CN109005165A - Integral network safety defence method, device and storage medium - Google Patents

Abstract

The embodiment of the invention discloses a kind of integral network safety defence method, device and storage mediums, are related to network safety filed.The method comprise the steps that obtaining the website abnormal information that monitoring system reports, the address information of abnormal website is carried in the website abnormal information；Based on the website abnormal information, cyber-defence integrated treatment is carried out；When the website abnormal for receiving the abnormal website feedback has removed information, the access authority of the abnormal website is opened.The present invention can be improved the validity of network security.

Description

Integrated network security defense method, device and storage medium

technical field

The invention relates to the field of network security, in particular to an integrated network security defense method, device and storage medium.

Background technique

With the continuous development of network technology, enterprises or users are increasingly dependent on the network. At the same time, network security has become an important concern in the process of network development.

At present, there are many security protection products, such as firewalls, intrusion detection systems, vulnerability scanning systems, website risk assessment systems, network application monitoring systems, online behavior auditing systems, etc. However, various security devices, network devices, application systems, etc. Different manufacturers, different models, and each device is isolated from each other and cannot be associated, resulting in network security that cannot be guaranteed.

Contents of the invention

Embodiments of the present invention provide an integrated network security defense method, device and storage medium, which can solve the problem that network security cannot be guaranteed.

In order to achieve the above object, embodiments of the present invention adopt the following technical solutions:

In the first aspect, an embodiment of the present invention provides an integrated network security defense method, which is characterized in that it includes:

Obtaining abnormal website information reported by the monitoring system, the abnormal website information carrying address information of the abnormal website;

Based on the abnormal information of the website, perform integrated network defense processing;

When the website abnormality cleared information fed back by the abnormal website is received, the access authority of the abnormal website is enabled.

With reference to the first aspect, in the first possible implementation manner of the first aspect, the integrated processing of network defense includes:

Through the administrator of the abnormal website, close the access authority of the abnormal website;

Through the firewall, close the external access authority of the abnormal website.

With reference to the first possible implementation of the first aspect, in the first possible implementation of the first aspect, the integrated processing of network defense further includes:

Based on the intrusion detection system, website risk assessment system, and vulnerability scanning system, the reasons for website abnormalities are obtained.

With reference to the second possible implementation of the first aspect, in a third possible implementation of the first aspect, the method further includes:

When the cause of the abnormality of the website is that the security hole is attacked by hackers, the administrator of the abnormal website performs the repair of the security hole.

With reference to the third possible implementation of the first aspect, in the fourth possible implementation of the first aspect, when the information that the abnormal website has been cleared is received from the abnormal website, start the abnormal website access rights, including:

When receiving feedback from the administrator of the abnormal website that the security vulnerability has been repaired, scan through the vulnerability scanning system to confirm whether there is currently a vulnerability in the abnormal website;

In response to receiving the feedback from the vulnerability scanning system that there is currently no security vulnerability information, enable the access authority of the abnormal website.

In a second aspect, embodiments of the present invention provide an integrated network security defense device, including:

An acquisition module, configured to acquire abnormal website information reported by the monitoring system, where the abnormal website information carries address information of the abnormal website;

A defense module, configured to perform integrated processing of network defense based on the abnormal information of the website;

The opening module is used to open the access authority of the abnormal website when receiving the information that the website abnormality has been cleared from the feedback of the abnormal website.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the defense module includes:

The first closing sub-module is used to close the access authority of the abnormal website through the administrator of the abnormal website;

The second closing sub-module is used to close the external access authority of the abnormal website through the firewall.

With reference to the first possible implementation of the second aspect, in the first possible implementation of the second aspect, the defense module further includes:

The obtaining sub-module is used to obtain the cause of the abnormality of the website based on the intrusion detection system, the website risk assessment system, and the vulnerability scanning system.

With reference to the second possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the device further includes:

The repairing module is used for repairing the security hole through the administrator of the abnormal website when the reason for the abnormality of the website is that the security hole is attacked by hackers.

In combination with the third possible implementation of the second aspect, the fourth possible implementation of the second aspect includes:

The confirmation sub-module is used to scan and confirm whether the abnormal website currently has a vulnerability through the scanning of the vulnerability scanning system when receiving the information that the security vulnerability has been repaired fed back by the administrator of the abnormal website;

The opening sub-module is used to open the access authority of the abnormal website in response to receiving the information that there is currently no security vulnerability fed back by the vulnerability scanning system.

In a third aspect, an embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored, wherein, when the program is executed by a processor, the steps of the method provided in the first aspect are implemented.

The integrated network security defense method, device, and storage medium provided by the embodiments of the present invention obtain the abnormal website information reported by the monitoring system, and the abnormal website information carries the address information of the abnormal website; based on the abnormal website information, the Integrated processing of network defense; when receiving feedback from the abnormal website that the website abnormality has been cleared, enable access to the abnormal website. It is possible to obtain abnormal website information through the network defense integrated platform, and uniformly dispatch all network security devices associated with the platform for unified network security defense, so that various security devices, network devices, application systems, etc. are involved in different manufacturers, Different models and each device are related to each other, which can realize the linkage of multiple security devices upstream and downstream and the issuance of one-click control commands, provide network security active defense, notification and early warning, and corresponding support, thereby improving the effectiveness of network security.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the accompanying drawings that need to be used in the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without making creative efforts.

FIG. 1 is a schematic flow diagram of an integrated network security defense method according to an embodiment of the present invention;

Fig. 2 is another schematic flow chart of the integrated network security defense method according to the embodiment of the present invention;

3 is a schematic structural diagram of an integrated network security defense device according to an embodiment of the present invention;

Fig. 4 is a schematic structural diagram of a defense module according to an embodiment of the present invention;

Fig. 5 is another structural schematic diagram of the integrated network security defense device according to the embodiment of the present invention;

Fig. 6 is a schematic structural diagram of an opening module according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of an integrated network security defense device 700 according to an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

An embodiment of the present invention provides an integrated network security defense method, as shown in Figure 1, the method includes:

101. Obtain abnormal website information reported by the monitoring system, where the abnormal website information carries address information of the abnormal website.

102. Based on the abnormal website information, perform integrated network defense processing.

Among them, the integrated processing of network defense involves related equipment or systems such as administrators of abnormal websites, firewalls, intrusion detection systems, website risk assessment systems, and vulnerability scanning systems.

103. When receiving the information that the website abnormality has been cleared from the abnormal website, enable the access permission of the abnormal website.

Compared with the prior art, the embodiment of the present invention can obtain the abnormal website information through the integrated network defense platform, and uniformly dispatch all network security devices associated with the platform to perform network security defense in a unified manner, so that various security devices, Network devices and application systems all involve different manufacturers and models, and the devices are related to each other. It can realize the linkage of multiple security devices upstream and downstream and the issuance of one-click control commands, and provide network security active defense, notification and early warning and corresponding support, which in turn can increase the effectiveness of cybersecurity.

Another embodiment of the present invention provides an integrated network security defense method, as shown in Figure 2, the method includes:

201. Obtain abnormal website information reported by the monitoring system, where the abnormal website information carries address information of the abnormal website.

202. Close the access authority of the abnormal website through the administrator of the abnormal website.

203. Close the external access authority of the abnormal website through the firewall.

204. Based on the intrusion detection system, the website risk assessment system, and the vulnerability scanning system, obtain the cause of the website abnormality.

In the embodiment of the present invention, any one or more of the intrusion detection system, the website risk assessment system, and the vulnerability scanning system can cooperate to obtain the cause of the abnormality of the website.

Wherein, the website abnormality may be a problem such as abnormal website visits.

205. When the reason for the website abnormality is that a security hole is attacked by a hacker, the administrator of the abnormal website repairs the security hole.

206. When receiving feedback from the administrator of the abnormal website that the security vulnerability has been repaired, scan and confirm whether the abnormal website currently has a vulnerability through the vulnerability scanning system.

207. In response to receiving the information that there is currently no security vulnerability fed back by the vulnerability scanning system, enable the access authority of the abnormal website.

Compared with the prior art, the embodiment of the present invention can obtain the abnormal website information through the integrated network defense platform, and uniformly dispatch all network security devices associated with the platform to perform network security defense in a unified manner, so that various security devices, Network devices and application systems all involve different manufacturers and models, and the devices are related to each other. It can realize the linkage of multiple security devices upstream and downstream and the issuance of one-click control commands, and provide network security active defense, notification and early warning and corresponding support, which in turn can increase the effectiveness of cybersecurity.

Another embodiment of the present invention provides an integrated network security defense device, as shown in Figure 3, the device includes:

The obtaining module 31 is used to obtain the abnormal website information reported by the monitoring system, and the abnormal website information carries the address information of the abnormal website;

A defense module 32, configured to perform integrated processing of network defense based on the abnormal information of the website;

The opening module 33 is configured to open the access authority of the abnormal website when receiving the information that the website abnormality has been cleared from the feedback of the abnormal website.

Further, as shown in Figure 4, the defense module 32 includes:

The first closing sub-module 3201 is used to close the access authority of the abnormal website through the administrator of the abnormal website;

The second closing sub-module 3202 is configured to close the external access authority of the abnormal website through the firewall.

The obtaining sub-module 3203 is used to obtain the cause of the abnormality of the website based on the intrusion detection system, the website risk assessment system, and the vulnerability scanning system.

Further, as shown in Figure 5, the device also includes:

The repairing module 51 is used for repairing the security hole through the administrator of the abnormal website when the cause of the abnormality of the website is that the security hole is attacked by hackers.

Further, as shown in Figure 6, the opening module 33 includes:

Confirmation sub-module 3301, configured to scan and confirm whether the abnormal website currently has a vulnerability through the vulnerability scanning system when receiving feedback from the administrator of the abnormal website that the security vulnerability has been repaired;

The opening sub-module 3302 is configured to open the access authority of the abnormal website in response to receiving the information that there are currently no security vulnerabilities fed back by the vulnerability scanning system.

Compared with the prior art, the embodiment of the present invention can obtain the abnormal website information through the integrated network defense platform, and uniformly dispatch all network security devices associated with the platform to perform network security defense in a unified manner, so that various security devices, Network devices and application systems all involve different manufacturers and models, and the devices are related to each other. It can realize the linkage of multiple security devices upstream and downstream and the issuance of one-click control commands, and provide network security active defense, notification and early warning and corresponding support, which in turn can increase the effectiveness of cybersecurity.

The embodiment of the present invention also provides another computer-readable storage medium, which may be the computer-readable storage medium included in the memory in the above-mentioned embodiments; or exist independently and not be assembled into the terminal computer readable storage media. The computer-readable storage medium stores one or more programs, and the one or more programs are used by one or more processors to execute the integrated network security defense method provided by the embodiments shown in FIG. 1 and FIG. 2 .

The integrated network security defense device provided in the embodiment of the present invention can implement the method embodiment provided above. For specific function implementation, please refer to the description in the method embodiment, and details will not be repeated here. The integrated network security defense method, device, and storage medium provided by the embodiments of the present invention may be applicable to integrated network security defense, but are not limited thereto.

As shown in FIG. 7 , the integrated network security defense device 700 can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a personal digital assistant, and the like.

Referring to FIG. 7, the integrated network security defense device 700 may include one or more of the following components: a processing component 702, a memory 704, a power supply component 706, a multimedia component 708, an audio component 710, and an input/output (I/O) interface 712 , sensor component 714, and communication component 716.

The processing component 702 generally controls the overall operations of the drone control device 700, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. Processing component 702 may include one or more processors 720 to execute instructions.

Additionally, processing component 702 may include one or more modules that facilitate interaction between processing component 702 and other components. For example, processing component 702 may include a multimedia module to facilitate interaction between multimedia component 708 and processing component 702 .

The memory 704 is configured to store various types of data to support operations at the drone control device 700 . Examples of such data include instructions for any application or method operating on the drone control device 700, contact data, phonebook data, messages, pictures, videos, etc. The memory 704 can be realized by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic or Optical Disk.

The power supply component 706 provides power to various components of the drone control device 700 . Power components 706 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to drone control 700 .

The multimedia component 708 includes a screen that provides an output interface between the drone control device 700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may not only sense a boundary of a touch or swipe action, but also detect duration and pressure associated with the touch or swipe action. In some embodiments, the multimedia component 708 includes a front camera and/or a rear camera. When the UAV control device 700 is in an operation mode, such as a shooting mode or a video mode, the front camera and/or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have focal length and optical zoom capability.

The audio component 710 is configured to output and/or input audio signals. For example, the audio component 710 includes a microphone (MIC), which is configured to receive external audio signals when the drone control device 700 is in operation modes, such as calling mode, recording mode and voice recognition mode. Received audio signals may be further stored in memory 704 or sent via communication component 716 . In some embodiments, the audio component 710 also includes a speaker for outputting audio signals.

The I/O interface 712 provides an interface between the processing component 702 and a peripheral interface module, which may be a keyboard, a click wheel, a button, and the like. These buttons may include, but are not limited to: a home button, volume buttons, start button, and lock button.

Sensor assembly 714 includes one or more sensors for providing various aspects of status assessment for drone controls 700 . For example, the sensor assembly 714 can detect the open/closed state of the drone control device 700, the relative positioning of components, such as the display and keypad of the drone control device 700, and the sensor assembly 714 can also detect unmanned vehicles. A change in position of drone controls 700 or a component of drone controls 700 , presence or absence of user contact with drone controls 700 , drone controls 700 orientation or acceleration/deceleration and drone controls 700 temperature change. Sensor assembly 714 may include a proximity sensor configured to detect the presence of nearby objects in the absence of any physical contact. Sensor assembly 714 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor component 714 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor or a temperature sensor.

The communication component 716 is configured to facilitate wired or wireless communication between the drone control device 700 and other devices. The UAV control device 700 can access wireless networks based on communication standards, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 716 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 716 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

In an exemplary embodiment, the drone control device 700 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs) , field programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic components.

Each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for relevant parts, please refer to part of the description of the method embodiment.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct related hardware, and the programs can be stored in a computer-readable storage medium. During execution, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM) or a random access memory (Random Access Memory, RAM) and the like.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. All should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (11)

1. a kind of integral network safety defence method characterized by comprising

The website abnormal information that monitoring system reports is obtained, the address letter of abnormal website is carried in the website abnormal information Breath；

Based on the website abnormal information, cyber-defence integrated treatment is carried out；

When the website abnormal for receiving the abnormal website feedback has removed information, the access right of the abnormal website is opened Limit.

2. integration integral network safety defence method according to claim 1, which is characterized in that the carry out network Defend integrated treatment, comprising:

By the administrator of the abnormal website, the access authority of the abnormal website is closed；

By firewall, the outside access permission of the abnormal website is closed.

3. integration integral network safety defence method according to claim 2, which is characterized in that the carry out network Defend integrated treatment, further includes:

Based on intruding detection system, website risk evaluating system, vulnerability scanning system, website abnormal reason is obtained.

4. integration integral network safety defence method according to claim 3, which is characterized in that the method is also wrapped It includes:

When website abnormal reason be security breaches by hacker attack when, the administrator for passing through the abnormal website carries out safe leakage It repairs in hole.

5. integration integral network safety defence method according to claim 4, described to receive the abnormal net When the website abnormal for feedback of standing has removed information, the access authority of the abnormal website is opened characterized by comprising

When receiving the security breaches restoration information of administrator's feedback of the abnormal website, pass through the vulnerability scanning system The system scanning confirmation abnormal website currently whether there is loophole；

In response to receiving the current no safety loophole information of the vulnerability scanning system feedback, the visit of the abnormal website is opened Ask permission.

6. a kind of integral network safety defence installation characterized by comprising

Module is obtained, the website abnormal information reported for obtaining monitoring system carries exception in the website abnormal information The address information of website；

Defense module carries out cyber-defence integrated treatment for being based on the website abnormal information；

Opening module, for opening the exception when the website abnormal for receiving the abnormal website feedback has removed information The access authority of website.

7. integration integral network safety defence installation according to claim 6, which is characterized in that the defence mould Block, comprising:

First closes submodule, for the administrator by the abnormal website, closes the access authority of the abnormal website；

Second closes submodule, for closing the outside access permission of the abnormal website by firewall.

8. integration integral network safety defence installation according to claim 7, which is characterized in that the defence mould Block, further includes:

It is different to obtain website for being based on intruding detection system, website risk evaluating system, vulnerability scanning system for acquisition submodule Normal reason.

9. integration integral network safety defence installation according to claim 8, which is characterized in that described device is also wrapped It includes:

Repair module, for when website abnormal reason be security breaches by hacker attack when, pass through the pipe of the abnormal website Reason person carries out security breaches reparation.

10. integration integral network safety defence installation according to claim 9, which is characterized in that the unlatching mould Block, comprising:

Submodule is confirmed, for leading to when receiving the security breaches restoration information of administrator's feedback of the abnormal website Crossing the vulnerability scanning system scanning confirmation abnormal website currently whether there is loophole；

Submodule is opened, for the current no safety loophole information in response to receiving the vulnerability scanning system feedback, is opened The access authority of the exception website.

11. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that described program is processed The step of claim 1-5 the method is realized when device executes.