TWM639265U - Advanced Threat Protection Event Information Integration System - Google Patents

Abstract

An advanced threat protection event information integration system, which is used to integrate the protection log files in the external host and provide it to the system administrator to implement routine protection operations, including: a communication module for accessing the protection log files in the external host Log files; data preprocessing module, which is used to generate standardized files after data preprocessing of protection log files; data association module, used to receive standardized files, and perform data association operations on standardized files to generate associated files; protection suggestions The analysis module is used to receive associated files, generate protection event reports through big data analysis operations, and send them back to the system administrator’s device for routine protection operations; and the database is used to store standardized files and associated files , Protection incident reports and internal information.

Description

Advanced Threat Protection Event Information Integration System

The present invention discloses an advanced threat protection event information integration system, especially an advanced threat protection event information integration system that can automatically analyze data and give corresponding risk levels.

The advanced threat protection system device daily report used in the current technology neither provides detailed event information nor supports the export of raw data. Even if the event information is retrieved through Security Information and Event Management (SIEM), it still needs to Classify and analyze a large amount of data, such as: internal weak scan behavior, in-line download behavior, etc.; and, for external malicious connections, it is necessary to query multiple external information to determine whether to use the firewall to block; For external connections of suspicious domains, it is necessary to confirm whether they are blocked by other information security devices. Issues related to communication security are very complicated and difficult to unify, which will inevitably impose a heavy burden on the operation of information security personnel.

Therefore, how to develop an advanced threat protection event information integration system that can automatically capture and analyze various intelligence data, and automatically give the corresponding risk level to facilitate information security personnel as a reference for routine maintenance operations has become a problem. very important issue.

The purpose of this new model is to provide an advanced threat protection event information integration system, which is used to integrate multiple protection log files in multiple external hosts after the protection event information integration operation, and provide the system administrator with the system administrator device embodiment Perform protection operations, including: communication module, data preprocessing module, data association module, protection suggestion analysis module and database.

Optionally, the communication module is connected to the external host and the system administrator device for accessing the protection log file in the external host; the data preprocessing module is connected to the communication module for the protection Multiple standardized files are generated after data preprocessing of the log files; the data association module is signal-connected to the communication module and the data preprocessing module for receiving standardized files, and according to internal information and external information, will Multiple associated files are generated after the data association operation of the standardized file; the protection suggestion analysis module, the signal connection communication module and the data association module are used to receive the associated files, and carry out protection events on the associated files through big data analysis operations After the information integration operation, a protection event report is generated and sent back to the system administrator’s device through the communication module for routine protection operations; the database, signal connection data preprocessing module, data association module and protection suggestion analysis Module, used to store standardized files, associated files, protection event reports and internal information.

Optionally, the external host includes: a security information and event management host, a sandbox analysis system, a network proxy server, a web application firewall or a combination thereof.

Optionally, the data preprocessing job includes: a decompression job, a renaming job or a combination thereof.

Optionally, the data association module performs data association operations through event classification of internal information and risk degree of external information.

Optionally, the protection suggestion analysis module performs a protection event information integration operation through multiple protection risk parameters to generate a protection event report.

Optionally, the protection risk parameters include the risk degree of external information and the internal firewall performance of internal information.

Optionally, the performance of the internal firewall includes: network traffic processing capacity, threat behavior network traffic processing capacity, ability to record the number of new connections established per second, maximum connection capacity or a combination thereof.

Optionally, the protection event report has recommended blocking days.

Optionally, the new advanced threat protection event information integration system further includes: a feedback module, a signal connection communication module, a database and a protection suggestion analysis module, when the system administrator does not accept the output of the big data analysis operation The protection event report sends correction commands to the feedback module through the system administrator device, and the correction commands are then passed to the protection suggestion analysis module to correct the big data analysis operation and store the corrected protection event reports in the database.

To sum up, this new type of advanced threat protection event information integration system can achieve the following effects: (1) greatly optimize the current routine protection operation process, and present it in a display method that is closer to routine protection operations, so the operation It does not take too much time for personnel to adapt quickly; (2) Through the integration of protection event information, the source of the event can be judged and analyzed more effectively, saving the working time of the operator; (3) It can automatically block according to the recommendations in the report The number of days is automatically blocked, and the blocking function is automatically unblocked after the specified period, which greatly reduces the burden on the firewall.

100: Advanced threat protection event information integration system

110: Communication module

120: Data preprocessing module

130: Data association module

140: Protection suggestion analysis module

150: Feedback Module

160: Database

200: external host

300: System Administrator Device

The accompanying drawings are provided to enable those having ordinary knowledge in the technical field of the present invention to further understand the present invention, and are incorporated and constitute a part of the description of the present invention. The accompanying drawings show the new It is an exemplary embodiment of the model, and is used to explain the principle of the new model together with the description of the new model. The following is a brief description of each figure of the present invention: FIG. 1 is a functional block diagram of an advanced threat protection event information integration system according to an embodiment of the present invention.

FIG. 2 is a flow chart of the operation of the advanced threat protection event information integration system according to an embodiment of the present invention.

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. . Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making progressive contributions all belong to the scope of protection of the present invention.

In view of the above problems, an embodiment of the present invention develops an advanced threat protection event information integration system, please refer to FIG. 1 , which is a functional block diagram of an advanced threat protection event information integration system according to an embodiment of the present invention. The above-mentioned advanced threat protection event information integration system 100 is used to integrate the protection event information of multiple protection log files in multiple external hosts 200, and then provide the system administrator with the system administrator device 300 to implement routine protection operations. , including: a communication module 110 , a data preprocessing module 120 , a data association module 130 , a protection suggestion analysis module 140 and a database 160 .

As mentioned above, the communication module 110 is connected to the external host 200 and the system administrator device 300 by signal, and is used to access the protection log files in the external host 200; the data preprocessing module 120, the signal connection communication module 110 is used to generate multiple standardized files after performing data preprocessing on the protection log file; the data correlation module 130 is connected to the communication module 110 and the data preprocessing module 120 by signal After receiving the standardized file, and according to the internal information and external information, a plurality of associated files are generated after performing data association operations on the standardized file; the protection suggestion analysis module 140, the signal connection communication module 110 and the data association The module 130 is used to receive the associated file, and after performing protection event information integration operation on the associated file through big data analysis operation, generate a protection event report, and send it back to the system administrator device through the communication module 110 300 for routine protection operations; database 160, signal connection data preprocessing module 120, data association module 130 and protection suggestion analysis module 140, used to store the standardized files, associated files, protection event reports and Internal information.

Next, the external host 200 is an external host related to information security event analysis, such as but not limited to: security information and event management host, sandbox analysis system, network proxy server, web application firewall, or combination.

Then, after the communication module 110 accesses the protection log files to the plurality of external hosts 200, it will perform data preprocessing operations, for example: decompress and rename each file to generate multiple standardized log files. files, and delivered to the database 160 for preservation, but the present invention is not limited thereto.

After the data preprocessing operation is completed, the plurality of standardized files will be transmitted to the data association module 130 for data association operation, wherein the data association operation is based on the event classification of internal information and the risk degree of external information to proceed. That is to say, classify events based on internal information (such as: IP; detailed usage of Hash, etc.); Do sorting and generate multiple relational files.

Furthermore, after the data association operation is completed, the plurality of associated files will be sent to the protection suggestion analysis module 140 for the protection event information integration operation, wherein the protection event information integration operation is based on multiple protection risk parameters After execution, a protection event report is generated. Moreover, the multiple protection risk parameters may be, for example, the risk levels of different external information and the performance of firewalls in internal information, but the present invention is not limited thereto.

Based on the above, the characteristic part of the internal firewall performance can be selected from the following groups, but the present invention is not limited thereto.

(1) Network traffic throughput (Firewall throughput): It is the general network traffic size that the firewall itself can handle, in Gbps.

(2) Threat Prevention throughput: The amount of network traffic that the firewall itself can handle against threat behaviors, in Gbps.

(3) The ability to record the number of new connections per second (New sessions per second): the number of new connections per second that the firewall itself can record.

(4) Maximum sessions: The maximum number of sessions that the firewall itself can record at the same time.

Moreover, it is worth noting that the protection event report generated after the data preprocessing operation, data association operation and protection event information integration operation will have the recommended blocking days for the firewall. In addition, the protection event information integration operation can use AI artificial intelligence (such as: neural network, machine learning, etc.) to perform big data analysis and then produce the protection event report, but the present model is not limited to this .

Furthermore, the advanced threat protection event information integration system 100 of the present invention also has a feedback module 150, which is signal connected to the communication module 110, the database 160 and the protection suggestion analysis module 140, When the system administrator does not accept the protection event report produced by the big data analysis operation, the system administrator device 300 sends a correction command to the feedback module 150, and the correction command is then passed to the protection suggestion analysis module 140 to correct the big data analysis operation , and store the amended protection event report in the database 160.

Here, a practical example is given to fully illustrate the implementation. For example, there are many daily newspapers in financial institutions, so let’s first select “Top 20 Malicious Websites” to illustrate. Firstly, the communication module 110 accesses information about the top 20 malicious websites from the external host 200, and after performing data preprocessing, data correlation, and protection event information integration operations, it generates a protection event report in a unified format, and transmits the information through the communication module. Group 110 is sent to system administrator device 300 for viewing.

The system administrator can check the query results of external information in detail by clicking on a specific column. For example, the Bluecoat information in the external information determines that the website that the user connects to is classified as Suspicious and Health. In addition, by combining the log information of the Internet proxy system, you can know whether the connection is blocked by the system; in addition, by combining the IP resource management system in the internal information, you can know which department the source IP address is in computer and user information.

Next, please refer to FIG. 2 to understand the operation process of the present invention. FIG. 2 is a flow chart of an advanced threat protection event information integration system according to an embodiment of the present invention. In step S202 of FIG. 2 , after the communication module 110 accesses a plurality of protection log files from each external host 200 , the process proceeds to step S204 .

In step S204 of FIG. 2 , after the data preprocessing module 120 preprocesses the plurality of protection log files, standardized files of consistent format are generated and stored in the database 160 , and then step S206 is continued.

In step S206 of FIG. 2 , the data association module 130 accesses the standardized files, and associates these standardized files according to internal information and external information to generate associated files, and then proceeds to step S208 .

In step S208 of FIG. 2 , the protection suggestion analysis module 140 then associates these files, uses machine learning function (or other AI artificial intelligence) to perform big data analysis, and generates a protection event report with risk level and recommended blocking days , and transmit it to the system administrator device 300 through the communication module 110, and continue to step S210.

In step S210 of FIG. 2 , the next process is determined according to whether the system administrator accepts the protection event report. If the system administrator accepts this report, then continue to step S214; otherwise, if the system administrator believes that there are some events in the protection event report whose recommended blocking days and/or risk levels do not meet the practical determination, then continue to step S212 .

In step S212 of FIG. 2 , when the system administrator does not accept the protection event report, it sends a correction instruction to the feedback module 150 through the system administrator device 300, and the correction instruction is then transmitted to the protection suggestion analysis module 140 for Feedback the machine learning model, and return to steps S208-210 to make a re-analysis to generate a revised protection event report, and send it to the system administrator device 300 again for the system administrator to view.

In step S214 of Fig. 2, when the system administrator accepts the protection event report (whether it is analyzed for the first time, or the protection event report corrected after feedback), the system administrator performs data processing according to the protection event report Routine protective work for security. In this way, the system will gradually refine the big data analysis as the instructions are revised, and obtain more and more accurate reports, which is convenient for information security personnel to carry out operations.

To sum up, the new advanced threat protection event information integration system has the following functions: (1) The current routine protection operation process is greatly optimized, and it is presented in a display method closer to the routine protection operation, so the operating personnel It does not take too much time to adapt quickly; (2) Through the integration of protection event information, the source of the event can be judged and analyzed more effectively, saving the working time of the operator; (3) The number of days that can be blocked automatically according to the recommendations in the report Automatically block and unblock after a specified period, greatly reducing the burden on the firewall.

Although the embodiments of the present invention have been shown and described, those skilled in the art can understand that various changes, modifications, substitutions and variants, the scope of the present invention is defined by the appended patent scope and its equivalents.

100: Advanced threat protection event information integration system

110: Communication module

120: Data preprocessing module

130: Data association module

140: Protection suggestion analysis module

150: Feedback Module

160: Database

200: external host

300: System Administrator Device

Claims (9)

An advanced threat protection event information integration system, which is used to provide a system administrator with a system administrator device to implement a routine protection after performing a protection event information integration operation on a plurality of protection log files in a plurality of external hosts The operation includes: a communication module, signally connected to the external hosts and the system administrator device, for accessing the protection log files in the external hosts; a data preprocessing module, signally connected to the communication module A group, which is used to perform a data preprocessing operation on these protection log files to generate a plurality of standardized files; a data correlation module, which is signally connected to the communication module and the data preprocessing module, and is used to receive the standardized files , and according to an internal information and an external information, a data association operation is performed on these standardized files to generate a plurality of associated files; a protection suggestion analysis module, a signal connection between the communication module and the data association module , used to receive these associated files, and integrate the protection event information on these associated files through a big data analysis operation to generate a protection event report and send it back to the system administrator through the communication module device for performing the routine protection operation; and a database, signally connected to the data preprocessing module, the data association module and the protection suggestion analysis module, for storing the standardized files, the associated files, The protection event report and the internal information. The advanced threat protection event information integration system as described in claim item 1, wherein the external hosts include a security information and event management host, a sandbox analysis system, a network proxy server, a web application firewall or its combination. The advanced threat protection event information integration system as described in Claim 1, wherein the data preprocessing operation includes a decompression operation, a renaming operation or a combination thereof. The advanced threat protection event information integration system as described in Claim 1, wherein the data association module performs the data association operation through an event classification of the internal information and a risk level of the external information. The advanced threat protection event information integration system as described in claim 4, wherein the protection suggestion analysis module performs the protection event information integration operation through a plurality of protection risk parameters to generate the protection event report. In the advanced threat protection event information integration system as described in Claim 5, wherein the protection risk parameters include the risk degree of the external information and the performance of an internal firewall of the internal information. The advanced threat protection event information integration system as described in claim item 6, wherein the performance of the internal firewall includes network traffic processing capacity, threat behavior network traffic processing capacity, the ability to record the number of new connections established per second, and the maximum connection capacity or a combination thereof. The advanced threat protection event information integration system as described in claim 1, wherein the protection event report has a suggested blocking days. The advanced threat protection event information integration system as described in request item 1 further includes: a feedback module, which is connected to the communication module, the database and the protection suggestion analysis module, and when the system administrator does not accept the The protection event report generated by the big data analysis operation sends a correction command to the feedback module through the system administrator device, and the correction command is then transmitted to the protection suggestion branch The analysis module is used to correct the big data analysis operation, and the corrected protection event report is stored in the database.

Images