Workflow node processing method and system applied to network security environment

Abstract

The invention provides a workflow node processing method and system applied to a network security environment, and the method comprises the steps: deleting flows, which do not meet the flow matching degree, in a flow resource library from the flow resource library, constructing a candidate flow set, and finding a flow, which meets the given flow matching degree with a recommended flow p, in the candidate flow set; extracting a flow path taking end node of flow p as a starting node from each found flow to serve as a recommended flow path, and forming a recommended flow path set, thereby achieving disposal of workflow nodes. According to the invention, the diversity of the processes is met, the method and the system are suitable for complex and diverse process scenes, and the execution efficiency is high through a breadth-first search algorithm. Moreover, the method has intelligent matching performance, the process does not need to be realized through tedious solidification, and the efficiency of automatic matching and dynamic adjustment of event handling process nodes is greatly improved. The method is not limited to the current network security environment, and can be abstractly used in a more generalized scene.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a workflow node processing method and system applied to a network security environment. Background technique [0002] Big data in the network security environment has a great diversity of data types, such as virus killing, identity authentication, operation and maintenance monitoring, etc. There are hundreds of different sub-categories of security events, so the processing of such diverse security events is closed Different procedures are bound to be used, which in turn involves personnel of various roles in different units and departments. [0003] The business processes of traditional businesses may be large in number, but most of them have single scenarios and types, and the whole is not complicated. Most of the nodes and levels are fixed or do not change much. For example, several fixed roles are configured, and the processes flow during the period, and the diversity...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a workflow node disposal method and system applied in a network security environment, aiming to solve the problem of low efficiency of workflow node event disposal in the prior art, and realize automatic matching and dynamic adjustment of event disposal process nodes s efficiency

Images