Distributed information security operation and maintenance management platform based on massive data

Abstract

The invention discloses a distributed information security operation and maintenance management platform based on massive data. The distributed information security operation and maintenance management platform supports a single-user mode and a multi-user mode and comprises a customer service module, a security operation and maintenance management module, an acquisition terminal module, a distributed storage module and a security operation and maintenance APP store module. In the multi-user mode, the security operation and maintenance management module of each enterprise is autonomous; and one customer service module can simultaneously provide security operation and maintenance management services for a plurality of enterprises. APPs provided by the security operation and maintenance APP store on the platform include those cooperating with various information security operation and maintenance service providers together; and the distributed information security operation and maintenance management platform is convenient for users to use and can help the enterprises to rapidly position and solve problems.

Description

technical field [0001] The present invention relates to the fields of information security, network management, business management, data exchange platform and big data technology, and in particular to a method and system for a distributed information security operation and maintenance management platform architecture. Background technique [0002] The English abbreviation included in the present invention is as follows: [0003] SOC: SecurityOperationCenter Security Management Center [0004] IDS: IntrusionDetectionSystems intrusion detection system [0005] MIS: Management Information System Management Information System [0006] DMZ: demilitarizedzone isolation area, or demilitarized area [0007] APP: Application application [0008] SNMP: SimpleNetworkManagementProtocol Simple Network Management Protocol [0009] HDFS: HadoopDistributeFileSystemHadoop Distributed File System [0010] ODBC: OpenDatabaseConnectivity open database interconnection [0011] WMI: Windo...

AI Technical Summary

Problems solved by technology

[0022] 1. There are many types of information security products and network equipment, widely distributed, and lack of unified data analysis and management;

[0023] 2. The knowledge base of information security products and network equipment is not unified, and there is a lack of unified solutions;

[0024] 3. Safety responsibilities are unclear, and specific responsibilities have not been implemented;

[0025] 4. Information security operation and maintenance management assessment is not detailed, lacking some necessary and key indicators;

[0026] 5. There is a lack of more advanced intelligent analysis and aggregation correlation between events of different security devices or even events of the same security device, resulting in a huge amount of data, making it difficult to analyze and discover potential safety hazards, so as to prevent problems before they happen;

[0027] 6. Information security incidents are not reported in time, fault diagnosis is not timely, processing efficiency is low, and the effect is poor;

[0028] 7. Information security incidents and asset vulnerabilities have not been correlatively analyzed, resulting in no further analysis and processing of many incidents;

[0033] The above-mentioned problems exist to varying degrees in the business and network that the enterprise has built, which will become an obstacle to the stable improvement of the enterprise's business security operation and maintenance management in the future

Images