Network disaster recovery emergency response method and system, and device and readable storage medium

Abstract

A network disaster recovery emergency response method, comprising the following steps: deploying a network monitoring tool in a target network, so as to monitor the network in real time; formulating a data backup plan, and executing the data backup plan to periodically back up data; acquiring a backup log and a network monitoring result in real time, and determining whether the network is anomalous; executing emergency response, and handling a network anomaly; and on the basis of the backup log and the backup data, performing data recovery on the anomalous network. By means of monitoring a network in real time, a backup log and a network monitoring result are acquired, and whether the network is anomalous is determined, and thus a network anomaly can be found instantly and a response can be made; a data backup plan is formulated and executed, so as to periodically back up data, thereby ensuring the availability and integrity of the data; and by means of an emergency response measure and a disaster recovery strategy, it can be ensured that enterprises can rapidly restore and sustain business operations in the case of an accident event, thereby reducing risks and economic losses, and protecting enterprise reputation.

Description

A network disaster recovery emergency response method, system, device, and readable storage medium Technical Field

[0001] This invention relates to the field of network security, and in particular to a network disaster recovery emergency response method, system, device, and readable storage medium. Background Technology

[0002] With the rapid development of information technology, the scale of networks continues to expand at an unprecedented rate, from local area networks to wide area networks, and then to the globally covered Internet. Every node is closely connected, forming a vast and complex digital ecosystem. At the same time, the amount of data is also growing explosively, from personal social media information and shopping records to transaction data and customer information in business operations, and even national-level scientific research data and government information. The sheer volume and variety of this data far exceed the scope of traditional data processing and storage capabilities.

[0003] However, the expansion of network scale and the surge in data volume have also brought unprecedented data security challenges. First, the increased number of devices and systems connected to the network means a wider potential attack surface, providing hackers and criminals with more opportunities to exploit system vulnerabilities, malware, phishing attacks, and other means to illegally obtain, tamper with, or destroy sensitive data, posing a serious threat to personal privacy, corporate interests, and even cybersecurity.

[0004] Secondly, the increase in data volume makes data management and protection more complex and difficult. How to accurately identify and effectively protect valuable information from massive amounts of data, while ensuring data integrity, availability, and confidentiality, has become a pressing problem. Furthermore, data may be lost or leaked during transmission, storage, and processing due to technical failures, human error, or natural disasters, further exacerbating data security risks.

[0005] Enterprise network disasters refer to severe impacts on an enterprise's information systems and network infrastructure caused by natural, technological, or human factors. Besides natural disasters and human factors, causes include technical failures and cyberattacks. Network disasters affect business continuity and data security, leading to business terminal and data loss, and even reputational damage. Disasters directly impact an enterprise's operations, economic benefits, and reputation; therefore, early warning, rapid response, and recovery from enterprise network disasters are crucial for the normal operation of the enterprise network. Current technologies for handling enterprise network disasters rely on monitoring network anomalies. However, actual network anomalies in enterprise network disasters encompass aspects such as traffic, accounts, and resource allocation, and cannot achieve comprehensive emergency response and handling for enterprise network disasters. Summary of the Invention

[0006] In view of the current problem that comprehensive emergency response to enterprise network disasters cannot be achieved, this invention provides a network disaster recovery emergency response method. By deploying network monitoring tools for comprehensive real-time network monitoring, and by ensuring data availability and integrity through data backup and regular testing, this method can reduce the risks of enterprise disaster recovery emergency response and reduce economic losses.

[0007] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0008] A network disaster recovery emergency response method, comprising the following steps:

[0009] Deploy network monitoring tools on the target network to monitor the network in real time;

[0010] Develop a data backup plan and execute the plan to back up data regularly.

[0011] Real-time acquisition of backup logs and network monitoring results to determine if the network is abnormal;

[0012] Execute emergency response and handle network anomalies;

[0013] Data recovery is performed on the abnormal network based on backup logs and backup data.

[0014] According to one aspect of the present invention, the real-time monitoring network specifically refers to: real-time monitoring of a target network, wherein the real-time monitoring includes monitoring any one or more of network traffic, account information, malware, resource usage, and data leakage.

[0015] According to one aspect of the present invention, the data backup plan includes: defining data backup types and corresponding data backup frequencies, wherein the data backup types include at least full backup, incremental backup and differential backup, and the data backup frequencies are in ascending order of full backup, differential backup and incremental backup.

[0016] According to one aspect of the invention, the full backup is defined as periodically backing up all data of the target network.

[0017] According to one aspect of the present invention, the incremental backup is defined as periodically acquiring the last backup data, comparing the current data with the last backup data to obtain the changed data, and backing up the changed data.

[0018] According to one aspect of the present invention, the differential backup is defined as periodically obtaining the last full backup data, comparing the current data with the last full backup data to obtain differential data, and backing up the differential data.

[0019] According to one aspect of the present invention, the data backup type further includes a redundancy configuration, which includes data redundancy and geographical redundancy. The data redundancy is achieved through an independent disk redundancy array; the geographical redundancy is achieved through off-site backup and cloud backup.

[0020] According to one aspect of the present invention, the execution of emergency response and handling of network anomalies includes:

[0021] Determine the type, scope, and urgency of network anomalies;

[0022] Determine the processing priority of network anomalies based on their urgency, and respond to network anomalies according to their processing priority;

[0023] Based on the type and scope of the network anomaly, develop and implement a solution to resolve the network anomaly.

[0024] According to one aspect of the present invention, the network disaster recovery emergency response method further includes: periodically conducting data recovery tests.

[0025] According to one aspect of the present invention, the network disaster recovery emergency response method further includes: analyzing the process of performing emergency response and performing data recovery based on the results of network anomaly handling and data recovery, and optimizing the method of handling network anomalies and performing data recovery based on the analysis results.

[0026] A network disaster recovery and emergency response system includes:

[0027] The real-time monitoring module is used to monitor the network in real time through network monitoring tools deployed on the target network.

[0028] The data backup module is used to create data backup plans and execute these plans to back up data periodically.

[0029] The anomaly detection module is used to obtain backup logs and network monitoring results in real time to determine whether the network is abnormal.

[0030] The emergency response module is used to perform emergency responses and handle network anomalies;

[0031] The backup and recovery module is used to recover data from abnormal networks based on backup logs and backup data.

[0032] A network disaster recovery and emergency response device, comprising:

[0033] Memory, used to store computer programs;

[0034] A processor is used to execute the computer program to implement the steps of a network disaster recovery emergency response method as described above.

[0035] A readable storage medium for network disaster recovery emergency response, wherein a computer program is stored on the readable storage medium, and the computer program is executed to perform the steps of a network disaster recovery emergency response method as described above.

[0036] Advantages of this invention: The network disaster recovery emergency response method of this invention includes the following steps: deploying network monitoring tools on the target network to monitor the network in real time; formulating a data backup plan and executing the data backup plan to back up data regularly; obtaining backup logs and network monitoring results in real time to determine if the network is abnormal; executing emergency response to handle network anomalies; and restoring data to the abnormal network based on backup logs and backup data. By deploying network monitoring tools on the target network to monitor the network in real time, obtaining backup logs and network monitoring results, and determining if the network is abnormal, anomalies can be detected and responded to in a timely manner; formulating and executing a data backup plan to back up data regularly, and performing data recovery to the abnormal network based on backup logs and backup data, the availability and integrity of data are ensured; and through emergency response measures and disaster recovery strategies, enterprises can quickly restore and maintain business operations in the event of unexpected events, thereby reducing risks, minimizing economic losses, and maintaining corporate reputation. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 is a flowchart of the network disaster recovery emergency response method according to Embodiment 1 of the present invention;

[0039] Figure 2 is a flowchart of the network disaster recovery emergency response method according to Embodiment 2 of the present invention;

[0040] Figure 3 is a structural diagram of the network disaster recovery emergency response system according to Embodiment 3 of the present invention;

[0041] Figure 4 is a structural diagram of the network disaster recovery emergency response equipment described in Embodiment 4 of the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] Example 1

[0044] As shown in Figure 1, a network disaster recovery emergency response method includes the following steps:

[0045] Step S1: Deploy network monitoring tools on the target network to monitor the network in real time;

[0046] Real-time monitoring of the target network includes monitoring one or more of the following: network traffic, account information, malware, resource usage, and data leakage.

[0047] The common method for monitoring network traffic is to set thresholds, such as alert thresholds or alarm thresholds. When network traffic increases or decreases abnormally, alerts or alarms are triggered based on the threshold reached, allowing for timely detection of network traffic anomalies. Tools commonly used for monitoring network traffic include Wireshark and SolarWinds.

[0048] Monitoring account information involves using an intrusion detection system (IDS) or a security information and event management system (SIEM) to monitor login logs and the number of failed login attempts, identifying abnormal login behavior or excessive login failures as account anomalies.

[0049] The method for monitoring malware is to use antivirus software or endpoint detection and corresponding tools (EDR) to scan for and detect malware or suspicious file activity;

[0050] The method of monitoring resource usage is to use monitoring tools such as Nagios and Zabbix to monitor the usage of CPU, memory and disk, and to set thresholds to detect whether resource usage exceeds the thresholds, thereby determining whether there are abnormal resource usage situations.

[0051] One method to monitor data breaches is to use a Data Loss Prevention (DLP) system to monitor data transfer and file access activities, and to detect any abnormal transmission of sensitive data.

[0052] In practical applications, in addition to deploying network monitoring tools, to improve the efficiency of network disaster recovery and emergency response, an emergency response team composed of IT departments, security departments, and management can be established. The responsibilities of each person and department in the team should be clearly defined, and the deployed network monitoring tools should be utilized to the maximum extent to achieve real-time network monitoring.

[0053] Step S2: Develop a data backup plan and execute the data backup plan to back up data regularly;

[0054] The backup plan includes backup strategy, backup window and storage location; it defines data backup types and corresponding data backup frequencies, wherein the data backup types include at least full backup, incremental backup and differential backup;

[0055] The backup strategy involves selecting the backup method and determining the backup frequency based on the characteristics of full backup, incremental backup, and differential backup. The data backup frequency, from low to high, is full backup, differential backup, and incremental backup. The backup window is the time when the system load is handed over to perform the backup, so as to avoid affecting the operation of normal business. The storage location is the selection of a suitable backup storage medium, which can be disk, tape, cloud storage, etc.

[0056] Data backup utilizes automated backup software to reduce manual intervention and improve backup efficiency. Backups can employ data deduplication algorithms to detect and remove duplicate data blocks, reducing backup storage requirements. Compression algorithms, such as LZ77, LZ78, and LZW, can be used to compress data before backup, further reducing storage space requirements. Encryption algorithms are used to encrypt backup data, ensuring data security during transmission and storage. Commonly used algorithms include Advanced Encryption Standard (AES) and Asymmetric Encryption (RSA). These strategies and algorithms help enterprises effectively perform data backup and redundancy configurations, ensuring rapid data and business recovery in the event of a disaster.

[0057] Full backup is defined as periodically backing up all data on the target network. The advantage of full backup is that it is the fastest to restore, but it requires a large amount of storage space and takes a long time. Generally, the algorithm to achieve full backup is the data block copying algorithm, which completely copies the data source to the backup target to achieve backup.

[0058] Incremental backup is defined as periodically retrieving the data from the last backup, comparing the current data with the last backup to identify changes, and then backing up the changed data. The advantages of incremental backup are its small footprint and fast backup speed. However, recovery requires applying each incremental backup sequentially from the most recent full backup, resulting in a longer recovery time. It typically uses hash comparison algorithms, such as the SHA-256 hash fingerprint algorithm (which detects duplicate data by comparing the fingerprints of data blocks), to determine whether the current version has changed compared to the previous backup by comparing the hash values ​​of files or data blocks.

[0059] Differential backup is defined as periodically retrieving the last full backup data, comparing the current data with the last full backup data to obtain the differences, and then backing up the differences. Differential backup recovery time is shorter than incremental backup recovery time, and its storage space is smaller than full backup, but larger than incremental backup. Furthermore, the backup time and storage space required will increase over time. Differential backup also uses a hash comparison algorithm, but the difference lies in the backup scope; differential backup backs up all changes since the last full backup.

[0060] Data backup types also include redundancy configurations, which include data redundancy and geographical redundancy.

[0061] Data redundancy is achieved through independent disk redundancy arrays (RAID), such as RAID1, RAID5, and RAID6. Among them, RAID1 is a mirror backup, writing each piece of data to two disks; RAID5 distributes data and parity information across multiple disks; and RAID6 adds a parity block to RAID5, which can tolerate the failure of two disks.

[0062] Geographic redundancy achieves data redundancy through off-site backup and cloud backup; off-site backup involves backing up data to different geographical locations to prevent data loss caused by local disasters such as fires and floods; cloud backup utilizes cloud storage service providers to back up data to the cloud to ensure high availability and security of data.

[0063] Step S3: Obtain backup logs and network monitoring results in real time to determine if the network is abnormal;

[0064] After each different type of data backup, a backup log is recorded and generated. The backup status is monitored through the backup log, and the target network is monitored in real time through network monitoring tools. The backup log and network monitoring results are obtained in real time to ensure that problems can be discovered and resolved in a timely manner.

[0065] In addition, once an anomaly is detected in the target network, it can automatically respond and issue alerts via email, SMS, system pop-ups, etc., to provide timely reminders.

[0066] Step S4: Execute emergency response and handle network anomalies;

[0067] Step S41: Determine the anomaly type, scope of impact, and urgency of the network anomaly;

[0068] Network anomaly types include abnormal network traffic, abnormal account information, malware, abnormal resource usage, and abnormal data leakage.

[0069] By analyzing backup logs and network monitoring results, the type of network anomaly can be determined, and further analysis based on the anomaly type can reveal the scope and urgency of the network anomaly.

[0070] Step S42: Determine the processing priority of the network anomaly based on its urgency, and respond to the network anomaly according to the processing priority;

[0071] The priority of handling network anomalies is determined based on their urgency. Network anomalies with higher urgency are assigned higher priority, and network anomalies are responded to from high to low priority.

[0072] Furthermore, it can determine the priority of network anomalies by combining the anomaly type and the scope of impact, set weights for anomaly type, scope of impact and urgency, and calculate the priority of network anomalies by comprehensively calculating the weights.

[0073] Step S43: Based on the anomaly type and scope of impact of the network anomaly, formulate and implement a solution to resolve the network anomaly.

[0074] Based on the type of network anomaly, develop and implement solutions. Solutions include emergency response and post-incident recovery; common emergency response methods include the following:

[0075] When network traffic is abnormal, determine whether the traffic is abnormally high or abnormally low. If the traffic is abnormally high, implement rate limiting; if the traffic is abnormally low, optimize network configuration to resolve the traffic abnormality.

[0076] Lock the abnormal account when account information is abnormal;

[0077] When maliciously attacked, isolate the attacked or infected system to prevent the situation from escalating and clean up malware;

[0078] When resource usage is abnormal, investigate the cause of the abnormality and resolve the abnormality;

[0079] In addition, there are other methods such as vulnerability repair.

[0080] Based on the scope of the network anomaly, resolve the network anomaly within the affected area using the established solutions.

[0081] Step S5: Based on the backup logs and backup data, perform data recovery for the abnormal network;

[0082] After handling the network anomaly, it is necessary to perform data recovery operations on the abnormal network, restore the affected system from the backup, and ensure data integrity and normal system operation.

[0083] In addition, to ensure the validity of backup data and the feasibility of recovery operations, data recovery tests need to be performed regularly.

[0084] Disaster recovery plans can be specified, clearly defining recovery strategies for critical business systems and data. For example, based on the type and scope of the network anomaly, the parts that need to be recovered and the order of recovery can be determined.

[0085] To ensure business continuity, a backup system can be set up. When a network failure occurs, the system can be switched to the backup system, and then switched back to the original system after the network failure is resolved.

[0086] This embodiment provides a network disaster recovery emergency response method. By deploying network monitoring tools on the target network, it monitors the network in real time, obtains backup logs and network monitoring results, determines whether the network is abnormal, and can promptly detect and respond to anomalies. It formulates and executes a data backup plan, regularly backs up data, and performs data recovery on abnormal networks based on backup logs and backup data, ensuring data availability and integrity. Through emergency response measures and disaster recovery strategies, it ensures that enterprises can quickly restore and maintain business operations in the event of unexpected incidents, thereby reducing risks, minimizing economic losses, and protecting corporate reputation.

[0087] Example 2

[0088] As shown in Figure 2, a network disaster recovery emergency response method includes the following steps:

[0089] Step S1: Deploy network monitoring tools on the target network to monitor the network in real time;

[0090] Real-time monitoring of the target network includes monitoring one or more of the following: network traffic, account information, malware, resource usage, and data leakage.

[0091] The common method for monitoring network traffic is to set thresholds, such as alert thresholds or alarm thresholds. When network traffic increases or decreases abnormally, alerts or alarms are triggered based on the threshold reached, allowing for timely detection of network traffic anomalies. Tools commonly used for monitoring network traffic include Wireshark and SolarWinds.

[0092] Monitoring account information involves using an intrusion detection system (IDS) or a security information and event management system (SIEM) to monitor login logs and the number of failed login attempts, identifying abnormal login behavior or excessive login failures as account anomalies.

[0093] The method for monitoring malware is to use antivirus software or endpoint detection and corresponding tools (EDR) to scan for and detect malware or suspicious file activity;

[0094] The method of monitoring resource usage is to use monitoring tools such as Nagios and Zabbix to monitor the usage of CPU, memory and disk, and to set thresholds to detect whether resource usage exceeds the thresholds, thereby determining whether there are abnormal resource usage situations.

[0095] One method to monitor data breaches is to use a Data Loss Prevention (DLP) system to monitor data transfer and file access activities, and to detect any abnormal transmission of sensitive data.

[0096] In practical applications, in addition to deploying network monitoring tools, to improve the efficiency of network disaster recovery and emergency response, an emergency response team composed of IT departments, security departments, and management can be established. The responsibilities of each person and department in the team should be clearly defined, and the deployed network monitoring tools should be utilized to the maximum extent to achieve real-time network monitoring.

[0097] Step S2: Develop a data backup plan and execute the data backup plan to back up data regularly;

[0098] The backup plan includes backup strategy, backup window and storage location; it defines data backup types and corresponding data backup frequencies, wherein the data backup types include at least full backup, incremental backup and differential backup;

[0099] The backup strategy involves selecting the backup method and determining the backup frequency based on the characteristics of full backup, incremental backup, and differential backup. The data backup frequency, from low to high, is full backup, differential backup, and incremental backup. The backup window is the time when the system load is handed over to perform the backup, so as to avoid affecting the operation of normal business. The storage location is the selection of a suitable backup storage medium, which can be disk, tape, cloud storage, etc.

[0100] Data backup utilizes automated backup software to reduce manual intervention and improve backup efficiency. Backups can employ data deduplication algorithms to detect and remove duplicate data blocks, reducing backup storage requirements. Compression algorithms, such as LZ77, LZ78, and LZW, can be used to compress data before backup, further reducing storage space requirements. Encryption algorithms are used to encrypt backup data, ensuring data security during transmission and storage. Commonly used algorithms include Advanced Encryption Standard (AES) and Asymmetric Encryption (RSA). These strategies and algorithms help enterprises effectively perform data backup and redundancy configurations, ensuring rapid data and business recovery in the event of a disaster.

[0101] Full backup is defined as periodically backing up all data on the target network. The advantage of full backup is that it is the fastest to restore, but it requires a large amount of storage space and takes a long time. Generally, the algorithm to achieve full backup is the data block copying algorithm, which completely copies the data source to the backup target to achieve backup.

[0102] Incremental backup is defined as periodically retrieving the data from the last backup, comparing the current data with the last backup to identify changes, and then backing up the changed data. The advantages of incremental backup are its small footprint and fast backup speed. However, recovery requires applying each incremental backup sequentially from the most recent full backup, resulting in a longer recovery time. It typically uses hash comparison algorithms, such as the SHA-256 hash fingerprint algorithm (which detects duplicate data by comparing the fingerprints of data blocks), to determine whether the current version has changed compared to the previous backup by comparing the hash values ​​of files or data blocks.

[0103] Differential backup is defined as periodically retrieving the last full backup data, comparing the current data with the last full backup data to obtain the differences, and then backing up the differences. Differential backup recovery time is shorter than incremental backup recovery time, and its storage space is smaller than full backup, but larger than incremental backup. Furthermore, the backup time and storage space required will increase over time. Differential backup also uses a hash comparison algorithm, but the difference lies in the backup scope; differential backup backs up all changes since the last full backup.

[0104] Data backup types also include redundancy configurations, which include data redundancy and geographical redundancy.

[0105] Data redundancy is achieved through independent disk redundancy arrays (RAID), such as RAID1, RAID5, and RAID6. Among them, RAID1 is a mirror backup, writing each piece of data to two disks; RAID5 distributes data and parity information across multiple disks; and RAID6 adds a parity block to RAID5, which can tolerate the failure of two disks.

[0106] Geographic redundancy achieves data redundancy through off-site backup and cloud backup; off-site backup involves backing up data to different geographical locations to prevent data loss caused by local disasters such as fires and floods; cloud backup utilizes cloud storage service providers to back up data to the cloud to ensure high availability and security of data.

[0107] Step S3: Obtain backup logs and network monitoring results in real time to determine if the network is abnormal;

[0108] After each different type of data backup, a backup log is recorded and generated. The backup status is monitored through the backup log, and the target network is monitored in real time through network monitoring tools. The backup log and network monitoring results are obtained in real time to ensure that problems can be discovered and resolved in a timely manner.

[0109] In addition, once an anomaly is detected in the target network, it can automatically respond and issue alerts via email, SMS, system pop-ups, etc., to provide timely reminders.

[0110] Step S4: Execute emergency response and handle network anomalies;

[0111] Step S41: Determine the anomaly type, scope of impact, and urgency of the network anomaly;

[0112] Network anomaly types include abnormal network traffic, abnormal account information, malware, abnormal resource usage, and abnormal data leakage.

[0113] By analyzing backup logs and network monitoring results, the type of network anomaly can be determined, and further analysis based on the anomaly type can reveal the scope and urgency of the network anomaly.

[0114] Step S42: Determine the processing priority of the network anomaly based on its urgency, and respond to the network anomaly according to the processing priority;

[0115] The priority of handling network anomalies is determined based on their urgency. Network anomalies with higher urgency are assigned higher priority, and network anomalies are responded to from high to low priority.

[0116] Furthermore, it can determine the priority of network anomalies by combining the anomaly type and the scope of impact, set weights for anomaly type, scope of impact and urgency, and calculate the priority of network anomalies by comprehensively calculating the weights.

[0117] Step S43: Based on the anomaly type and scope of impact of the network anomaly, formulate and implement a solution to resolve the network anomaly.

[0118] Based on the type of network anomaly, develop and implement solutions. Solutions include emergency response and post-incident recovery; common emergency response methods include the following:

[0119] When network traffic is abnormal, determine whether the traffic is abnormally high or abnormally low. If the traffic is abnormally high, implement rate limiting; if the traffic is abnormally low, optimize network configuration to resolve the traffic abnormality.

[0120] Lock the abnormal account when account information is abnormal;

[0121] When maliciously attacked, isolate the attacked or infected system to prevent the situation from escalating and clean up malware;

[0122] When resource usage is abnormal, investigate the cause of the abnormality and resolve the abnormality;

[0123] In addition, there are other methods such as vulnerability repair.

[0124] Based on the scope of the network anomaly, resolve the network anomaly within the affected area using the established solutions.

[0125] Step S5: Based on the backup logs and backup data, perform data recovery for the abnormal network;

[0126] After handling the network anomaly, it is necessary to perform data recovery operations on the abnormal network, restore the affected system from the backup, and ensure data integrity and normal system operation.

[0127] In addition, to ensure the validity of backup data and the feasibility of recovery operations, data recovery tests need to be performed regularly.

[0128] Disaster recovery plans can be specified, clearly defining recovery strategies for critical business systems and data. For example, based on the type and scope of the network anomaly, the parts that need to be recovered and the order of recovery can be determined.

[0129] To ensure business continuity, a backup system can be set up. When a network failure occurs, the system can be switched to the backup system, and then switched back to the original system after the network failure is resolved.

[0130] Step S6: Based on the results of network anomaly handling and data recovery, analyze the process of performing emergency response and data recovery, and optimize the methods for handling network anomalies and performing data recovery based on the analysis results.

[0131] Based on Example 1, this embodiment analyzes and optimizes the process and methods of disaster recovery response and data recovery, analyzes the causes, impacts and response processes of events, improves the emergency response plan, analyzes the disaster recovery process, improves the disaster recovery plan, enhances system resilience, and can further improve the efficiency of handling network anomalies and recovering data.

[0132] Example 3

[0133] As shown in Figure 3, a network disaster recovery and emergency response system 2 includes:

[0134] Real-time monitoring module 21 is used to monitor the network in real time through network monitoring tools deployed on the target network;

[0135] Data backup module 22 is used to formulate a data backup plan and execute the data backup plan to back up data periodically;

[0136] The anomaly detection module 23 is used to obtain backup logs and network monitoring results in real time to determine whether the network is abnormal;

[0137] Emergency response module 24 is used to perform emergency response and handle the network anomaly;

[0138] The backup and recovery module 25 is used to recover data from abnormal networks based on backup logs and backup data.

[0139] In practical applications, network emergency response and disaster recovery systems also include an analysis and optimization module, which is used to analyze the process of executing emergency response and data recovery based on the results of network anomaly handling and data recovery, and optimize the methods of handling network anomalies and performing data recovery based on the analysis results.

[0140] The emergency response module includes an anomaly detection module, a priority module, and an anomaly resolution module. The anomaly detection module is used to determine the anomaly type, scope of impact, and urgency of the network anomaly. The priority module is used to determine the processing priority of the network anomaly based on its urgency and respond to the network anomaly according to the processing priority. The anomaly resolution module is used to formulate and execute solutions to resolve the network anomaly based on its anomaly type and scope of impact.

[0141] Example 4

[0142] As shown in Figure 4, a network disaster recovery and emergency response device includes:

[0143] Memory 100 is used to store computer programs;

[0144] The processor 200 is used to execute the computer program to implement the steps of a network disaster recovery emergency response method as described in Embodiment 1 and Embodiment 2.

[0145] Example 5

[0146] A readable storage medium for network disaster recovery emergency response is provided, wherein a computer program is stored on the readable storage medium, and the computer program executes the steps of a network disaster recovery emergency response method as described in Embodiment 1 and Embodiment 2.

[0147] The present invention can be a system, method, and / or computer program product. The computer program product may comprise a computer-readable storage medium (or medium) having computer-readable program instructions thereon for causing a processor to perform aspects of the invention.

[0148] A computer-readable storage medium is a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital universal disc (DVD), memory sticks, floppy disks, mechanical encoding devices (such as punched cards or raised structures in grooves having instructions recorded thereon), and any suitable combination of the foregoing.

[0149] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device or via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network) to an external computer or external storage device. The network may include copper transmission cables, optical fiber transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the suitable computing / processing device.

[0150] The computer program described herein is a computer-readable program instruction that can be downloaded from a computer-readable storage medium to a corresponding computing / processing device or via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network) to an external computer or external storage device. The network may include copper transmission cables, optical fiber transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instruction from the network and forwards it to a computer-readable storage medium within the corresponding computing / processing device.

[0151] The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet through an Internet service provider). In some embodiments, electronic circuitry (including, for example, programmable logic circuitry, a field-programmable gate array (FPGA), or a programmable logic array (PLA)) may execute the computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry in order to perform aspects of the invention.

[0152] Aspects of the invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, systems, apparatuses, and computer program products according to embodiments of the invention. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0153] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, which executes via the processor of the computer or other programmable data processing apparatus, creating means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium capable of instructing a computer, a programmable data processing apparatus, and / or other devices that function in a particular manner, such that the computer-readable storage medium having the instructions stored therein includes an article of writing comprising instructions for implementing aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0154] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A network disaster recovery emergency response method, characterized in that, The network disaster recovery emergency response method includes the following steps: Deploy network monitoring tools on the target network to monitor the network in real time; Develop a data backup plan and execute the plan to back up data regularly. Real-time acquisition of backup logs and network monitoring results to determine if the network is abnormal; Execute emergency response and handle network anomalies; Data recovery is performed on the abnormal network based on backup logs and backup data.

2. The network disaster recovery emergency response method according to claim 1, characterized in that, The real-time monitoring network specifically refers to the real-time monitoring of the target network, which includes monitoring any one or more of the following: network traffic, account information, malware, resource usage, and data leakage.

3. The network disaster recovery emergency response method according to claim 1, characterized in that, The process of developing a data backup plan includes defining data backup types and corresponding data backup frequencies. The data backup types include at least full backup, incremental backup, and differential backup. The data backup frequencies, from low to high, are full backup, differential backup, and incremental backup.

4. The network disaster recovery emergency response method according to claim 3, characterized in that, The full backup is defined as periodically backing up all data on the target network.

5. The network disaster recovery emergency response method according to claim 3, characterized in that, The incremental backup is defined as periodically obtaining the last backup data, comparing the current data with the last backup data to obtain the changed data, and backing up the changed data.

6. The network disaster recovery emergency response method according to claim 3, characterized in that, The differential backup is defined as periodically obtaining the last full backup data, comparing the current data with the last full backup data to obtain the differential data, and backing up the differential data.

7. The network disaster recovery emergency response method according to claim 3, characterized in that, The data backup type also includes redundancy configuration, which includes data redundancy and geographical redundancy. Data redundancy is achieved through independent disk redundancy arrays; geographical redundancy is achieved through off-site backup and cloud backup.

8. The network disaster recovery emergency response method according to claim 1, characterized in that, The execution of emergency response and handling of network anomalies includes: determining the anomaly type, scope of impact, and urgency of the network anomaly; Determine the processing priority of network anomalies based on their urgency, and respond to network anomalies according to their processing priority; Based on the type and scope of the network anomaly, develop and implement a solution to resolve the network anomaly.

9. The network disaster recovery emergency response method according to claim 1, characterized in that, The network disaster recovery emergency response method also includes: conducting data recovery tests regularly.

10. The network disaster recovery emergency response method according to claim 1, characterized in that, The network disaster recovery emergency response method further includes: analyzing the process of executing the emergency response and the process of executing the data recovery based on the results of network anomaly handling and data recovery, and optimizing the methods of handling network anomalies and executing data recovery based on the analysis results.

11. A network disaster recovery and emergency response system, characterized in that, The network disaster recovery and emergency response system includes: The real-time monitoring module is used to monitor the network in real time through network monitoring tools deployed on the target network. The data backup module is used to create data backup plans and execute these plans to back up data periodically. The anomaly detection module is used to obtain backup logs and network monitoring results in real time to determine whether the network is abnormal. The emergency response module is used to perform emergency responses and handle network anomalies; The backup and recovery module is used to recover data from abnormal networks based on backup logs and backup data.

12. A network disaster recovery and emergency response device, characterized in that, include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of a network disaster recovery emergency response method as described in any one of claims 1-10.

13. A readable storage medium for network disaster recovery emergency response, characterized in that, The readable storage medium stores a computer program that executes the steps of a network disaster recovery emergency response method as described in any one of claims 1-10.