Security event processing system and method based on computer network information

Abstract

The invention belongs to the technical field of computer security, and discloses a security event processing system and method based on computer network information. The system comprises a network monitoring module, a data acquisition module, a data mining module, a data processing module, a central control module, an information security evaluation module, an event analysis module, an event processing module, a data storage module, an alarm module and a display module. According to the system, most invalid and repeated information in the network security information can be filtered, the information processing efficiency and the information availability are improved, and the security event analysis and processing efficiency is effectively improved; meanwhile, real-time high-speed analysisand merging processing of the security events and presetting of merging logic of the merging events can be achieved, unified management of the security events is facilitated, and the security of computer network information is greatly improved; in addition, the security events are accurately analyzed and processed, and efficient execution of a network security function is ensured.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to a computer network-based information security event processing system and method. Background technique [0002] At present, with the continuous improvement of informatization, network and information security have increasingly become an important part of the network development of various organizations and institutions. Information security has been paid more and more attention by governments at all levels and various industries. Emergency response to information security incidents As the last resort of information security packaging work, it has become more and more important. In the initial stage of information security construction, network security products have begun to be widely used. Traditional information security event processing methods cannot accurately determine the type of security event when an information security event occurs, and cannot kno...

AI Technical Summary

Problems solved by technology

Traditional information security event processing methods cannot accurately determine the type of security event when an information security event occurs, and cannot know the occurrence of a security event at the first time, which makes it difficult to effectively handle security events

[0003] At the same time, there are more and more potential hidden dangers and loopholes in network and information system security, and the subsequent alarm information also increases rapidly, which brings great difficulties to the company's network security operation and maintenance. There are many network devices and complex structures. A large amount of alarm information will be generated; viewing the alarm requires a large workload, which brings great work pressure to the network security operation and maintenance personnel

[0004] Through the above analysis, the existing problems and defects of the existing technology are: the existing security network information is massive, the processing complexity is high, and the processing efficiency is low, which leads to low security event analysis efficiency, cannot accurately determine the type of security event, and cannot be effectively processed

Images