Interactive network defense system and its operating method

Abstract

An interactive network defense system and its operating method are provided. The system includes a mobile communication device and first to fourth servers. The first server runs Security Information and Event Management (SIEM) software to detect a threat event and generate an alert. The second server runs a Python script to receive the alert, forward the alert to the mobile communication device, and generate a control command based on a response message. The third server runs a server-side of a communication software to transmit the alert to the mobile communication device and uses a webhook to send the response message back to the second server. The mobile communication device runs a client-side of the communication software to receive the alerts and send the response message. The fourth server runs Security Orchestration, Automation, and Response (SOAR) software to execute a defense mechanism based on control commands to cope with the threat event.

Images