and the updated information constitutes the original event sensed by the sensor, which is extracted and analyzed by the rule management module. The original event constituted by the attack event conforms to the normalization rule of SQL injection attack events (referring to the attack event in which the attacker attempts to manipulate or control the backend database by inserting malicious SQL code in the input field), forming a platform event under the normalization rule of SQL injection attack events. Furthermore, the platform event triggers the SQL injection attack event handling decision, starts the corresponding executor, and forms a workflow. The content of the workflow includes: (1) obtaining the target URL source IP; (2) performing SQL injection vulnerability detection on the system; (3) if there is a vulnerability in SQL, a detection report is generated, and the report is sent to the security administrator in the permission configuration module through the fixed mailbox configured by the platform, and at the same time, the executor set at the firewall is started to promote the firewall to block the source IP.

[0072] In one embodiment, if Figure 4 As shown, the sensor senses the updated information in the system's intrusion protection log, and the updated information constitutes the original event sensed by the sensor, which is extracted and analyzed by the rule management module. The original event constituted by the attack event conforms to the normalization rules of SSH weak password attack events (referring to the attack event in which the attacker uses the SSH (Secure Shell) service on the remote server or device to try to use common weak passwords (such as password123, admin, etc.) to log in to the system through brute force or dictionary attacks), forming a platform event under the normalization rules of SSH weak password attack events. Furthermore, the platform event triggers the SSH weak password attack event handling decision, starts the corresponding executor, and forms a workflow. The contents of the workflow include: (1) obtaining the target IP; (2) performing SSH service detection on the system (similar to the above-mentioned service detection execution decision workflow); (3) detecting whether the SSH weak password of the platform event exists in the system; (4) if the SSH weak password exists, performing a password modification operation; (5) if the password modification operation is successful, generating a security report related to the platform event, and sending the security report and the modified preset password or random password to the security administrator in the permission configuration module through the fixed mailbox configured by the platform; if the password modification operation fails, generating a security report related to the platform event, and sending the security report and the password modification prompt to the security administrator in the permission configuration module through the fixed mailbox configured by the platform.

[0073] In one embodiment, if Figure 5As shown, the sensor senses the updated information in the system's intrusion protection log, and the updated information constitutes the original event sensed by the sensor, which is extracted and analyzed by the rule management module. The original event constituted by the attack event complies with the CVE-2021-41277 attack event normalization rules (referring to the attack event through the CVE-2021-41277 security vulnerability existing in the Metabase data analysis platform. This vulnerability allows attackers to bypass the authentication mechanism through carefully constructed HTTP requests and read the contents of any file on the server), forming a platform event under the CVE-2021-41277 attack event normalization rules. Furthermore, the platform event triggers the CVE-2021-41277 attack event handling decision, starts the corresponding executor, and forms a workflow. The workflow includes: (1) obtaining the attack source IP and target IP; (2) running the Metabase directory traversal vulnerability detection script through the executor (the purpose of the script is to detect whether the Metabase server has a directory traversal vulnerability (Directory Traversal Vulnerability), especially for the CVE-2021-41277 vulnerability. The script attempts to read sensitive files on the server (such as / etc / passwd) by sending carefully constructed HTTP requests to Metabase's specific API. If these files can be read successfully, it means that the server has a directory traversal vulnerability; otherwise, it means that the vulnerability has been fixed or does not exist); (3) starting the executor set at the firewall to promote the firewall to block the source IP; (4) if the vulnerability exists, the executor issues a work order and sends the work order to the security administrator in the permission configuration module through the fixed mailbox configured by the platform, urging the security administrator to repair the vulnerability.

[0074] The handling of a large number of alarms generated by asset scanning, vulnerability scanning, attack exploitation attempts, and other behaviors on various traffic-side detection systems is a relatively labor-intensive task in emergency response. Only through warning triage and alarm investigation can the quality of warnings be improved and the number of warnings be reduced. The platform of the present invention can achieve attack interception, detection, and response by collecting, associating, classifying, sharing, integrating, and matching with other systems for multi-source threat information.

[0075] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security integration and linkage platform, characterized in that: The sensor detects the raw events of each device or system and sends the raw events to the event management module. The event management module aggregates all original events, extracts the information of original events and forms an event management list. The rule management module extracts the information of the original event through the event management list, makes logical association judgments according to the preset rules, associates the original events to form a combination of associated events and outputs them to form platform events. The decision management module extracts information about platform events and establishes a mapping relationship between platform events and actuators to be acted upon based on preset decisions.

2. According to the network security integration and linkage platform described in claim 1, it is characterized in that: It includes a sensor management module, through which users can create, query, edit and delete each sensor. The sensor is set at the end of the system, and all information entering or leaving the system is processed by the sensor.

3. According to the network security integration and linkage platform described in claim 1, it is characterized in that: The event management module retrieves the content of the original event, analyzes, classifies, and organizes the original event, and creates an event management list to display various information of the original event.

4. According to the network security integration and linkage platform described in claim 1, it is characterized in that: The rule management module performs correlation matching on multiple different original events, redefines the original events by analyzing the characteristic attributes of each original event and combining its own set rules, and then combines the related original events into platform events.

5. According to the network security integration and linkage platform described in claim 4, it is characterized in that: The platform events generated by the rule management module are saved in the event management module and displayed in the event management list.

6. According to the network security integration and linkage platform described in claim 1, it is characterized in that: The decision management module sets up a decision management list. The decisions displayed in the decision management list are the mapping relationships between platform events and actuators. Decisions connect platform events with actuators. The decision management module detects newly generated platform events in real time, obtains platform event information, and matches existing decisions based on platform event information. It manages platform events that meet the decisions with the actuators corresponding to the decisions, so that platform events trigger the actions of the actuators.

7. According to the network security integration and linkage platform described in claim 1, it is characterized in that: The executor is a fixed running program, including complex operations composed of one or more arrangements of general operations, integrated operations, custom operations, program plug-ins, and script programs.

8. According to the network security integration and linkage platform described in claim 1, it is characterized in that: It also includes a permission configuration module, which sets different permission accounts according to different management devices or contents. A single permission account is only for the management of a single device or content.

9. According to the network security integration and linkage platform described in claim 1, it is characterized in that: It also includes an audit management module. The audit management module sets an audit management list. The audit management list displays all operation logs of the platform. Through the permission configuration of the permission configuration module, users can retrieve, view, and send operation logs through the audit management list.

10. A network security integration and linkage platform according to claim 1, characterized in that: It also includes a system configuration module, the control, management and operation contents of which include the configuration of the platform notification status, platform reminder method and the mail server information set by the platform.

Images