基于安全态势感知的智能决策与联动防护方案研究

Research on Intelligent Decision Making and Linkage Protection Scheme Based on Security Situation Awareness

针对企业的安全防护资源和防护手段的局限性,提出了基于安全态势感知的智能决策与联动防护方案。方案采用安全态势感知,对骨干网络、云上安全服务和企业端点安全设备日志进行异源数据分析,实现实时攻击预警;针对攻击预警,进行智能决策形成预判结果和防护建议;根据防护建议对防护服务和设备进行联合调度,通过动态策略调整,形成对目标的有效保护,从而形成一套云网端的闭环防护体系。

Aiming at the limitations of enterprise security protection resources and protection methods,it proposes an intelligent decision-making and linkage protection scheme based on security situational awareness. The solution uses security situational awareness to analyze the basic network,cloud security services and enterprise endpoint security device logs to achieve realtime attack warning. In viewof attack warnings,intelligent decision-making is made to form pre-judgment results and protection suggestions. According to protection suggestions,the services and devices is jointly scheduled,and the effective protection of the target is formed through the adjustment of dynamic strategies,so as to form a closed-loop protection system on the cloud and network side.