Information security monitoring system, method, device and medium

Abstract

The invention provides an information security monitoring system, method and device, electronic equipment and a storage medium, the information security monitoring system comprises an information security agent component, an information security server and a data storage and visualization component, the information security agent component is deployed in to-be-monitored equipment, and the data storage and visualization component is deployed in the to-be-monitored equipment. The acquisition module is used for acquiring equipment information of the to-be-monitored equipment; the information security server receives the equipment information reported by the information security agent component, and executes a target strategy according to the equipment information; and the data storage and visualization component processes the equipment information forwarded by the information security server, and displays security events corresponding to different to-be-monitored equipment according to a processing result. In the information security monitoring scheme provided by the invention, through automatic security monitoring and management processes, the workload of security management personnel is reduced, and the reliability and timeliness of information security monitoring are improved.

Description

Technical Field

[0001] The present application relates to the technical field of power distribution data processing, and in particular to an information security monitoring system, method, device, electronic equipment and storage medium. Background Art

[0002] With the rapid development of information technology, network security threats are becoming increasingly severe, and enterprises are facing increasing risks such as data leakage, system compromise, and malware infection.

[0003] Current defense methods often rely on manual work. However, vulnerability scanning tools have relatively simple functions and can only detect specific types of vulnerabilities or are limited to certain systems or applications. This limitation makes it difficult to fully carry out vulnerability scanning work and easily misses other types of vulnerabilities or security issues in system components. Real-time updates of vulnerability databases and scanning tools are essential to ensure the accuracy of scanning results. However, vulnerability scanning solutions fail to provide a real-time update mechanism, resulting in the inability to detect new vulnerabilities in a timely manner. It can be seen that the reliability and timeliness of current information security monitoring solutions are poor. Summary of the invention

[0004] The embodiments of the present application provide an information security monitoring system, method, device, electronic device, and storage medium, which can improve the reliability and timeliness of information security monitoring.

[0005] In a first aspect, an embodiment of the present application provides an information security monitoring system, including:

[0006] An information security agent component, which is deployed in the device to be monitored and is used to obtain device information of the device to be monitored;

[0007] An information security server, configured to receive device information reported by the information security agent component and execute a target policy according to the device information;

[0008] The data storage and visualization component is used to process the device information forwarded by the information security server, and is also used to display security events corresponding to different monitored devices based on the processing results.

[0009] Optionally, in some embodiments of the present application, the information security agent component transmits the device information to the information security server through a preset communication protocol. Under preset conditions, the information security agent component processes the device information and / or transmits the device information based on a preset policy.

[0010] Optionally, in some embodiments of the present application, under a preset condition, the information security agent component processes the device information, and / or transmits the device information based on a preset policy, including:

[0011] When the network is unstable, the information security agent component continues to transmit the device information at the breakpoint;

[0012] When the data volume is greater than a preset value, the information security agent component compresses the device information and transmits the compressed device information to the information security server.

[0013] Optionally, in some embodiments of the present application, the information security agent component is also used to perform security rule detection and intercept behaviors that do not meet the preset security environment.

[0014] Optionally, in some embodiments of the present application, the information security server is specifically used to decode and standardize the device information based on a preset decoder.

[0015] Optionally, in some embodiments of the present application, the information security server is further used to analyze the decoded device information using predefined security rules, and generate a security warning prompt when the decoded device information poses a security threat.

[0016] In a second aspect, an embodiment of the present application provides an information security monitoring method, which is applied to the information security monitoring system of any of the above embodiments, and the information security monitoring method includes:

[0017] Obtaining device information of the device to be monitored;

[0018] executing a target strategy according to the device information;

[0019] The device information is processed, and security events corresponding to different monitored devices are displayed according to the processing results.

[0020] In a third aspect, an embodiment of the present application provides an information security monitoring device, including:

[0021] An acquisition module, used to acquire device information of the device to be monitored;

[0022] An execution module, used for executing a target strategy according to the device information;

[0023] The processing module is used to process the device information and display security events corresponding to different monitored devices according to the processing results.

[0024] Correspondingly, the present application also provides an electronic device, comprising a memory, a processor, and a processing program stored in the memory and executable on the processor, wherein the processor executes the program according to any of the steps of the method described above.

[0025] The present application also provides a storage medium, wherein the storage medium stores a processor program, and the processor program implements any of the above methods when the processor program is executed by a processor.

[0026] The present application provides an information security monitoring system, method, device, electronic device and storage medium. The information security monitoring system includes: an information security agent component, an information security server and a data storage and visualization component. The information security agent component is deployed in the device to be monitored and is used to obtain the device information of the device to be monitored; the information security server receives the device information reported by the information security agent component and executes the target strategy according to the device information; the data storage and visualization component processes the device information forwarded by the information security server and also displays the security events corresponding to different devices to be monitored according to the processing results. In the information security monitoring scheme provided by the present application, the workload of security managers is reduced and the reliability and timeliness of information security monitoring are improved through automated security monitoring and management processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 This is a schematic diagram of the structure of the information security monitoring system provided in the embodiment of the present application.

[0029] Figure 2 It is a flowchart of the information security monitoring method provided by the embodiment of the present application;

[0030] Figure 3 is a structural diagram of an information security monitoring device provided in an embodiment of the present application;

[0031] Figure 4 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of systems and methods consistent with the examples detailed in the attached claims, or with some aspects of the present application.

[0033] It should be noted that, in this article, the terms "include", "comprises" or any other variants thereof are intended to cover descriptions such as non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element. In addition, components, features, and elements with the same name in different embodiments of the present application may have the same meaning or different meanings, and their specific meanings need to be determined by their explanation in the specific embodiment or further combined with the context of the specific embodiment.

[0034] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0035] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present application, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0036] Embodiments of the present application provide an information security monitoring system, device, electronic device and storage medium.

[0037] The information security monitoring device can be deployed in a terminal, which can be a smart phone, a tablet, etc. As mentioned above, the terminal 102 is often equipped with a display device, which can also be a display, a display screen, a touch screen, etc. The touch screen can also be a touch screen, a touch panel, etc., but is not limited to this. The terminal can communicate with the server in a wired or wireless manner. The server can include an independently running server or a distributed server, or a server cluster composed of multiple servers. The terminal can include a mobile phone, a tablet computer or a personal computer (PC, Personal Computer).

[0038] It should be noted that the order of description of the following embodiments is not intended to limit the priority order of the embodiments.

[0039] See also Figure 1 , Figure 1 This is an architectural diagram of the information security monitoring system provided by the present application. The information security monitoring system includes an information security agent component 101, an information security server 102, and a data storage and visualization component 103: wherein the information security agent component 101 is deployed in the device to be monitored, and is used to obtain the device information of the device to be monitored; the information security server 102 is used to receive the device information reported by the information security agent component 101, and execute the target policy according to the device information; the data storage and visualization component 103 processes the device information forwarded by the information security server 102, and also displays the security events corresponding to different devices to be monitored according to the processing results.

[0040] Specifically, the information security agent component 101 is deployed in the device to be monitored, such as a computer system, a network device, a server, a workstation, a mobile device, a virtual machine, or a cloud instance. The purpose of monitoring these devices is to ensure their security and prevent data leakage, service interruption, malware infection, or other security threats. The information security agent component 101 collects various information of the device to be monitored, such as system logs, application logs, network traffic data, file integrity information, etc. Then, the collected data is reported to the information security server 102. The information security server 102 receives the device information reported from the information security agent component 101. At the same time, the predefined security policy can be executed according to the received device information. When a potential security threat or abnormal behavior is detected, an alarm is generated and the administrator is notified. Optionally, in some embodiments of the present application, the information security server 102 allows the administrator to manage and update security policies and rules through a management interface. The data storage and visualization component 103 processes the device information forwarded by the information security server 102. Then, the processed data is stored in an appropriate storage system, and security events corresponding to different devices to be monitored are displayed according to the processing results.

[0041] For example, the information security agent component 101 runs on the device to be monitored and collects device information in real time. The information security agent component 101 sends the collected data to the information security server 102. The information security server 102 receives the data and executes security policies based on the data. When a security threat is detected, the information security server 102 generates an alarm. The data storage and visualization component 103 processes the data forwarded by the information security server 102 and stores it. The data storage and visualization component 103 displays security events of different devices to be monitored. The administrator analyzes the security events through the visualization interface and responds.

[0042] Optionally, in some embodiments of the present application, the information security agent component 101 transmits device information to the information security server 102 via a preset communication protocol. Under preset conditions, the information security agent component 101 processes the device information and / or transmits the device information based on a preset policy.

[0043] (1) If the monitored device detects an abnormal login attempt, the information security agent component 101 immediately transmits the relevant logs and event details to the information security server 102 through an encrypted communication protocol. (2) When the monitored device is a mobile device and the network connection is unstable. The information security agent component 101 first pre-processes the collected data locally, such as compressing or deduplicating, and then waits for the network conditions to improve before transmitting it to the information security server 102. (3) The information security server 102 is configured with a policy to only receive high-risk security events. According to this policy, the information security agent component 101 only reports information to the server when a high-risk event is detected, reducing network traffic and server processing burden. (4) The monitored device is a workstation in the internal network and the network bandwidth is limited. The information security agent component 101 is configured to batch transmit the collected data to the information security server 102 during network off-peak hours, such as at night, to reduce the impact on daily work. (5) It is detected that the system configuration has been changed, such as the firewall settings have been accidentally modified. The information security agent component 101 immediately reports the change event to the information security server 102, and the server may automatically restore the configuration according to a preset policy or notify the administrator to perform manual intervention.

[0044] Optionally, in some embodiments of the present application, under preset conditions, the information security agent component 101 processes the device information and / or transmits the device information based on a preset policy, including:

[0045] When the network is unstable, the information security agent component 101 resumes the transmission of device information at the breakpoint;

[0046] When the data volume is greater than a preset value, the information security agent component 101 compresses the device information and transmits the compressed device information to the information security server 102 .

[0047] For example, the information security agent component 101 detects that the network connection is unstable, such as frequent packet loss or high latency. The information security agent component 101 automatically enables the breakpoint resuming mechanism, marks the successfully transmitted data as completed, and continues to transmit the remaining data after the network is restored to stability. This ensures that even in poor network conditions, key security events and logs can be fully transmitted to the information security server 102.

[0048] For example, specifically, the amount of data collected by the information security agent component 101 exceeds a preset threshold, and the data collected at a single time exceeds 50MB. The information security agent component 101 automatically compresses the data to reduce the size of the data. The compressed data is transmitted to the information security server 102 through the established secure channel, thereby saving bandwidth and improving transmission efficiency.

[0049] In addition, when the information security agent component 101 works under the condition of unstable network and large amount of data. First, the information security agent component 101 compresses the collected data to reduce the amount of transmitted data. Then, when the network is unstable, the breakpoint resume mechanism is enabled to ensure the integrity and reliability of the data. This combined method is particularly suitable for environments with limited bandwidth or unstable network conditions, such as mobile devices or remote offices.

[0050] Optionally, in some embodiments of the present application, the information security agent component 101 is also used to perform security rule detection and intercept behaviors that do not meet the preset security environment.

[0051] For example, the information security agent component 101 is configured with a series of security rules that define what is safe and unsafe behavior. The information security agent component 101 monitors the activities on the monitored devices in real time, and once any behavior is found to violate these preset security rules, such as unauthorized file access or suspicious network connection attempts, it will automatically trigger an alarm and take interception measures. The information security agent component 101 detects characteristic behaviors of malware on the monitored devices, such as attempts to connect to known malicious servers or attempts to modify system files. The information security agent component 101 automatically intercepts these behaviors, prevents the malware from communicating with the outside, and notifies the information security server 102 for further analysis and response. If the information security agent component 101 detects attempts to transmit sensitive data to unauthorized external servers, it will intercept these data transmission behaviors according to the preset data protection rules and alert the administrator to review to prevent potential data leaks.

[0052] Optionally, in some embodiments of the present application, the information security server 102 is specifically used to decode and standardize the device information based on a preset decoder.

[0053] For example, after the information security agent component 101 collects log data in different formats from the monitored device, the information security server 102 decodes the log data using a preset decoder to convert the raw data into a readable and analyzable format. The decoding process may include parsing the log timestamp, event type, source and target information, etc., and standardizing this information for further security analysis.

[0054] Optionally, in some embodiments of the present application, the information security server 102 is further used to analyze the decoded device information using predefined security rules, and generate a security warning prompt when the decoded device information poses a security threat.

[0055] For example, the information security server 102 identifies this behavior as a potential password cracking attack based on predefined security rules and generates a security alert so that the security team can respond quickly; the information security server 102 can also use predefined rules to mark this behavior as suspicious and generate an alert to prompt the administrator to conduct further investigation. The information security server 102 can also identify this configuration change as a violation based on predefined compliance rules and generate an alert to ensure that the security of the system is not weakened.

[0056] The present application provides an information security monitoring system, including: an information security agent component 101, an information security server 102, and a data storage and visualization component 103. The information security agent component 101 is deployed in the device to be monitored, and is used to obtain the device information of the device to be monitored; the information security server 102 receives the device information reported by the information security agent component 101, and executes the target strategy according to the device information; the data storage and visualization component 103 processes the device information forwarded by the information security server 102, and also displays the security events corresponding to different devices to be monitored according to the processing results. In the information security monitoring scheme provided by the present application, the workload of security managers is reduced through automated security monitoring and management processes, and the reliability and timeliness of information security monitoring are improved.

[0057] See also Figure 2 , Figure 2 This is a flow chart of the information security monitoring method provided by the present application, which specifically includes the following process:

[0058] 201. Obtain device information of the device to be monitored.

[0059] Optionally, the information security agent component 101 is configured to automatically collect system logs on the device to be monitored. These logs may include event logs, application logs, security logs, etc. of the operating system, which record system operations, errors, warnings and other key information. The information security agent component 101 monitors all inbound and outbound network traffic of the device to be monitored. Through network traffic analysis, information about the device's communication with the outside world can be collected, including the URLs visited, the amount of data transmitted, the protocols used, etc. The information security agent component 101 regularly scans key files and directories on the device to be monitored, records the hash values ​​of the files, and monitors any unauthorized modifications. This helps detect malware implants or data leaks.

[0060] 202. Execute the target strategy according to the device information.

[0061] For example, after receiving the device configuration information reported by the information security agent component 101, the information security server 102 automatically checks whether the device configuration complies with the pre-set security configuration standards, such as password policy, account lock policy, etc. If it is found that the configuration does not meet the security standards, the server will trigger the policy execution, such as automatically pushing security patches or sending notifications to require administrators to intervene manually.

[0062] 203. Process the device information, and display security events corresponding to different monitored devices according to the processing results.

[0063] For example, the information security agent component 101 collects various information from the monitored device, including system logs, network traffic, file integrity status, user activities, etc. The information security agent component 101 transmits the collected device information to the information security server 102 through a secure communication channel. The information security server 102 uses a preset decoder to decode and standardize the transmitted device information and convert it into a format that is easy to analyze. The information security server 102 analyzes the decoded data according to predefined security rules to identify potential security threats or abnormal behaviors. When the analysis finds a security threat, the information security server 102 generates a security event and classifies it according to the severity and type of the event. The data storage and visualization component 103 receives security event data from the information security server 102 and displays it on a visualization interface.

[0064] The above is the information security monitoring process provided in the embodiment of the present application.

[0065] In summary, after obtaining the device information of the device to be monitored, the embodiment of the present application executes the target strategy according to the device information, and finally processes the device information, and displays the security events corresponding to different devices to be monitored according to the processing results. In the information security monitoring solution provided by the present application, the workload of security managers is reduced and the reliability and timeliness of information security monitoring are improved through automated security monitoring and management processes.

[0066] In order to further understand the information security monitoring solution of this application, the following is an example of an information security monitoring scenario based on the Wazuh platform. The Wazuh platform is an open source security monitoring and event management framework that provides comprehensive monitoring of physical servers, virtual machines, workstations, containers, and cloud instances.

[0067] 1.1 The Wazuh platform is mainly composed of three core components: the central manager (Wazuh server, i.e., information security server), the agent (Wazuh Agent, i.e., information security agent component), and the data storage and visualization layer (based on Elastic Stack, i.e., data storage and visualization component).

[0068] 1.2 Central Manager (Wazuh Server)

[0069] Located at the center of the architecture, it is responsible for receiving monitoring data from agents, enforcing security policies, generating alerts, and integrating with other security systems. The server has a built-in decoder that can decode the data sent by the agent, and a built-in rule engine that can enforce security policies and generate alerts.

[0070] 1.3 Agent (Wazuh Agent)

[0071] Deployed on the terminal devices that need to be monitored, such as servers, workstations, virtual machines or cloud instances. The agent is responsible for collecting the device's system logs, application logs, network traffic data, file integrity information, etc., and transmits this data to the central manager in real time.

[0072] 1.4 Data Storage and Visualization Layer

[0073] Built on the Elastic Stack, it is used to store, retrieve, and analyze data forwarded by the Wazuh server. Through the distributed storage and search capabilities of Elasticsearch, it can efficiently process large amounts of monitoring data. At the same time, Kibana provides a rich visualization interface for administrators to view and analyze security events.

[0074] 2. Main Components

[0075] 2.1Wazuh Agent

[0076] 2.1.1 Data Collection

[0077] Wazuh Agent can collect data from multiple data sources including system logs, application logs, network traffic, file changes, etc. Agent supports flexible configuration, allowing administrators to customize collection strategies according to actual needs to ensure the integrity and real-time nature of key data.

[0078] 2.1.2 Data Transmission

[0079] The collected data is transmitted to the Wazuh server via a secure communication protocol (such as TLS / SSL). The Agent supports features such as breakpoint resuming and compressed transmission to ensure reliable data transmission in the case of unstable network or large data volume.

[0080] 2.1.3 Local Processing

[0081] In order to reduce the server load and improve response speed, the Agent also has certain local processing capabilities. For example, it can perform simple security rule checks and conduct preliminary interception of obvious malicious behaviors.

[0082] 2.2 Wazuh Server

[0083] 2.2.1 Data reception and decoding

[0084] The server receives the raw data from the agent and decodes and normalizes it using the built-in decoder, which helps with subsequent security analysis and alarm generation.

[0085] 2.2.2 Security Analysis and Alert Generation

[0086] The server uses predefined security rules and policies to conduct in-depth analysis of the decoded data. When potential security threats or abnormal behaviors are found, the server will generate an alarm and notify the administrator. The alarm information includes event details, risk level, handling suggestions, etc.

[0087] 2.2.3 Policy Management and Update

[0088] Administrators can manage and update security policies and rules through the Wazuh server's management interface. This allows enterprises to adjust monitoring strategies based on actual conditions to respond to changing security threats.

[0089] 2.2.4 Integration and Extension

[0090] Wazuh server provides a rich API and plug-in interface for easy integration with other security tools and systems. In addition, by writing custom decoders and rules, you can expand the monitoring scope and depth of Wazuh.

[0091] 2.3Elastic Stack

[0092] 2.3.1 Data Storage

[0093] As the data storage layer, Elasticsearch uses its distributed architecture and powerful search capabilities to achieve efficient storage and retrieval of large amounts of monitoring data.

[0094] 2.3.2 Data Analysis and Visualization

[0095] As a visual interface, Kibana provides a variety of charts and dashboards to help administrators intuitively view and analyze security events. In addition, Kibana also supports customized dashboards and reporting functions to meet the monitoring needs of enterprises at different levels.

[0096] 2.3.3 Log Search and Audit

[0097] Elasticsearch supports complex query and search functions. Administrators can use Kibana to search and audit logs to quickly locate and analyze security issues.

[0098] In order to better implement the information security monitoring system of the embodiment of the present application, the embodiment of the present application also provides an information security monitoring device, wherein the meanings of the terms are the same as those in the above-mentioned information security monitoring system, and the specific implementation details can refer to the description in the system embodiment.

[0099] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of an information security monitoring device provided in an embodiment of the present application, wherein the information security monitoring device may specifically include an acquisition module 301, an execution module 302, and a processing module 303, which may be specifically as follows:

[0100] The acquisition module 301 is used to acquire device information of the device to be monitored;

[0101] An execution module 302, configured to execute a target policy according to device information;

[0102] The processing module 303 is used to process the device information and display the security events corresponding to different monitored devices according to the processing results.

[0103] The embodiment of the present application provides an information security monitoring device. After the acquisition module 301 acquires the device information of the device to be monitored, the execution module 302 executes the target strategy according to the device information. Finally, the processing module 303 processes the device information and displays the security events corresponding to different devices to be monitored according to the processing results. In the information security monitoring solution provided by the present application, the workload of security managers is reduced and the reliability and timeliness of information security monitoring are improved through automated security monitoring and management processes.

[0104] In addition, the present application also provides an electronic device, such as Figure 4 As shown, it shows a schematic diagram of the structure of the electronic device involved in the embodiment of the present application, specifically:

[0105] The electronic device may include components such as a processor 301 with one or more processing cores, a memory 302 with one or more processor-readable storage media, a power supply 303, and an input unit 304. Those skilled in the art will appreciate that Figure 4 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0106] The processor 301 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 302, and calling data stored in the memory 302, it executes various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. Optionally, the processor 301 may include one or more processing cores; preferably, the processor 301 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 301.

[0107] The memory 302 can be used to store software programs and modules. The processor 301 executes various functional applications and information security monitoring systems by running the software programs and modules stored in the memory 302. The memory 302 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 302 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 302 may also include a memory controller to provide the processor 301 with access to the memory 302.

[0108] The electronic device also includes a power supply 303 for supplying power to each component. Preferably, the power supply 303 can be logically connected to the processor 301 through a power management system, so that the power management system can manage charging, discharging, power consumption and other functions. The power supply 303 can also include one or more DC or AC power supplies, recharging systems, power anomaly detection circuits, power converters or inverters, power status indicators and other arbitrary components.

[0109] The electronic device may further include an input unit 304, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0110] Although not shown, the electronic device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 301 in the electronic device will load the executable files corresponding to the processes of one or more application programs into the memory 302 according to the following instructions, and the processor 301 will run the application programs stored in the memory 302, thereby realizing various functions, as follows:

[0111] Obtain device information of the device to be monitored; execute target policies based on the device information; process the device information, and display security events corresponding to different devices to be monitored based on the processing results.

[0112] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0113] After obtaining the device information of the device to be monitored, the embodiment of the present application executes the target strategy according to the device information, and finally processes the device information, and displays the security events corresponding to different devices to be monitored according to the processing results. In the information security monitoring solution provided by the present application, the workload of security managers is reduced and the reliability and timeliness of information security monitoring are improved through automated security monitoring and management processes.

[0114] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a processor-readable storage medium and loaded and executed by a processor.

[0115] To this end, an embodiment of the present application provides a storage medium in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any information security monitoring system provided in the embodiment of the present application. For example, the instructions can execute the following steps:

[0116] Obtain device information of the device to be monitored; execute target policies based on the device information; process the device information, and display security events corresponding to different devices to be monitored based on the processing results.

[0117] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0118] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0119] Since the instructions stored in the storage medium can execute the steps in any information security monitoring system provided in the embodiments of the present application, the beneficial effects that can be achieved by any information security monitoring system provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0120] The above is a detailed introduction to an information security monitoring system, method, device, electronic device and storage medium provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An information security monitoring system, characterized in that: include: An information security agent component, which is deployed in the device to be monitored and is used to obtain device information of the device to be monitored; An information security server, configured to receive device information reported by the information security agent component and execute a target policy according to the device information; The data storage and visualization component is used to process the device information forwarded by the information security server, and is also used to display security events corresponding to different monitored devices based on the processing results.

2. The information security monitoring system according to claim 1, characterized in that: The information security agent component transmits the device information to the information security server via a preset communication protocol. Under preset conditions, the information security agent component processes the device information and / or transmits the device information based on a preset policy.

3. The information security monitoring system according to claim 2, characterized in that: The information security agent component processes the device information under the preset conditions and / or transmits the device information based on a preset strategy, including: When the network is unstable, the information security agent component continues to transmit the device information at the breakpoint; When the data volume is greater than a preset value, the information security agent component compresses the device information and transmits the compressed device information to the information security server.

4. The information security monitoring system according to claim 1, characterized in that: The information security agent component is also used to perform security rule detection and intercept behaviors that do not meet the preset security environment.

5. The information security monitoring system according to claim 1, characterized in that: The information security server is specifically used to decode and standardize the device information based on a preset decoder.

6. The information security monitoring system according to claim 5, characterized in that: The information security server is also specifically used to analyze the decoded device information using predefined security rules, and generate a security warning prompt when the decoded device information has a security threat.

7. An information security monitoring method, applied to the information security monitoring system according to any one of claims 1 to 6, characterized in that: include: Obtaining device information of the device to be monitored; executing a target strategy according to the device information; The device information is processed, and security events corresponding to different monitored devices are displayed according to the processing results.

8. An information security monitoring device, characterized in that: include: An acquisition module, used to acquire device information of the device to be monitored; An execution module, used for executing a target strategy according to the device information; The processing module is used to process the device information and display security events corresponding to different monitored devices according to the processing results.

9. An electronic device, characterized in that: include: A memory, a processor and a processing program stored in the memory and executable on the processor, wherein the processor executes the steps of the information security monitoring system as described in claim 7.

10. A storage medium, characterized in that: A computer processing program capable of being loaded by a processor and executing the information security monitoring system as claimed in claim 7 is stored.

Images