CN114844667B - Intelligent security analysis management decision system and method based on network equipment - Google Patents

Abstract

The invention provides a method and a system for intelligent security analysis and management decision based on network equipment, which are based on network security attack or network security system setting fault which may occur in the running process of a cloud system of the network equipment.

Description

System and method for intelligent security analysis management decision-making based on network equipment

technical field

The invention belongs to the technical field of network security, and in particular relates to a management decision-making system based on intelligent security analysis of network equipment and a management method thereof.

Background technique

The development of the Internet not only brings the convenience of data transmission to the information society, but also brings various types of network security issues.

Generally speaking, cybersecurity refers to technologies that protect computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. This technology is also known as information technology security or electronic information security. Network security usually refers to the security of computer networks, but in fact it can also refer to the security of computer communication networks. Computer communication network is a system that interconnects several computers with independent functions through communication equipment and transmission media, and realizes information transmission and exchange between computers with the support of communication software. The computer network refers to a system that uses communication means to connect several independent computer systems, terminal devices and data devices that are relatively dispersed in the region for the purpose of sharing resources, and exchanges data under the control of the protocol. The fundamental purpose of computer network is resource sharing, communication network is the way to realize network resource sharing, therefore, computer network is safe, the corresponding computer communication network must also be safe, it should be able to realize information exchange and resource sharing for network users. The term applies to a variety of contexts from business to mobile computing and can be broken down into several common categories. Network security in its most general sense is a technique for protecting computer networks from intruders, whether through targeted attacks or conditional malware attacks. Application security focuses on protecting software and devices from threats. A compromised application may provide access to data it was designed to protect. And, the success of an application's security is determined early in the design phase of the application, not before the program or device is deployed. Information Security is designed to protect the integrity and privacy of data during storage and transmission. Operational security includes processes and decisions for handling and protecting data assets. The permissions users have when accessing the network and the steps to determine when and where data is stored/shared are included under this umbrella. Disaster recovery and business continuity define how an organization responds to a cyber security incident or any other event that results in loss of operations/data. A disaster recovery strategy specifies how an organization restores its operations and information to the same operational capacity it was in before the event. Business continuity refers to the plans an organization relies on when trying to operate without certain resources.

Network security often includes hardware security and software security at the same time. Both sides need to be maintained together. Hardware needs to be assembled with suitable products and tested regularly. Software needs to be anti-virus maintenance and upgrades. In the Internet, the most important link is the sharing of resource information. This link requires network security to ensure safety. Since equipment, data, and computer systems are connected, data exchange is performed under the control of the protocol, so as to carry out information feedback. Therefore, network security is also the security of communication and information.

The most effective method for network security is to conduct network security defense based on network security formal analysis.

Network security defense, or network security protection, generally has the following basic security aspects. If combined properly, it will be able to effectively stop attacks on enterprise data, networks and users. Firewall: This cornerstone of network defense for more than a decade is still very much needed for solid foundational security today. Without a firewall to block harmful traffic, the work of a business to protect its own network assets is multiplied. The firewall must be deployed on the external border of the enterprise, but it can also be placed inside the enterprise network to protect the data security of each network segment. Deploying a firewall inside an enterprise is a relatively new but good practice. This practice has arisen primarily because any tangible, reliable network perimeter that can distinguish trusted traffic from harmful traffic is disappearing. The old concept of so-called clear Internet boundaries no longer exists in the modern network. The latest change is that firewalls are getting smarter and more granular, being able to define them at the flow of data. Today, it is common for firewalls to control the flow of data based on the type of application or even a function of the application. For example, a firewall can block a SIP voice call based on the calling number. Secure Routers: Routers are found almost everywhere on most networks. Conventionally, they are only used as traffic cops to monitor traffic. But modern routers can do a lot more than that. Routers have complete security functions, sometimes even more complete than firewalls. Most routers today come with a robust firewall, some useful IDS/IPS features, robust QoS and traffic management tools, and of course strong VPN data encryption. The list of such features could go on and on. Modern routers are perfectly capable of adding security to a network. And with modern VPN technology, it's fairly simple to encrypt all traffic on the corporate WAN without having to add manpower to it. Some people also take advantage of its atypical uses, such as firewall functions and IPS functions. Turn on the router and you can see that the security situation has improved a lot. Wireless WPA2: If you have not adopted WPA2 wireless security, starting to switch to WPA2 with AES encryption will better improve network security. Email Security: Email is the most vulnerable object. Viruses, malware, and worms love to use email as their distribution channel. Email is also the most common channel through which we can leak sensitive data. Web Security: In view of the increasing complexity of Web-based attacks, it is imperative for enterprises to deploy a robust Web security solution. Simple URL filtering has been used for many years and is indeed a core element of web security. But web security is far more than just URL filtering. It also needs functions such as injection AV scanning, malware scanning, IP reputation identification, dynamic URL classification techniques, and data leakage prevention. Attackers are attacking many high-profile websites at an alarming rate. If only relying on URL blacklist and whitelist to filter, then only whitelist URLs may be left for access. Any web security solution must be able to dynamically scan web traffic.

The defense of network security attacks often follows the traditional security protection rules, and fails to adapt well to the characteristics of network equipment itself, as well as the characteristics of network security events and the consideration of protection levels to comprehensively make decisions on network security management and security at the system level. Defense, resulting in the protection of network security is always a remedy for the past, paying too much attention to local and transient data protection.

The present invention proposes a method and system based on network equipment intelligent security analysis management decision-making, based on network security attacks or network security system setting failures that may occur during the operation of the network equipment in the cloud system, and proposes security events based on security event data packets. Analysis and management decision-making methods and systems, by converting security events into corresponding security event data packets and performing normalized analysis of data packets, making security event analysis and decision-making based on device confidence, processing level information, and security event parameter sets, etc. Three-party entry parameters are intelligently based on security policy collection to realize security intelligence analysis and global decision-making of network devices.

Contents of the invention

The invention aims to provide a management decision-making system and method based on intelligent security analysis of network equipment, which is superior to the prior art.

In order to achieve the above object, the technical scheme of the present invention is as follows:

A management and decision-making system based on intelligent security analysis of network equipment, the system includes:

A plurality of network devices, each of which runs in a cloud computing network, processes a network data processing request from a client and returns a data processing result;

The network device is also configured to send a security event message to the security event normalizer based on the network device intelligent security analysis management decision-making system when encountering a network security event;

The security event message is used to record the collection record information when the network device encounters a network security event;

Wherein, the security event message is used to record the collection record information when the network device encounters a network security event, specifically: when the network device A encounters a network security event, the security event message at least records the network device The network device ID, the first parameter set of the security event, the occurrence level and the correlation level of the security event;

A security event normalizer, the security event normalizer is used to perform event-based message normalization processing on the security event message sent by the network device, and disassemble the security event message into at least the network device The network device ID field, the security event first parameter set field, the security event occurrence level and associated level field;

The security event normalizer is also used to pack the network device ID field of the network device into the first event decision data, and send it to the device confidence module; pack the first parameter set field of the security event into the second event Decision data, and send to the policy collection module; package the security event occurrence level and associated level into third event decision data, and send to the processing level module;

A device confidence module, the device confidence module is used to receive the first event decision data, and analyze the network device ID of the network device, search the network device security event confidence table based on the network device ID, and determine the network device security event confidence value , sent to the intelligent management decision-making module;

A policy collection module, the policy collection module is configured to receive and parse the second event decision data, determine the corresponding security policy collection based on the first parameter set field of the security event, and collect the corresponding security policy The collection is sent to the intelligent management decision-making module;

A processing level module; the processing level module is used to receive the third event decision data, analyze the security event occurrence level and the associated level therein, and determine the corresponding security event processing operation level permission requirements based on the security event occurrence level and the associated level , and send the determined corresponding security event processing operation-level authority requirements to the intelligent management decision-making module;

Wherein, the permission requirement of the corresponding security event processing operation level is at least higher than or equal to the correlation level of the security event;

An intelligent management decision-making module, the intelligent management decision-making module receives the security event confidence value of the network device, the collection of security policies, and the corresponding security event processing operation level permission requirements, and determines whether to execute security based on the comparison between the security event confidence value and the confidence threshold. Event intelligent management decision-making;

Wherein, the comparison of the security event confidence value and the confidence threshold determines whether to execute the security event intelligent management decision, specifically:

When the confidence value of the security event is greater than the confidence threshold, the intelligent management decision of the security event is directly executed; when the confidence value of the security event is less than the confidence threshold, a random algorithm is used with the probability of the security event confidence K1, and the judgment is in the range of [0,1] Whether the result of the selected random number falls within [0, K1], if so, execute the intelligent management decision of the security event;

The security event intelligent management decision at least includes: enabling the processing operation level authority required by the security event processing operation level authority requirement to the security event processing object, and based on the security policy collection, using the corresponding security policy to process the security event , and record to the database.

Preferably, the network device may be a cloud computing edge server, router, gateway or service host.

Preferably, the network security events include at least one of the following events: network attack events, non-attack network failure events, and network information security level change events.

Preferably, the network device security event confidence table is preset by the management decision-making system based on network device intelligent security analysis, and the network device security event confidence table at least includes network device ID information and a A corresponding network device security event confidence value, the network device security event confidence value is calculated based on the historical security event credibility of the network device stored in the system database.

Preferably, the reliability of the historical security events of the network equipment stored in the system database is equal to the false positive probability of the historical security incidents of the network equipment, and is updated and dynamically changed as the security incidents of the network equipment are continuously reported.

At the same time, this application also seeks to protect a management method based on intelligent security analysis of network equipment, and the method includes the following steps:

Step 1: Operate each of the network devices in the plurality of network devices to run in the cloud computing network, process the network data processing request proposed by the client and return the data processing result;

The network device is also configured to send a security event message to the security event normalizer based on the network device intelligent security analysis management decision-making system when encountering a network security event;

The security event message is used to record the collection record information when the network device encounters a network security event;

Wherein, the security event message is used to record the collection record information when the network device encounters a network security event, specifically: when the network device A encounters a network security event, the security event message at least records the network device The network device ID, the first parameter set of the security event, the occurrence level and the correlation level of the security event;

Step 2: Operate the security event normalizer to perform event-based message normalization processing on the security event message sent by the network device, and disassemble the security event message into at least the network device ID field of the network device , security event first parameter set field, security event occurrence level and associated level field;

The security event normalizer is also used to pack the network device ID field of the network device into the first event decision data, and send it to the device confidence module; pack the first parameter set field of the security event into the second event Decision data, and send to the policy collection module; package the security event occurrence level and associated level into third event decision data, and send to the processing level module;

Step 3: The operating device confidence module receives the first event decision data, and analyzes the network device ID of the network device, searches the network device security event confidence table based on the network device ID, determines the network device security event confidence value, and sends it to the intelligent Management decision-making module;

Step 4: The operation policy collection module receives and analyzes the second event decision data, determines the corresponding security policy collection based on the first parameter set field of the security event, and sends the corresponding security policy collection to the intelligent Management decision-making module;

Step 5: The operation processing level module receives the third event decision data, and analyzes the security event occurrence level and correlation level, determines the corresponding security event processing operation level permission requirements based on the security event occurrence level and correlation level, and determines The corresponding security event processing operation-level permission requirements are sent to the intelligent management decision-making module;

Wherein, the permission requirement of the corresponding security event processing operation level is at least higher than or equal to the correlation level of the security event;

Step 6: The operation intelligent management decision-making module receives the confidence value of the security event of the network device, the collection of security policies, and the corresponding permission requirements of the security event processing operation level, and determines whether to perform intelligent management of security events based on the comparison of the security event confidence value and the confidence threshold decision making;

Wherein, the comparison of the security event confidence value and the confidence threshold determines whether to execute the security event intelligent management decision, specifically:

When the confidence value of the security event is greater than the confidence threshold, the intelligent management decision of the security event is directly executed; when the confidence value of the security event is less than the confidence threshold, a random algorithm is used with the probability of the security event confidence K1, and the judgment is in the range of [0,1] Whether the result of the selected random number falls within [0, K1], if so, execute the intelligent management decision of the security event;

The security event intelligent management decision at least includes: enabling the processing operation level authority required by the security event processing operation level authority requirement to the security event processing object, and based on the security policy collection, using the corresponding security policy to process the security event , and record to the database.

Preferably, the network device may be a cloud computing edge server, router, gateway or service host.

Preferably, the network security events include at least one of the following events: network attack events, non-attack network failure events, and network information security level change events.

Preferably, the network device security event confidence table is preset by the management decision-making system based on network device intelligent security analysis, and the network device security event confidence table at least includes network device ID information and a A corresponding network device security event confidence value, the network device security event confidence value is calculated based on the historical security event credibility of the network device stored in the system database.

Preferably, the reliability of the historical security events of the network equipment stored in the system database is equal to the false positive probability of the historical security incidents of the network equipment, and is updated and dynamically changed as the security incidents of the network equipment are continuously reported.

The present invention proposes a method and system based on network equipment intelligent security analysis management decision-making, based on network security attacks or network security system setting failures that may occur during the operation of the network equipment in the cloud system, and proposes security events based on security event data packets. Analysis and management decision-making methods and systems, by converting security events into corresponding security event data packets and performing normalized analysis of data packets, making security event analysis and decision-making based on device confidence, processing level information, and security event parameter sets, etc. Three-party entry parameters are intelligently based on security policy collection to realize security intelligence analysis and global decision-making of network devices.

Description of drawings

Fig. 1 is a kind of basic system structural diagram of the intelligent security analysis management decision-making system based on network equipment shown in the present invention;

Fig. 2 is a kind of basic system structure diagram of the security event normalizer in the intelligent security analysis management decision-making system based on the network equipment shown in the present invention;

Fig. 3 is a basic system structure diagram of the interconnection between the security event normalizer module, the device confidence module, the policy collection module, and the processing level module in the intelligent security analysis management decision-making system based on network equipment shown in the present invention;

Fig. 4 is a preferred embodiment of the step flow chart of the method for intelligent security analysis and management based on network equipment shown in the present invention;

Fig. 5 is a schematic diagram of a preferred display embodiment of the present invention showing the intelligent security event management decision-making steps based on the network device intelligent security analysis management method.

Detailed ways

The following specifically describes several embodiments and beneficial effects of a management decision-making system based on intelligent security analysis of network equipment claimed in the present invention, so as to facilitate a more detailed examination and decomposition of the present invention.

In order to better understand the technical solutions of the present invention, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings.

It should be clear that the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. As used in the embodiments of the present invention and the appended claims, the singular forms "a", "said" and "the" are also intended to include the plural forms unless the context clearly indicates otherwise.

It should be understood that the term "and/or" used herein is only an association relationship describing associated objects, which means that there may be three relationships, for example, A and/or B, which may mean that A exists alone, and A and B exist simultaneously. B, there are three situations of B alone. In addition, the character "/" in this article generally indicates that the contextual objects are an "or" relationship.

It should be understood that although the terms first, second, etc. may be used in the embodiments of the present invention to describe methods and corresponding devices, these keywords should not be limited to these terms. These terms are only used to distinguish keywords from one another. For example, without departing from the scope of the embodiments of the present invention, the first parameter set, the first event decision data, etc. may also be referred to as the second parameter set, the second event decision data, similarly, the second parameter set, the first event decision data, etc. Second-event decision data and the like may also be referred to as first parameter set, first-event decision data.

Depending on the context, the word "if" as used herein may be interpreted as "at" or "when" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrases "if determined" or "if detected (the stated condition or event)" could be interpreted as "when determined" or "in response to the determination" or "when detected (the stated condition or event) )" or "in response to detection of (a stated condition or event)".

As shown in Figures 1-3 of the description, Figures 1-3 of the description are one of the embodiments of a management decision-making system based on intelligent security analysis of network equipment and its specific internal module interconnection relationship claimed in the present invention. The system includes:

A plurality of network devices, each of which runs in a cloud computing network, processes a network data processing request from a client and returns a data processing result;

The network device is also configured to send a security event message to the security event normalizer based on the network device intelligent security analysis management decision-making system when encountering a network security event;

The security event message is used to record the collection record information when the network device encounters a network security event;

Wherein, the security event message is used to record the collection record information when the network device encounters a network security event, specifically: when the network device A encounters a network security event, the security event message at least records the network device The network device ID, the first parameter set of the security event, the occurrence level and the correlation level of the security event;

As a preferred embodiment that can be superimposed, the security event message is used to record the collection and record information when the network device encounters a network security event, specifically: the security event message when network device A encounters a network security event When an event occurs, at least record the network device ID of the network device, the first parameter set of the security event, the occurrence level and the association level of the security event. Wherein, the network device ID is used to characterize the heterogeneity of the network device and to identify the network device, and the first parameter set of the security event at least includes a data message protocol flow table of the security event, which is used to record and summarize data transmitted incorrectly Message protocol cluster type; security fault range, used to determine the concurrency range of security faults; security fault new indicator, used to determine whether this security fault is a new fault within a specific period. As another preferred embodiment that can be superimposed, the concurrency range of the safety fault is used to send a fault detection message to the directly connected or upstream and downstream network devices of the same type when the local network device A fails. To detect whether the same type of failure occurs in the same type of network equipment that is directly connected or upstream and downstream, and when network equipment A is directly connected or the same type of upstream and downstream network equipment has the same type of failure, continue to directly connect to network equipment A or upstream and downstream The direct connection of the same type of network device or the upstream and downstream network device of the same type sends a fault detection message to detect whether the direct connection of network device A or the direct connection of the upstream and downstream network device of the same type or the upstream and downstream network device of the same type occurs For the same type of faults, until no fault occurs or the fault detection message has been sent at least three times, then stop sending the fault detection message. The value of the safe fault range is the number of times the fault detection message is sent. If the fault detection message has been sent at least three times and reaches the upper limit, then the value of the safe fault range is equal to 3 at this time. The new safety fault indicator is used to determine whether a specific network device is the first new fault within a specific maintenance period, such as 3 days, and is used to determine the fault occurrence rate of the network device, and based on the fault of the network device The occurrence rate determines the probability of repair, and the probability of repair is proportional to the index of new security faults. If the fault of the network device is new in a specific period, the security fault new index is 1, which is used to characterize this fault; The index of new faults is K+1. As another preferred embodiment that can be superimposed, the occurrence level and associated level of the security event are used to characterize the level and associated level where the security event occurs. As another preferred embodiment that can be superimposed, the occurrence level The fault used to characterize the security event comes from the delivery layer of the cloud computing system, that is, the bottom client layer; or the edge connection layer, that is, the network device layer from the bottom client (not included) to the cloud edge device; or The cloud center layer, that is, from the cloud computing center based on the intelligent security analysis management decision system of network equipment to one of the central computing layers of each cloud edge device (not included), and the occurrence level of the network security event The level (if any) is used as the associated level of the security event, and is recorded in the security event occurrence level and associated level fields of the security event message.

A security event normalizer, the security event normalizer is used to perform event-based message normalization processing on the security event message sent by the network device, and disassemble the security event message into at least the network device The network device ID field, the security event first parameter set field, the security event occurrence level and associated level field;

The security event normalizer is also used to pack the network device ID field of the network device into the first event decision data, and send it to the device confidence module; pack the first parameter set field of the security event into the second event Decision data, and send to the policy collection module; package the security event occurrence level and associated level into third event decision data, and send to the processing level module;

A device confidence module, the device confidence module is used to receive the first event decision data, and analyze the network device ID of the network device, search the network device security event confidence table based on the network device ID, and determine the network device security event confidence value , sent to the intelligent management decision-making module;

A policy collection module, the policy collection module is configured to receive and parse the second event decision data, determine the corresponding security policy collection based on the first parameter set field of the security event, and collect the corresponding security policy The collection is sent to the intelligent management decision-making module;

As a preferred embodiment that can be superimposed, the policy collection module is configured to receive and parse the second event decision data, and determine the corresponding security event based on the first parameter set field of the security event. Policy collection, specifically: the policy collection module analyzes the security event data message protocol flow table, the security fault range field, and the new security fault indicator, and based on the security event data message protocol flow table, security The fault range field and the newly issued security fault index jointly determine the corresponding security event management strategy. The security event management strategy can be decided by the system administrator based on the above indicators, or can be automatically decided by the system based on the security policy collection query table. As a preferred embodiment that can be superimposed, the security policy collection module stores a system preset security policy collection query table, and the security policy collection query table at least includes each security policy and its corresponding security event data Message protocol flow table, security fault range field, and security fault newly issued index range, by querying the security event data message protocol flow table, security fault range field, and security fault newly issued index carried by the security event message, you can find The corresponding security policy collection is queried in the security policy collection query table, and the corresponding security policy collection is sent to the intelligent management decision-making module.

A processing level module; the processing level module is used to receive the third event decision data, analyze the security event occurrence level and the associated level therein, and determine the corresponding security event processing operation level permission requirements based on the security event occurrence level and the associated level , and send the determined corresponding security event processing operation-level authority requirements to the intelligent management decision-making module;

Wherein, the permission requirement of the corresponding security event processing operation level is at least higher than or equal to the correlation level of the security event;

An intelligent management decision-making module, the intelligent management decision-making module receives the security event confidence value of the network device, the collection of security policies, and the corresponding security event processing operation level permission requirements, and determines whether to execute security based on the comparison between the security event confidence value and the confidence threshold. Event intelligent management decision-making;

Wherein, the comparison of the security event confidence value and the confidence threshold determines whether to execute the security event intelligent management decision, specifically:

When the confidence value of the security event is greater than the confidence threshold, the intelligent management decision of the security event is directly executed; when the confidence value of the security event is less than the confidence threshold, a random algorithm is used with the probability of the security event confidence K1, and the judgment is in the range of [0,1] Whether the result of the selected random number falls within [0, K1], if so, execute the intelligent management decision of the security event;

The security event intelligent management decision at least includes: enabling the processing operation level authority required by the security event processing operation level authority requirement to the security event processing object, and based on the security policy collection, using the corresponding security policy to process the security event , and record to the database.

As a superimposed embodiment, the network device may be a cloud computing edge server, router, gateway or service host.

As another superimposed embodiment, the network security event includes at least one of the following events: a network attack event, a non-attack network failure event, and a network information security level change event.

As another superimposed embodiment, the network device security event confidence table is preset by the network device intelligent security analysis management decision-making system, and the network device security event confidence table at least includes network device ID information and The confidence value of the network device security event corresponding to the network device ID information is one-to-one, and the network device security event confidence value is calculated based on the historical security event credibility of the network device stored in the system database.

As another superimposed embodiment, the reliability of the historical security events of the network equipment stored in the system database is equal to the false positive probability of the historical security incidents of the network equipment, and is updated along with the continuous reporting of the security incidents of the network equipment and Dynamic changes.

As shown in Figures 4-5 of the description, Figures 4-5 of the description are schematic diagrams of preferred display embodiments of the method for intelligent security analysis and management based on network equipment and its implementation of intelligent management decision-making steps for security incidents claimed in the present invention, the method Including the following steps:

Step S102: Operate each of the network devices in the plurality of network devices to run in the cloud computing network, process the network data processing request from the client and return the data processing result;

The network device is also configured to send a security event message to the security event normalizer based on the network device intelligent security analysis management decision-making system when encountering a network security event;

The security event message is used to record the collection record information when the network device encounters a network security event;

Wherein, the security event message is used to record the collection record information when the network device encounters a network security event, specifically: when the network device A encounters a network security event, the security event message at least records the network device The network device ID, the first parameter set of the security event, the occurrence level and the correlation level of the security event;

Step S104: Operate the security event normalizer to perform event-based message normalization processing on the security event message sent by the network device, and disassemble the security event message into at least the network device ID field of the network device , security event first parameter set field, security event occurrence level and associated level field;

The security event normalizer is also used to pack the network device ID field of the network device into the first event decision data, and send it to the device confidence module; pack the first parameter set field of the security event into the second event Decision data, and send to the policy collection module; package the security event occurrence level and associated level into third event decision data, and send to the processing level module;

Step S106: The operating device confidence module receives the first event decision data, and analyzes the network device ID of the network device, searches the network device security event confidence table based on the network device ID, determines the network device security event confidence value, and sends it to the intelligent Management decision-making module;

Step S108: The operation policy collection module receives and analyzes the second event decision data, determines the corresponding security policy collection based on the first parameter set field of the security event, and sends the corresponding security policy collection to the intelligent Management decision-making module;

Step S110: The operation processing level module receives the third event decision-making data, and analyzes the security event occurrence level and association level therein, determines the corresponding security event processing operation level permission requirement based on the security event occurrence level and association level, and determines The corresponding security event processing operation-level permission requirements are sent to the intelligent management decision-making module;

Wherein, the permission requirement of the corresponding security event processing operation level is at least higher than or equal to the correlation level of the security event;

Step S112: The operation intelligent management decision-making module receives the security event confidence value of the network device, the collection of security policies, and the corresponding security event processing operation level authority requirements, and determines whether to implement security event intelligent management based on the comparison between the security event confidence value and the confidence threshold decision making;

Wherein, the comparison of the security event confidence value and the confidence threshold determines whether to execute the security event intelligent management decision, specifically:

When the confidence value of the security event is greater than the confidence threshold, the intelligent management decision of the security event is directly executed; when the confidence value of the security event is less than the confidence threshold, a random algorithm is used with the probability of the security event confidence K1, and the judgment is in the range of [0,1] Whether the result of the selected random number falls within [0, K1], if so, execute the intelligent management decision of the security event;

The security event intelligent management decision at least includes: enabling the processing operation level authority required by the security event processing operation level authority requirement to the security event processing object, and based on the security policy collection, using the corresponding security policy to process the security event , and record to the database.

As another superimposed embodiment, the network device may be a cloud computing edge server, router, gateway or service host.

As another superimposed embodiment, the network security event includes at least one of the following events: a network attack event, a non-attack network failure event, and a network information security level change event.

As another superimposed embodiment, the network device security event confidence table is preset by the network device intelligent security analysis management decision-making system, and the network device security event confidence table at least includes network device ID information and The confidence value of the network device security event corresponding to the network device ID information is one-to-one, and the network device security event confidence value is calculated based on the historical security event credibility of the network device stored in the system database.

As another superimposed embodiment, the reliability of the historical security events of the network equipment stored in the system database is equal to the false positive probability of the historical security incidents of the network equipment, and is updated along with the continuous reporting of the security incidents of the network equipment and Dynamic changes.

The present invention proposes a method and system based on network equipment intelligent security analysis management decision-making, based on network security attacks or network security system setting failures that may occur during the operation of the network equipment in the cloud system, and proposes security events based on security event data packets. Analysis and management decision-making methods and systems, by converting security events into corresponding security event data packets and performing normalized analysis of data packets, making security event analysis and decision-making based on device confidence, processing level information, and security event parameter sets, etc. Three-party entry parameters are intelligently based on security policy collection to realize security intelligence analysis and global decision-making of network devices.

In all the above-mentioned embodiments, in order to realize some special data transmission, read/write function requirements, during the operation of the above-mentioned method and its corresponding devices, devices, modules, devices, hardware, pin connections or differences in memory and processors can be added to extend the functionality.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the method, device and unit described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the method steps is only a logical or functional division, and there may be other divisions in actual implementation, for example, multiple units or components May be combined or may be integrated into another system, or some features may be omitted, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as the various steps of the method and the separate components of the device may or may not be logically or physically separated, and may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, the method steps and their implementations and functional units in each embodiment of the present invention can be integrated into one processing unit, or each unit can exist separately physically, or two or more units can be integrated into one unit . The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above methods and devices can be implemented as integrated units in the form of software functional units, and can be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, and include several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) or a processor (Processor) execute the methods described in various embodiments of the present invention. partial steps. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), NVRAM, magnetic disk or optical disk, etc. can store program codes. medium.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the present invention. within the scope of protection.

It should be noted that: the above embodiments are only used to more clearly explain and set forth the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand : It can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. spirit and scope.

Claims (10)

1. An intelligent security analysis management decision system based on network equipment, which is used for realizing security intelligent analysis and global decision of the network equipment based on network security attack or network security system setting fault of the network equipment in the operation process of a cloud system, so that a security event analysis decision is based on equipment confidence, processing level information and security event parameter set three-party entry parameters, and the system comprises:

each network device runs in a cloud computing network, processes a network data processing request provided by a client and returns a data processing result;

the network equipment is also used for sending a security event message to the security event normalizing device based on the network equipment intelligent security analysis management decision-making system when encountering a network security event;

the security event message is used for recording acquisition record information when the network equipment encounters a network security event;

the security event message is used for recording acquisition record information of the network device when encountering a network security event, and specifically includes: when a network device A encounters a network security event, the security event message at least records a network device ID, a first parameter set of the security event, a security event occurrence level and an association level of the network device;

the security event normalizing device is used for performing event-based message normalizing processing on a security event message sent by the network equipment, and at least disassembling the security event message into a network equipment ID field, a security event first parameter set field, a security event occurrence level and an associated level field of the network equipment;

the security event normalizer is also used for packaging the network equipment ID field of the network equipment into first event decision data and sending the first event decision data to an equipment confidence module; packaging the first parameter set field of the security event into second event decision data, and sending the second event decision data to a policy collection module; packaging the security event occurrence level and the association level into third event decision data, and sending the third event decision data to a processing level module;

the equipment confidence module is used for receiving the first event decision data, analyzing the network equipment ID of the network equipment, searching a network equipment security event confidence table based on the network equipment ID, determining a network equipment security event confidence value and sending the network equipment security event confidence value to the intelligent management decision module;

the policy collecting module is used for receiving and analyzing the second event decision data, determining a corresponding security policy collecting set based on the first parameter set field of the security event, and sending the corresponding security policy collecting set to the intelligent management decision module;

a processing hierarchy module; the processing level module is used for receiving the third event decision data, analyzing the occurrence level and the association level of the security event, determining the corresponding security event processing operation level authority requirement based on the occurrence level and the association level of the security event, and sending the determined corresponding security event processing operation level authority requirement to the intelligent management decision module;

wherein the corresponding security event processing operation level authority requirement is at least higher than or equal to the associated level of the security event;

the intelligent management decision module receives the network equipment security event confidence value, the security policy collection and the corresponding security event processing operation level authority requirement, and determines whether to execute the security event intelligent management decision based on the comparison of the security event confidence value and the confidence threshold value;

wherein, the determining whether to execute the security event intelligent management decision based on the comparison of the security event confidence value and the confidence threshold value specifically comprises:

when the confidence value of the security event is greater than the confidence threshold value, directly executing an intelligent management decision of the security event; when the security event confidence value is smaller than the confidence threshold value, judging whether the random number result selected in the range of [0,1] falls in [0, K1] by adopting a random algorithm with the security event confidence value K1 as the probability, if so, executing the security event intelligent management decision, if not, not executing the security event intelligent management decision, and confirming that the security event is false alarm;

the security event intelligent management decision comprises at least: opening the processing operation level authority required by the security event processing operation level authority requirement to a security event processing object, processing the security event by adopting a corresponding security strategy based on the security strategy set, and recording the security event to a database.

2. The intelligent network device based security analysis and management decision making system of claim 1, wherein said network device is a cloud computing edge server, a router, a gateway or a service host.

3. The system of claim 2, wherein the network security event comprises at least one of: network attack event, non-attack network fault event and network information security level change event.

4. The network device based intelligent security analysis management decision making system of claim 2, wherein:

the network equipment safety event confidence table is preset by the network equipment-based intelligent safety analysis management decision system, the network equipment safety event confidence table at least comprises network equipment ID information and network equipment safety event confidence values corresponding to the network equipment ID information one by one, and the network equipment safety event confidence values are calculated based on the historical safety event confidence degrees of the network equipment stored in a system database.

5. The network device based intelligent security analysis management decision making system of claim 4, wherein:

and the credibility of the historical security events of the network equipment stored in the system database is equal to the false alarm probability of the historical security events of the network equipment, and the network equipment is updated and dynamically changed along with the continuous reporting of the security events of the network equipment.

6. An intelligent security analysis management method based on network equipment is based on network security attack or network security system setting fault of the network equipment in the operation process of a cloud system, so that security event analysis decision is based on equipment confidence, processing level information and security event parameter set three-party entry parameters, and security intelligent analysis and global decision of the network equipment are realized, and the method comprises the following steps:

the method comprises the following steps: operating each network device in a plurality of network devices to enable the network device to operate in a cloud computing network, processing a network data processing request provided by a client and returning a data processing result;

the network equipment is also used for sending a security event message to the security event normalizing device based on the network equipment intelligent security analysis management decision-making system when encountering a network security event;

the security event message is used for recording the acquisition record information when the network equipment encounters a network security event;

the security event message is used for recording acquisition record information of the network device when encountering a network security event, and specifically includes: when a network device A encounters a network security event, the security event message at least records a network device ID, a first parameter set of the security event, a security event occurrence level and an association level of the network device;

step two: operating a security event normalizing device to perform event-based message normalization processing on a security event message sent by the network equipment, and at least disassembling the security event message into a network equipment ID field, a security event first parameter set field, a security event occurrence level and an associated level field of the network equipment;

the security event normalizer is also used for packaging the network equipment ID field of the network equipment into first event decision data and sending the first event decision data to an equipment confidence module; packaging the first parameter set field of the security event into second event decision data, and sending the second event decision data to a policy collecting module; packaging the security event occurrence level and the association level into third event decision data, and sending the third event decision data to a processing level module;

step three: the operation equipment confidence module receives the first event decision data, analyzes the network equipment ID of the network equipment, searches a network equipment safety event confidence table based on the network equipment ID, determines a network equipment safety event confidence value and sends the network equipment safety event confidence value to the intelligent management decision module;

step four: an operation strategy collection module receives and analyzes the second event decision data, determines a corresponding safety strategy collection based on the first parameter set field of the safety event, and sends the corresponding safety strategy collection to an intelligent management decision module;

step five: the operation processing level module receives the third event decision data, analyzes the security event occurrence level and the association level in the third event decision data, determines the corresponding security event processing operation level authority requirement based on the security event occurrence level and the association level, and sends the determined corresponding security event processing operation level authority requirement to the intelligent management decision module;

wherein the corresponding security event processing operation level permission requirement is at least higher than or equal to the association level of the security event;

step six: an operation intelligent management decision module receives the network equipment security event confidence value, the security policy collection and the corresponding security event processing operation level authority requirement, and determines whether to execute a security event intelligent management decision based on the comparison of the security event confidence value and a confidence threshold value;

wherein, the determining whether to execute the security event intelligent management decision based on the comparison of the security event confidence value and the confidence threshold value specifically comprises:

when the confidence value of the security event is greater than the confidence threshold value, directly executing an intelligent management decision of the security event; when the confidence value of the security event is smaller than a confidence threshold value, judging whether a random number result selected in the range of [0,1] falls in the range of [0, K1] by using the confidence value K1 of the security event as a probability by adopting a random algorithm, if so, executing an intelligent management decision of the security event, if not, not executing the intelligent management decision of the security event, and confirming that the security event is false alarm;

the security event intelligent management decision comprises at least: opening the processing operation level authority required by the security event processing operation level authority requirement to a security event processing object, processing the security event by adopting a corresponding security strategy based on the security strategy set, and recording the security event to a database.

7. The intelligent network device-based security analysis management method of claim 6, wherein the network device is a cloud computing edge server, a router, a gateway, or a service host.

8. The intelligent network-device-based security analysis and management method according to claim 7, wherein the network security event comprises at least one of the following events: network attack event, non-attack network fault event and network information security level change event.

9. The intelligent security analysis and management method based on network devices of claim 7, wherein:

the network equipment safety event confidence table is preset by the network equipment-based intelligent safety analysis management decision-making system, the network equipment safety event confidence table at least comprises network equipment ID information and network equipment safety event confidence values in one-to-one correspondence with the network equipment ID information, and the network equipment safety event confidence values are calculated based on historical safety event confidence degrees of the network equipment stored in a system database.

10. The network-device-based intelligent security analysis and management method of claim 9, wherein:

the credibility of the historical security events of the network equipment stored in the system database is equal to the false alarm probability of the historical security events of the network equipment, and the network equipment is updated and dynamically changed along with the continuous reporting of the security events of the network equipment.

Images