Grading processing method and grading processing system for security event

Abstract

The invention relates to a grading processing method and a grading processing system for a security event. The method comprises the following steps: obtaining a security event generated by a security system in real time and storing the security event after analysis, wherein source address information and destination address information are contained in the security event; when set processing timearrives, counting an estimated value of damage degree according to a security grade, the frequency, an address distribution parameter and a configured operation parameter of each security event and confirming the damage grade of the security event according to the obtained estimated value; and processing the security event according to the damage grade of each security event and a mode which corresponds to the damage grade. The grading processing system comprises a security event obtaining device, a security event counting device, a security event estimating device, a security event processingdevice and a storage device which are connected in sequence. The invention can grade the damage degree of a great number of security events and process the security events in time according to a plurality of objective factors.

Description

technical field [0001] The invention relates to a processing method for security events, in particular to a hierarchical processing method for security events. Background technique [0002] Security events are generated by security systems, which refer to application systems that monitor and protect user systems, such as intrusion monitoring, vulnerability scanning, auditing, firewalls, and UTM. [0003] All kinds of network security monitoring and security systems will generate a large number of security alarm events. For example, intrusion detection system (IDS), vulnerability scanning, auditing and other systems are used as security monitoring systems, which can complete any behavior that poses any possible threat to security and alarm, that is, generate security events. However, in actual operation, there are many possible threats. Therefore, in the application of these systems, a large number of security events will be generated, some of which are loopholes, some of wh...

AI Technical Summary

Problems solved by technology

However, this method only refers to the two event parameters of the event safety level and the number of occurrences, which is too simple to carry out a true and objective classification of the degree of hazard of the event, so it cannot be adapted to find the most important and urgent events in actual use and timely Processing requirements may lead to delays in the processing of the most important and urgent security incidents, resulting in significant losses

Images