Acquisition agent deployment method and device

Abstract

The invention provides an acquisition agent deployment method and an acquisition agent deployment device. The method comprises the steps of constructing a threat-acquisition tree of a network according to a target network-data service library, a data service-potential threat event attribute library, a threat event-feature beacon library and an acquisition agent-threat detection atomic data item library; for any potential threat event, obtaining a risk value of the potential threat event according to the confidence degree of the potential threat event monitored by the acquisition agent and theinfluence of the potential threat event; determining whether each equipment node is a risk point or not according to the risk value of each potential threat event and the threat-acquisition tree; anddeploying the acquisition agent on the risk point according to the risk point in the network, the acquisition capability of the acquisition agent and a preset constraint condition. According to the invention, the data acquisition capability is improved, and resources consumed by data acquisition and analysis are reduced.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a collection agent deployment method and device. Background technique [0002] There are a large number of important devices and systems in large-scale and complex information networks. In order to monitor the operating status of these devices and systems and discover potential threats in time, it is necessary to deploy collection agents to collect the operating status of devices and systems and the massive data and logs they generate. [0003] The existing collection agent deployment scheme mainly deploys collection agents on nodes such as data generation and aggregation. Existing deployment methods mainly consider factors such as network topology or deployment cost, and generally use methods such as mirroring to achieve data collection. However, this collection agent deployment method is not suitable for large-scale complex information networks, because th...

AI Technical Summary

Problems solved by technology

[0005] In order to overcome the problem of over-collection or under-collection easily caused by the above-mentioned existing collection agent deployment method, or at least partially solve the above-mentioned problems, embodiments of the present invention provide a collection agent deployment method and device

Images