CN105847029A - 一种基于大数据分析的信息安全事件自动关联及快速响应的方法及*** - Google Patents
一种基于大数据分析的信息安全事件自动关联及快速响应的方法及*** Download PDFInfo
- Publication number
- CN105847029A CN105847029A CN201610130328.4A CN201610130328A CN105847029A CN 105847029 A CN105847029 A CN 105847029A CN 201610130328 A CN201610130328 A CN 201610130328A CN 105847029 A CN105847029 A CN 105847029A
- Authority
- CN
- China
- Prior art keywords
- alarm
- meta
- alarms
- module
- information security
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 34
- 230000004044 response Effects 0.000 title claims abstract description 25
- 238000007405 data analysis Methods 0.000 title claims abstract description 17
- 238000010219 correlation analysis Methods 0.000 claims abstract description 31
- 238000004458 analytical method Methods 0.000 claims abstract description 14
- 230000008439 repair process Effects 0.000 claims abstract description 4
- 238000004422 calculation algorithm Methods 0.000 claims description 9
- 238000005065 mining Methods 0.000 claims description 7
- 230000008569 process Effects 0.000 claims description 7
- 238000004445 quantitative analysis Methods 0.000 claims description 5
- 239000000284 extract Substances 0.000 claims description 4
- 230000002159 abnormal effect Effects 0.000 claims description 2
- 238000001514 detection method Methods 0.000 abstract description 6
- 238000005516 engineering process Methods 0.000 description 7
- 238000012098 association analyses Methods 0.000 description 6
- 238000012217 deletion Methods 0.000 description 4
- 230000037430 deletion Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 238000003780 insertion Methods 0.000 description 4
- 230000037431 insertion Effects 0.000 description 4
- 238000012423 maintenance Methods 0.000 description 4
- 238000007726 management method Methods 0.000 description 4
- 238000012545 processing Methods 0.000 description 3
- 241000764238 Isis Species 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 2
- 230000000875 corresponding effect Effects 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 238000013024 troubleshooting Methods 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000007621 cluster analysis Methods 0.000 description 1
- 230000002596 correlated effect Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000002955 isolation Methods 0.000 description 1
- 238000000691 measurement method Methods 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000011002 quantification Methods 0.000 description 1
- 239000011541 reaction mixture Substances 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- PUZPDOWCWNUUKD-UHFFFAOYSA-M sodium fluoride Chemical compound [F-].[Na+] PUZPDOWCWNUUKD-UHFFFAOYSA-M 0.000 description 1
- 238000012549 training Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
- 238000012800 visualization Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Alarm Systems (AREA)
Abstract
Description
Claims (14)
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201510565165 | 2015-09-08 | ||
CN2015105651658 | 2015-09-08 |
Publications (2)
Publication Number | Publication Date |
---|---|
CN105847029A true CN105847029A (zh) | 2016-08-10 |
CN105847029B CN105847029B (zh) | 2019-08-09 |
Family
ID=56586983
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201610130328.4A Active CN105847029B (zh) | 2015-09-08 | 2016-03-09 | 一种基于大数据的信息安全事件自动关联及快速响应*** |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN105847029B (zh) |
Cited By (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN106254125A (zh) * | 2016-08-18 | 2016-12-21 | 南京联成科技发展有限公司 | 基于大数据的安全事件相关性分析的方法及*** |
CN107332717A (zh) * | 2017-08-16 | 2017-11-07 | 南京联成科技发展股份有限公司 | 一种新型安全智慧平台的实现架构 |
CN107479518A (zh) * | 2017-08-16 | 2017-12-15 | 南京联成科技发展股份有限公司 | 一种自动生成告警关联规则的方法及*** |
CN108829794A (zh) * | 2018-06-04 | 2018-11-16 | 北京交通大学 | 基于区间图的告警分析方法 |
CN109064179A (zh) * | 2018-07-11 | 2018-12-21 | 成都理工大学 | 移动支付安全态势感知*** |
CN109660526A (zh) * | 2018-12-05 | 2019-04-19 | 国网江西省电力有限公司信息通信分公司 | 一种应用于信息安全领域的大数据分析方法 |
CN109995561A (zh) * | 2017-12-30 | 2019-07-09 | ***通信集团福建有限公司 | 通信网络故障定位的方法、装置、设备及介质 |
CN110149230A (zh) * | 2019-05-20 | 2019-08-20 | 拉扎斯网络科技(上海)有限公司 | 服务维护方法、装置、电子设备及可读存储介质 |
CN110933101A (zh) * | 2019-12-10 | 2020-03-27 | 腾讯科技(深圳)有限公司 | 安全事件日志处理方法、装置及存储介质 |
CN111126729A (zh) * | 2018-10-30 | 2020-05-08 | 千寻位置网络有限公司 | 智能化的安全事件闭环处置***及其方法 |
CN111224973A (zh) * | 2019-12-31 | 2020-06-02 | 南京联成科技发展股份有限公司 | 一种基于工业云的网络攻击快速检测*** |
CN112118141A (zh) * | 2020-09-21 | 2020-12-22 | 中山大学 | 面向通信网络的告警事件关联压缩方法及装置 |
CN113377623A (zh) * | 2021-07-02 | 2021-09-10 | 华青融天(北京)软件股份有限公司 | 告警规则的自动生成方法、装置和电子设备 |
CN113901452A (zh) * | 2021-09-30 | 2022-01-07 | 中国电子科技集团公司第十五研究所 | 一种基于信息熵的子图模糊匹配安全事件识别方法 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070289013A1 (en) * | 2006-06-08 | 2007-12-13 | Keng Leng Albert Lim | Method and system for anomaly detection using a collective set of unsupervised machine-learning algorithms |
CN101610174A (zh) * | 2009-07-24 | 2009-12-23 | 深圳市永达电子股份有限公司 | 一种日志关联分析***与方法 |
CN101697545A (zh) * | 2009-10-29 | 2010-04-21 | 成都市华为赛门铁克科技有限公司 | 安全事件关联方法、装置及网络服务器 |
CN101296122B (zh) * | 2008-06-23 | 2011-04-20 | 中兴通讯股份有限公司 | 告警相关性的分析方法和装置 |
-
2016
- 2016-03-09 CN CN201610130328.4A patent/CN105847029B/zh active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070289013A1 (en) * | 2006-06-08 | 2007-12-13 | Keng Leng Albert Lim | Method and system for anomaly detection using a collective set of unsupervised machine-learning algorithms |
CN101296122B (zh) * | 2008-06-23 | 2011-04-20 | 中兴通讯股份有限公司 | 告警相关性的分析方法和装置 |
CN101610174A (zh) * | 2009-07-24 | 2009-12-23 | 深圳市永达电子股份有限公司 | 一种日志关联分析***与方法 |
CN101697545A (zh) * | 2009-10-29 | 2010-04-21 | 成都市华为赛门铁克科技有限公司 | 安全事件关联方法、装置及网络服务器 |
Cited By (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN106254125A (zh) * | 2016-08-18 | 2016-12-21 | 南京联成科技发展有限公司 | 基于大数据的安全事件相关性分析的方法及*** |
CN107332717A (zh) * | 2017-08-16 | 2017-11-07 | 南京联成科技发展股份有限公司 | 一种新型安全智慧平台的实现架构 |
CN107479518A (zh) * | 2017-08-16 | 2017-12-15 | 南京联成科技发展股份有限公司 | 一种自动生成告警关联规则的方法及*** |
CN109995561B (zh) * | 2017-12-30 | 2022-03-29 | ***通信集团福建有限公司 | 通信网络故障定位的方法、装置、设备及介质 |
CN109995561A (zh) * | 2017-12-30 | 2019-07-09 | ***通信集团福建有限公司 | 通信网络故障定位的方法、装置、设备及介质 |
CN108829794A (zh) * | 2018-06-04 | 2018-11-16 | 北京交通大学 | 基于区间图的告警分析方法 |
CN108829794B (zh) * | 2018-06-04 | 2022-04-12 | 北京交通大学 | 基于区间图的告警分析方法 |
CN109064179A (zh) * | 2018-07-11 | 2018-12-21 | 成都理工大学 | 移动支付安全态势感知*** |
CN109064179B (zh) * | 2018-07-11 | 2022-05-20 | 成都理工大学 | 移动支付安全态势感知*** |
CN111126729A (zh) * | 2018-10-30 | 2020-05-08 | 千寻位置网络有限公司 | 智能化的安全事件闭环处置***及其方法 |
CN109660526A (zh) * | 2018-12-05 | 2019-04-19 | 国网江西省电力有限公司信息通信分公司 | 一种应用于信息安全领域的大数据分析方法 |
CN110149230A (zh) * | 2019-05-20 | 2019-08-20 | 拉扎斯网络科技(上海)有限公司 | 服务维护方法、装置、电子设备及可读存储介质 |
CN110933101A (zh) * | 2019-12-10 | 2020-03-27 | 腾讯科技(深圳)有限公司 | 安全事件日志处理方法、装置及存储介质 |
CN110933101B (zh) * | 2019-12-10 | 2022-11-04 | 腾讯科技(深圳)有限公司 | 安全事件日志处理方法、装置及存储介质 |
CN111224973A (zh) * | 2019-12-31 | 2020-06-02 | 南京联成科技发展股份有限公司 | 一种基于工业云的网络攻击快速检测*** |
CN112118141A (zh) * | 2020-09-21 | 2020-12-22 | 中山大学 | 面向通信网络的告警事件关联压缩方法及装置 |
CN112118141B (zh) * | 2020-09-21 | 2021-12-17 | 中山大学 | 面向通信网络的告警事件关联压缩方法及装置 |
CN113377623A (zh) * | 2021-07-02 | 2021-09-10 | 华青融天(北京)软件股份有限公司 | 告警规则的自动生成方法、装置和电子设备 |
CN113377623B (zh) * | 2021-07-02 | 2024-05-28 | 华青融天(北京)软件股份有限公司 | 告警规则的自动生成方法、装置和电子设备 |
CN113901452A (zh) * | 2021-09-30 | 2022-01-07 | 中国电子科技集团公司第十五研究所 | 一种基于信息熵的子图模糊匹配安全事件识别方法 |
Also Published As
Publication number | Publication date |
---|---|
CN105847029B (zh) | 2019-08-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN105847029B (zh) | 一种基于大数据的信息安全事件自动关联及快速响应*** | |
CN112651006B (zh) | 一种电网安全态势感知*** | |
US11799898B2 (en) | Method for sharing cybersecurity threat analysis and defensive measures amongst a community | |
CN103001811B (zh) | 故障定位方法和装置 | |
US20230012220A1 (en) | Method for determining likely malicious behavior based on abnormal behavior pattern comparison | |
US20220247778A1 (en) | Systems and methods for automatically selecting an access control entity to mitigate attack traffic | |
US20140165207A1 (en) | Method for detecting anomaly action within a computer network | |
WO2017160409A1 (en) | Real-time detection of abnormal network connections in streaming data | |
US10476752B2 (en) | Blue print graphs for fusing of heterogeneous alerts | |
CN105376193B (zh) | 安全事件的智能关联分析方法与装置 | |
CN103441982A (zh) | 一种基于相对熵的入侵报警分析方法 | |
CN109302396A (zh) | 一种基于风险评估的网络安全态势感知方法 | |
Wang et al. | Automatic multi-step attack pattern discovering | |
Janabi et al. | Convolutional neural network based algorithm for early warning proactive system security in software defined networks | |
Zhang et al. | Intrusion detection in SCADA systems by traffic periodicity and telemetry analysis | |
CN111181971A (zh) | 一种自动检测工业网络攻击的*** | |
CN104468193A (zh) | 一种基于组件发现对业务***进行监控的方法 | |
EP2936772A1 (en) | Network security management | |
CN114531273A (zh) | 一种防御工业网络***分布式拒绝服务攻击的方法 | |
CN107479518A (zh) | 一种自动生成告警关联规则的方法及*** | |
Sen et al. | Towards an approach to contextual detection of multi-stage cyber attacks in smart grids | |
Nehinbe | A simple method for improving intrusion detections in corporate networks | |
TWI744545B (zh) | 分散式網路流分析惡意行為偵測系統與其方法 | |
WO2017176676A1 (en) | Graph-based fusing of heterogeneous alerts | |
Protic et al. | WK-FNN design for detection of anomalies in the computer network traffic |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
CB02 | Change of applicant information |
Address after: 210012, Nanjing high tech Zone, Jiangsu, Nanjing Software Park, No. 99 unity Road, Eagle building, block A, 14 floor Applicant after: Nanjing Liancheng science and technology development Limited by Share Ltd Address before: The small road line road in Yuhuatai District of Nanjing City, Jiangsu province 210012 Building No. 158 Building 1 new ideal Applicant before: NANJING LIANCHENG TECHNOLOGY DEVELOPMENT CO., LTD. |
|
CB02 | Change of applicant information | ||
CB02 | Change of applicant information | ||
CB02 | Change of applicant information |
Address after: 210000 14F, building A, Eagle building, 99 solidarity Road, Nanjing Software Park, Nanjing hi tech Zone, Jiangsu Applicant after: Nanjing Liancheng science and technology development Limited by Share Ltd Address before: 210000, Nanjing high tech Zone, Jiangsu, Nanjing Software Park, No. 99 unity Road, Eagle building, block A, 14 floor Applicant before: Nanjing Liancheng science and technology development Limited by Share Ltd |
|
GR01 | Patent grant | ||
GR01 | Patent grant | ||
PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Information security event automatic association and rapid response system based on big data Effective date of registration: 20200328 Granted publication date: 20190809 Pledgee: Bank of Jiangsu, Limited by Share Ltd, Nanjing Jiangning branch Pledgor: NANJING LIANCHENG TECHNOLOGY DEVELOPMENT Co.,Ltd. Registration number: Y2020980001149 |
|
PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
PC01 | Cancellation of the registration of the contract for pledge of patent right |
Date of cancellation: 20210521 Granted publication date: 20190809 Pledgee: Bank of Jiangsu Limited by Share Ltd. Nanjing Jiangning branch Pledgor: NANJING LIANCHENG TECHNOLOGY DEVELOPMENT Co.,Ltd. Registration number: Y2020980001149 |
|
PC01 | Cancellation of the registration of the contract for pledge of patent right |