CN111262734A - Network security event emergency processing method - Google Patents

Network security event emergency processing method Download PDF

Info

Publication number
CN111262734A
CN111262734A CN202010031649.5A CN202010031649A CN111262734A CN 111262734 A CN111262734 A CN 111262734A CN 202010031649 A CN202010031649 A CN 202010031649A CN 111262734 A CN111262734 A CN 111262734A
Authority
CN
China
Prior art keywords
security
early warning
emergency processing
data
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202010031649.5A
Other languages
Chinese (zh)
Inventor
杨延双
张建
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing University of Technology
Original Assignee
Beijing University of Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing University of Technology filed Critical Beijing University of Technology
Priority to CN202010031649.5A priority Critical patent/CN111262734A/en
Publication of CN111262734A publication Critical patent/CN111262734A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/0631Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10File systems; File servers
    • G06F16/18File system types
    • G06F16/182Distributed file systems
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24Querying
    • G06F16/245Query processing
    • G06F16/2458Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
    • G06F16/2471Distributed queries
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/25Integrating or interfacing systems involving database management systems
    • G06F16/254Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/0686Additional information in the notification, e.g. enhancement of specific meta-data
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/069Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433Vulnerability analysis
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic
    • H04L63/145Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/20Network architectures or network communication protocols for network security for managing network security; network security policies in general

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Data Mining & Analysis (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Fuzzy Systems (AREA)
  • Mathematical Physics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Software Systems (AREA)
  • Computational Linguistics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

A network security emergency processing method belongs to the field of network security. The invention comprises the steps of network safety report early warning, and network safety report is carried out by stages of early warning release content, technical means, early warning release mode, early warning release result and the like; the big data security event emergency processing platform is communicated and interconnected through all the components to form a complete emergency processing flow; the emergency processing flow of the security incident carries out emergency disposal on various internal and external elements which threaten the network security; the network security supervision and management system forms KPI (Key performance indicator) grippers for enterprise security management through a security system, a security strategy system and a performance evaluation index system, displays the transverse and longitudinal security situation indexes of an enterprise through the performance evaluation index system and completes the management of daily security assessment work. The invention ensures that the security incident can be responded and processed instantly and correctly so as to ensure the omnibearing data security of the government-enterprise network.

Description

Network security event emergency processing method
Technical Field
The invention belongs to the technical field of network security, and particularly relates to an emergency processing method for a network security event.
Background
The emergency processing method for the network security event is characterized in that a network system is taken as a whole, and the security condition and the future trend of the network system are analyzed and grasped, so that a perfect security event alarming, handling, monitoring and supervising mechanism is established, the security event can be ensured to be responded and processed timely and correctly, and the risk and the loss caused by the network security problem are reduced to the minimum.
With the increasing of network scale and complexity, the attack technology of the network is continuously innovated, a great number of novel attack tools emerge, the traditional network security technology is unconscious, network intrusion is inevitable, and the network security problem is more severe. Complicated security problems are difficult to deal with by one or more security technologies, and the focus of network security personnel is also developed from the solution of a single security problem to the research of the security state of the whole network and the change trend thereof.
Because environmental factors, system software bugs, human factors and the like can induce network security events, if a complete security event emergency processing mechanism is not provided, the security event processing efficiency is low under the condition of lacking unified security event unified monitoring and one-key processing tools; the ability of non-safety professional maintenance and monitoring personnel to identify and analyze safety events is limited, and the emergency response speed needs to be improved; the report transmission flow is too long, and the reports are transmitted step by step mainly through telephone mails and other modes, so that the time consumption is long.
Disclosure of Invention
Therefore, it is necessary to provide an emergency handling mechanism for network security events, which can respond to the network security events in time, and ensure that the security events can be handled in an instant and correct manner.
In order to achieve the purpose, the invention provides the following technical scheme:
the emergency processing method for the network security event comprises the steps of,
1. a network security emergency processing method is characterized in that:
the network safety report early warning system integrates external early warnings including viruses, bugs and safety notices from national administrative agencies, system manufacturers, third-party organizations, safety manufacturers, superior units and the like and internal early warning from a group headquarters and a secondary branch thereof to form early warning release content, and adopts four modules of technical means, early warning release modes, early warning release results and the like
The big data security event emergency processing platform is communicated and interconnected through all the components to form a complete emergency processing flow; the emergency disposal flow of the security incident carries out emergency disposal on various internal and external factors which threaten the network security
Network security supervision and management, forming KPI (Key performance indicator) tongs for enterprise security management through a security system, a security strategy system and a performance evaluation index system, displaying the security situation indexes of the enterprise transversely and longitudinally through the performance evaluation index system, and completing the management of daily security assessment work
2. Further, the four modules of the network security report early warning comprise:
early warning release content: the research and judgment results of safety detection and monitoring comprise attack information, log information, fault information, state information, performance index analysis results and inspection reports
The technical means comprises information screening, data classification, analysis results, alarm processing results, industry ranking and regional ranking
The early warning issuing mode comprises large screen display, information rolling playing, mail notification, short message notification, operation and maintenance platform and emergency disposal platform
The early warning issuing result is sent by using the mail short message, a solution is provided, and the purposes of process tracing, evidence obtaining record and event management are achieved
3. Further, the big data security event emergency processing platform architecture comprises:
a. data acquisition Flume
Cloudera provides a highly available, highly reliable, distributed system for mass log collection aggregation and transmission. Flume supports the customization of various data senders in a log system for collecting data. Meanwhile, flash supports simple processing of data and writing to various data recipients (with customizability). The Flume is used as a preposed acquisition service for acquiring various logs or events, and can be acquired in an invasive or non-invasive mode according to the situation;
b. data preprocessing queue Kafka
A distributed publish-subscribe messaging system with high throughput can process all action flow data in a consumer-scale website, Kafka serves as a real-time message queue, decoupling with a data source can be completed through the module, and background processing capacity at a peak value is effectively balanced;
c. analytical transformation tool ETL
The self-developed ETL tool is generally required to receive data from Kafka and complete the data analysis according to the configured analysis rule and the field completion rule. Finally storing the parsed data into an Elastic Search
For subsequent short-term presentation and statistical analysis. At the same time can be used
One path of data is saved on an HDFS file system so as to facilitate long-period saving and off-line analysis;
d. streaming computing framework Spark Streaming
Micro batch processing can be realized, and the aim is to conveniently establish extensible and fault-tolerant stream application, support Java, Scala and Python and seamlessly integrate Spark. Spark Streaming can read the data HDFS,
flume, Kafka, Twitter and ZeroMQ, can also be read ad-hoc
Defining data;
e. stream computation Spark
A high-speed, general purpose big data computing processing engine. Has the advantages of Hadoop MapReduce, but the difference is that the intermediate output result of Job can be stored in the memory, thereby avoiding the need of reading and writing
HDFS, long-period off-line modeling and T +1 event analysis can be carried out through Spark.
f. Distributed file system HDFS
The Hadoop Distributed File System, HDFS for short, is a Distributed File System. HDFS is a highly fault tolerant system that provides high throughput data access. The original event/log may be saved as a copy to the HDFS for future execution
Long-cycle execution;
g. real-time search engine elastic search
ES is a Lucene-based search server. It provides a distributed, multi-user supported full-text search engine based on RESTful Web interface. The ES is used for storing the analyzed and enriched event/log information and analyzing the analysis result of the model so as to be displayed, traced and associated by the platform;
4. further, the emergency processing flow of the safety event comprises the following steps:
a. safety event registration b, processing task issuing c, formulating/receiving task d, generating and collecting tool
e. On-site data acquisition f, collected data import g, collected data analysis h, attack event backtracking
i. Generating survey report j, receiving survey results k, analyzing security events
5. Further, the network security supervision and management system refines a security policy system layer by layer through a security system including a government and enterprise internal organization architecture, a duty system and a security system, and forms a performance evaluation index system (including a security situation index and a compliance inspection index) after a compliance platform is displayed.
The network security report early warning system adopts a machine learning technology to learn and recognize mass logs, automatically clusters and combines the logs by analyzing a log grammatical structure and a clustering algorithm to form log sets containing similar data contents, and can sort according to the number of the logs in the log sets so as to facilitate the checking and analysis of security analysts.
The system can collect, store, analyze, respond and dispose the safety computing environment, the safety region boundary and the safety information and situation elements of the safety communication network of the information system with fixed level, provide the level protection work management function, realize the electronization, standardization and flow of the work of the information system such as level protection, filing, evaluation, rectification and the like, and improve the efficiency of the work of the safety management personnel such as keeping and management. And the safety management personnel visually display the relevant information in the process of peer-to-peer security management.
Drawings
FIG. 1 is a network security reporting early warning system
FIG. 2 is a big data security incident emergency processing platform architecture
FIG. 3 is a flow chart of emergency processing of network security events
FIG. 4 is a network security event supervision and management system
Detailed Description
To explain technical contents, structural features, objects and effects of the technical solutions in detail, the following detailed description is given with reference to the accompanying drawings
Fig. 1 is a network security reporting and early warning system. External early warnings including viruses, bugs and safety notices from national governing bodies, system manufacturers, third-party organizations, safety manufacturers, superior units and the like and internal early warnings from a group headquarters and a secondary branch thereof are integrated through a network safety report early warning system to form early warning release contents, and technical means, early warning release modes and early warning release results are adopted. Wherein:
early warning release content: the research and judgment results of safety detection and monitoring comprise attack information, log information, fault information, state information, performance index analysis results and inspection reports
The technical means comprises information screening, data classification, analysis results, alarm processing results, industry ranking and regional ranking
The early warning issuing mode comprises large screen display, information rolling playing, mail notification, short message notification, operation and maintenance platform and emergency disposal platform
The early warning issuing result is sent by using the mail short message, a solution is provided, and the purposes of process tracing, evidence obtaining record and event management are achieved
FIG. 2 is a big data Security incident Emergency handling platform architecture in which light summary data may be stored for one year; the environment data comprises an asset library and the like; the heavy summarization refers to data summarization after statistical analysis is carried out on alarm data;
fig. 3 shows a safety event emergency processing flow, and fig. 4 shows a safety supervision and management system.
The emergency processing flow of the safety event comprises the following steps:
a. safety event registration b, processing task issuing c, formulating/receiving task d, generating and collecting tool
e. On-site data acquisition f, collected data import g, collected data analysis h, attack event backtracking
i. Generating survey report j, receiving survey results k, analyzing security events
The network security supervision and management system refines a security policy system layer by layer through a security system including a government and enterprise internal organization structure, a duty system and a security system, and forms a performance evaluation index system (including a security situation index and a compliance check index) after a compliance platform displays the security policy system.
The above-mentioned embodiments, objects, technical solutions and contents of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only illustrative of the present invention and are not intended to limit the present invention, and any modifications, equivalents, improvements and the like made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (6)

1. A network security incident emergency processing method is characterized in that:
the network security report early warning system integrates external early warning including viruses, bugs and security reports and internal early warning information from a group headquarters and a secondary branch thereof to form early warning release content, adopts four modules of a technical means, an early warning release mode and an early warning release result, supports security monitoring early warning and information report, and reports and issues security information through an interface;
the big data security incident emergency processing platform forms a perfect emergency processing flow and security incident emergency processing flow through interconnection and intercommunication among platform components, carries out emergency processing network security supervision and management on various internal and external elements threatening network security, forms a KPI (Key performance indicator) gripper for enterprise security management through a security system, a security strategy system and a performance evaluation index system, displays security situation indexes of the enterprise in the transverse and longitudinal directions through the performance evaluation index system, and completes management of daily security assessment work.
2. The method of claim 1, wherein the four modules comprise:
early warning release content: the research and judgment results of safety detection and monitoring comprise attack information, log information, fault information, state information, performance index analysis results and inspection reports
The technical means comprises information screening, data classification, analysis results, alarm processing results, industry ranking and regional ranking
The early warning issuing mode comprises large screen display, information rolling playing, mail notification, short message notification, operation and maintenance platform and emergency disposal platform
And early warning issuing results are obtained, warning information is sent by using mail short messages, a solution is provided, and the purposes of process tracing, evidence obtaining record and event management are achieved.
3. The network security event emergency processing method of claim 1, wherein the big data security event emergency processing platform comprises:
a. data acquisition Flume
Cloudera provides a distributed system for collecting, aggregating and transmitting mass logs; the Flume supports various data senders customized in the log system for collecting data; the Flume is used as a preposed acquisition service for acquiring various logs or events;
b. a data preprocessing queue Kafka;
c. analytical transformation tool ETL
The ETL tool receives data from the Kafka and completes the analysis of the data according to the configured analysis rule and the field completion rule; finally, storing the analyzed data into an Elastic Search for subsequent short-period display and statistical analysis; meanwhile, bypassing one part of data to be saved on an HDFS file system so as to facilitate long-period saving and offline analysis;
d. streaming computing framework Spark Streaming
e. Stream computation Spark
f. Distributed file system HDFS
Storing an original event/log on an HDFS for long-period execution in the future;
g. the real-time search engine elastic search.
4. The network security emergency processing method of claim 1, wherein: the safety event emergency processing flow comprises the following steps:
a. safety event registration b, processing task issuing c, formulating/receiving task d, generating and collecting tool
e. On-site data acquisition f, collected data import g, collected data analysis h, attack event backtracking
i. Generating a survey report j, receiving a survey result k, and analyzing the security event.
5. The network security emergency processing method of claim 1, wherein: the network security supervision and management system refines a security policy system layer by layer through a security system including a government and enterprise internal organization structure, a duty system and a security system, and forms a performance evaluation index system after a platform is displayed.
6. The network security emergency processing method of claim 1, wherein: the method is characterized in that:
the network security report early warning system adopts a machine learning technology to learn and recognize mass logs, automatically clusters and combines the logs by analyzing a log grammatical structure and a clustering algorithm to form log sets containing similar data contents, and sorts the logs according to the number of the logs in the log sets so as to facilitate the checking and analysis of security analysts.
CN202010031649.5A 2020-01-13 2020-01-13 Network security event emergency processing method Pending CN111262734A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010031649.5A CN111262734A (en) 2020-01-13 2020-01-13 Network security event emergency processing method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010031649.5A CN111262734A (en) 2020-01-13 2020-01-13 Network security event emergency processing method

Publications (1)

Publication Number Publication Date
CN111262734A true CN111262734A (en) 2020-06-09

Family

ID=70952127

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010031649.5A Pending CN111262734A (en) 2020-01-13 2020-01-13 Network security event emergency processing method

Country Status (1)

Country Link
CN (1) CN111262734A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111818069A (en) * 2020-07-14 2020-10-23 绿盟科技集团股份有限公司 Method, device, medium and computer equipment for presenting security event processing flow
CN113872950A (en) * 2021-09-18 2021-12-31 恒安嘉新(北京)科技股份公司 Automobile safety analysis method and device, electronic equipment and storage medium
CN115664857A (en) * 2022-12-26 2023-01-31 安徽国审信息科技有限公司 Method, system, equipment and storage medium for protecting network information security

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103581155A (en) * 2012-08-08 2014-02-12 贵州电网公司信息通信分公司 Information security situation analysis method and system
CN105553957A (en) * 2015-12-09 2016-05-04 国家电网公司 Network safety situation awareness early-warning method and system based big data
CN109189846A (en) * 2018-09-11 2019-01-11 北京易华录信息技术股份有限公司 A kind of public security traffic control visual modeling system and method based on big data technology
CN110019070A (en) * 2017-11-10 2019-07-16 北京安码科技有限公司 A kind of security log clustering method based on Hadoop and system of calling to account

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103581155A (en) * 2012-08-08 2014-02-12 贵州电网公司信息通信分公司 Information security situation analysis method and system
CN105553957A (en) * 2015-12-09 2016-05-04 国家电网公司 Network safety situation awareness early-warning method and system based big data
CN110019070A (en) * 2017-11-10 2019-07-16 北京安码科技有限公司 A kind of security log clustering method based on Hadoop and system of calling to account
CN109189846A (en) * 2018-09-11 2019-01-11 北京易华录信息技术股份有限公司 A kind of public security traffic control visual modeling system and method based on big data technology

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
石峰等: "电力***信息安全防护体系研究", 《网络空间安全》 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111818069A (en) * 2020-07-14 2020-10-23 绿盟科技集团股份有限公司 Method, device, medium and computer equipment for presenting security event processing flow
CN113872950A (en) * 2021-09-18 2021-12-31 恒安嘉新(北京)科技股份公司 Automobile safety analysis method and device, electronic equipment and storage medium
CN113872950B (en) * 2021-09-18 2024-06-07 恒安嘉新(北京)科技股份公司 Automobile safety analysis method and device, electronic equipment and storage medium
CN115664857A (en) * 2022-12-26 2023-01-31 安徽国审信息科技有限公司 Method, system, equipment and storage medium for protecting network information security

Similar Documents

Publication Publication Date Title
CN107256219B (en) Big data fusion analysis method applied to mass logs of automatic train control system
CN111262734A (en) Network security event emergency processing method
CN105553957A (en) Network safety situation awareness early-warning method and system based big data
CN105528280A (en) Method and system capable of determining log alarm grades according to relationship between system logs and health monitoring
CN103475535A (en) Log management system of cloud computing server
CN114726654B (en) Data analysis method and server for coping with cloud computing network attack
CN104574219A (en) System and method for monitoring and early warning of operation conditions of power grid service information system
CN114648393A (en) Data mining method, system and equipment applied to bidding
CN116467366A (en) Block chain-based carbon footprint monitoring analysis and evaluation system
CN115038083A (en) Telecom fraud early warning identification method and system applied to AI operator industry
CN107257289A (en) A kind of risk analysis equipment, monitoring system and monitoring method
CN109858807A (en) A kind of method and system of enterprise operation monitoring
CN113065580A (en) Power plant equipment management method and system based on multi-information fusion
CN113157521A (en) Monitoring method and monitoring system for whole life cycle of block chain
CN115567563B (en) Comprehensive transportation hub monitoring and early warning system based on end edge cloud and control method thereof
Zhou et al. Automatically detecting excavator anomalies based on machine learning
CN110619572A (en) Method for monitoring high fault tolerance growth of enterprise public data
Shah et al. Automated log analysis and anomaly detection using machine learning
Yu Research on emergency management information system model based on big data
CN110503131A (en) Wind-driven generator health monitoring systems based on big data analysis
CN112995122B (en) Industrial control network safety data visualization system
Oyekan et al. A knowledge-based cognitive architecture supported by machine learning algorithms for interpretable monitoring of large-scale satellite networks
CN110717137B (en) Message distribution processing method and message system
Mistry et al. Using Event Data to Build Predictive Engine Failure Models
CN111258865B (en) Processor, alarm data management system and method of multi-informatization system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20200609

RJ01 Rejection of invention patent application after publication