TW201122895A - Security operation and instant messaging system, its union defense system and union defense method. - Google Patents

Abstract

A security operation and instant messaging system, its union defense system and a union defense method are disclosed. The present invention is provided for a security operation center (SOC) to perform real-time reporting of a monitored event, such that an instant messaging agent (IM agent) can perform analysis and process of the monitored event, so as to determine whether the monitored event can be handled by oneself or needs to be reported to monitoring personnel via instant messaging according to an analysis result of the monitored event and pre-stored event records. Furthermore, the security operation and instant messaging union defense system and its union defense method of the present invention allow each security operation center to have its own union defense contant person list respectively, so as to facilitate each security operation center to perform instant message delivery of monitored event reporting and event process recording, thereby achieving union defense effect among each of the security operation centers.

Description

201122895 . VI. Description of the Invention: [Technical Field] The present invention relates to a security monitoring instant messaging system and its joint prevention system and a joint prevention method. More specifically, it is a type of monitoring event and countermeasures transmitted through instant messaging. The security monitoring instant messaging system, the integrated defense system of a plurality of the security monitoring instant messaging systems, and the joint prevention method of the security monitoring and the instant communication. [Prior Art]

With the rapid development of the computer network, 'people's life and the Internet are closely related'. Whether it is querying data or online shopping, it is through the network to communicate between the computer and the server, so the network is more important. In addition to the common data leakage, Internet security is also a security attack on computers that suffer from network connection anomalies or virus intrusions.

Due to the emergence of cyber attacks, network security has become more and more important, especially for large enterprises or public organizations. For the sake of network security, it is not easy to ignore, such as: common mail viruses, phishing or If you have a network intrusion, a Trojan horse, a computer worm, etc., the server host of a large organization may have a system intrusion or a network attack. In addition to the possibility of data being stolen, it is more central ( Security Operation Center' SOC) monitors and alerts the security threats, provides appropriate solutions, and informs the system to achieve monitoring or defense effects, thereby preventing enterprises from establishing a network of computers. Generally speaking, 'enterprise institutions are more self-targeting'. 'Security monitoring. Centralized management and other methods, control, notification and analysis and handling. Security personnel 3 111314 201122895 The losses caused by the organization's security problems. At present, when the network security monitoring center of the enterprise organization receives the security attack, the system will analyze and process the information and notify the information. However, there are still many inconveniences in this mode, such as the monitoring part. The security personnel need 24 hours. Monitoring on a specific computer or handling the security situation, this will cause inconvenience to the security personnel; in addition, the message is reported. Most of the previous emails are sent to the security personnel emails, if the security personnel just do not receive The mail is just not in front of the computer, and it may cause serious harm from the important security incident. In addition, at present, the information security monitoring centers of various enterprise organizations have been deployed outside the committee. The biggest problem is that each security monitoring system has its own definition or setting. In short, it is more difficult to communicate or communicate between systems. Therefore, it is difficult for each company to use its own system, except that the resources of the security resources cannot be shared. If the system or the security personnel cannot solve the problem immediately, it is difficult to get immediate help. In short, it is The lack of the concept and practice of joint defense of security, so that only half of the situation occurs, but also make the enterprise security more inadequate. Therefore, how to make the security monitoring system deal with security problems can save time and convenience. In addition to being able to notify the monitoring personnel at any place, it is expected to form a joint system among the systems to achieve the effect of joint defense. In other words, through the concept of joint defense between systems, each system achieves the purpose of communication and monitoring information sharing, thereby reducing the waste of resources and having a multiplier effect. In summary, it is a technical issue that is currently being solved. SUMMARY OF THE INVENTION In view of the above-mentioned shortcomings of the prior art, the present invention provides a security supervisor 4 111314 201122895, a control instant messaging system and its joint defense system and a joint defense method, which will monitor events and countermeasures through instant messaging. Instant notification for the purpose of security monitoring. ^

Ben: Ming: For a security monitoring instant messaging system, used for security monitoring center subscription event monitoring and instant notification, including: event database, using f to store multiple event records; instant messaging agent (IM r two r According to the event records stored in the event database, the monitoring events detected by the second control center; and the list of contacts are stored as the contact person's monitoring personnel. (4) The communication agent immediately transmits the processed event to the monitoring personnel. In the application, 'the event of the custody handled by the instant messaging agent is transmitted to the monitoring personnel via the instant messaging software'. In the specific embodiment, the event is recorded as a security (10)^ event 20% (four) ^ 卩 time track agent complex includes: == two analysis of the status and level of the security event to analyze ·::: = The security records stored in the database to handle the security information =: Lian:: The monitoring personnel information stored in the list will be sent to the supervisor == two for the analysis module to pass the security incident Instruction; and processing; And is used to receive the monitoring personnel to transmit the fruit, and ^m2, and the 'pure (four) analysis module analyzes the node of the event database =::;: rr the instruction transmitted by the monitoring personnel or the analysis module The following is the processing of the security incident. The analysis is conducted to analyze the correlation between the female incident and the security record. The Xianan incident is related to the security record. 111314 5 201122895 The security event is processed by the security record stored in the event database. In addition, in another embodiment, the monitoring event is a sensing event, and the security monitoring instant messaging system is connected to the wireless sensing network. The wireless sensing network is formed by a plurality of sensors, and the sensing data captured by the sensor is transmitted back to the security monitoring center through wireless technology, as the instant messaging agent handles the security. The sensing event detected by the monitoring center. The invention further provides a joint defense system integrating a plurality of the foregoing security monitoring instant messaging systems. The joint defense system includes: a plurality of linked preventer lists, respectively In the fully-monitored instant messaging system, each of the joint liaisons stores the information of the monitoring personnel and other instant messaging agent information of the secure age communication system for the security of the security personnel. *Beca will immediately transmit the container control event handled by the instant messaging agent to the monitoring and monitoring instant messaging system. - The security of the insufficiency is 'the monitoring event is the f-an event, and the matter is recorded. The message of the incident with the local instant messenger's security incident includes the #安 event notification or the security record. The cow is related to: the instant messaging agent is controlled by the instant messaging agent. Relevant 'Ht local event database update. Event addition' The monitoring event is also a sensing event, the security system is connected to the wireless sensing network 'The wireless sensing network ^ by 201122895 · ·.» The safety supervision w贞 (4) (4) communication agent office The present invention also provides a security monitoring and law, which is used in a plurality of security monitoring ▲ the joint defense party to prevent purple 'this security monitoring and instant messaging; :== vertical

The list of contacts is stored in the monitoring personnel ==! All the joint defense data; so that the security monitoring center analyzes the monitoring event and the stored events, to analyze the Whether the monitoring event is recorded with the matter and the security monitoring towel'. Analytical association; The monitoring event is sealed into two: * The monitored personnel and the other security monitoring centers analyzed. People π early notice

Among them, the monitoring event is a security incident, which records 6 records and is monitored through the multiple security monitoring centers (4), = event monitoring, instant notification and event handling. , _ beta network connection, the wireless control technology does not pass the control center, and the monitoring heart is received. In addition, the security monitoring center and the wireless sensing line sensing network are composed of a plurality of sensors. The sensing data acquired by the sensor is returned to the safety monitoring event as a sensing event for analysis in the safety monitoring. Compared with the 0 technologies, the security monitoring instant messaging system of the present invention has its joint defense system β and the joint defense method, and provides the security monitoring center to control the effect of the instant monitoring notification when the communication is reached, and the contact list is also obtained. The method can establish a joint defense mechanism, and each security monitoring center is formed into a tree-like joint system to transmit monitoring event related information, and provide information such as monitoring event notification, processing or event record to improve security monitoring of each security monitoring center. Defensive capabilities and monitoring the speed and intensity of event processing. In addition, the joint defense concept is not only used for information security monitoring and processing, but also forms a mesh network structure with wireless technology and multiple sensors, and processes and transmits the captured sensing data. Each security monitors the messaging and joint defense between instant messaging systems. [Embodiment] The technical contents of the present invention are described below by way of specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in the present specification. As shown in Fig. 1, it is a block diagram of the basic system architecture and application architecture of the security monitoring instant messaging system of the present invention. As shown in the figure, the security monitoring instant messaging system 1 is used for security monitoring center for event monitoring and instant notification, and includes an instant messaging agent 10, an event database 11 and a contact list 12. The security monitoring instant messaging system 1 is installed in a security monitoring center (not shown here) for monitoring, analyzing, judging and processing the detected monitoring events, when the instant messaging agent 10 receives security. After the monitoring center reports the monitoring event, it monitors, analyzes and processes the monitoring event; and the event database 11 is connected to the instant messaging agent 10 for storing a plurality of event records, and the event record is Refers to the relevant monitoring event related information, including 8 111314 201122895,,, . Contains information such as status, grade, analysis results and treatment countermeasures; the contact list 12 contains the monitoring personnel information as the contact person for the purpose The instant messaging agent 10 performs a monitoring event notification to immediately transmit the monitoring event to the communication device of the monitoring person in the contact list 12, which may be a computer, a mobile phone, a PAD or an electronic device for accessing the Internet. The instant messaging agent 10 and the monitoring personnel in the contact list 12 transmit information through the instant messaging software (not shown here), that is, the monitoring personnel only need to have a device capable of accessing the Internet, such as • As shown in Fig. 1, the instant messaging agent 10 can transmit the message to the monitoring personnel terminal 20 through an instant messaging network formed by one or more IM servers. In short, since the monitoring event is transmitted by the instant messaging soft network through the instant messaging software, no matter where the monitoring personnel are located, the instant messaging software can be instantly received only when the instant messaging software is set to the open state. Monitoring event related information, therefore, the monitoring personnel need not be limited to a single computer to perform 24-hour monitoring actions, or can only know the occurrence of monitoring events after sending and receiving emails. Moreover, the instant messaging soft system used is selected by the contact list 12 as a contact, and the advantage is that the monitoring personnel can be grouped or classified so that only some monitoring personnel can be notified according to differences in monitoring content, time allocation or attributes. Or inform the relevant personnel, so that the monitoring of event notifications is more convenient. In a specific embodiment, the monitoring event may be a security incident, and the information security event is monitored through the security monitoring instant messaging system, and the event is recorded as a security record, which is a variety of security incidents and processing parties. 9 111314 201122895 ,,. As shown in Fig. 2, it is a block diagram showing the basic architecture of the instant messaging agent of the specific embodiment of the security monitoring instant communication system of Fig. 1. As shown in the figure, the security monitoring instant messaging system of the present embodiment is a security monitoring instant messaging system for processing security event monitoring, instant notification and processing, wherein the security monitoring instant messaging system is an instant messaging agent. The person 10' includes an analysis module 101, a receiving module 102, a processing module 103, and a notification module 104. The analysis module 101 is configured to analyze the status and level of the security event to determine whether the security event needs to be handled by the system itself, or to notify the monitoring personnel and wait for the processing instructions of the monitoring personnel. The receiving module 102 is configured to receive an instruction transmitted by a monitoring personnel. The processing module 103 is configured to execute an instruction for processing a security event, and the processing referred to herein includes processing by the system itself or receiving an instruction transmitted by the monitoring personnel by the receiving module 102 to determine a processing countermeasure. The notification module 104 is configured to transmit, by the analysis module 101, related information such as the analyzed security events to the monitoring personnel. In detail, the analysis module 101 compares the security events with the security records. When the analysis module 101 receives the security incident, it first analyzes and determines the subsequent processing methods, and the analysis is performed. The criteria for judging are compared with the records of the security records in the event database. If there has been a similar incident, the stored processing measures can be used. If there is no incident of security, the notification module will be used. 104 transmits the security event information to the monitoring personnel terminal 20 and waits for the returning instruction, and the instant messaging agent of the present embodiment 10 111314 201122895 1 person 10' notification module 104 is instant via the instant messaging network and the monitoring personnel terminal-20 The communication software 21 performs message delivery. Furthermore, the processing module 1〇3 performs the security event processing according to the instruction transmitted by the monitoring personnel terminal 2, as described above, the monitoring personnel terminal 2 receives the information of the security event and returns the processing instruction. After being received by the receiving module 1〇2, it is transmitted to the processing module 1〇3 for processing; in addition, the processing module ι〇3 is provided with self-processing instructions according to the analysis module 101, such as just As mentioned, if the Zidu monitoring instant messaging system 1 'can handle the security incidents on its own', the self-administered incidents will be handled according to the default processing measures provided by the security records in the event database 11 and the monitoring personnel will be reported. In addition, in another embodiment, the security monitoring instant messaging system of the present invention can also be combined with a wireless sensor network and applied to the detection of environmental conditions. In other words, the monitoring event of the security monitoring instant messaging system can be a sensing event, whereby the wireless sensor performs environment sensing, and then the wireless sensing network formed by the plurality of sensors performs sensing and data transmission, and The sensing data is transmitted back to a security monitoring instant messaging system to perform message transmission and processing of the foregoing sensing events. In detail, the aforementioned wireless sensor is a sensor having radio wave C radiofrequency (RF) transmission capability and independent power for specific sensing purposes, and can be used for sensing such as temperature, humidity, vibration, light, water shell or air. And other types of environmental data, and a plurality of wireless sensors form a wireless sensing network to transmit the captured detection data, such as a short distance formed by Zigbee communication technology under the standard of 802.15.4 a wireless sensing network, wherein the plurality of wireless sensors include a wireless sensor having the identity of the coordinator 111314 11 201122895 (coordinator), which is used to store and judge the numbers into the poles, and the coordination The wireless sensory security monitoring center of the identity is placed in the security monitoring center ^ 'and then through the security supervision and approval of the contact list in the instant messaging system to pass the ice / clothing brothers information 1 his security monitoring instant Communication system, or security monitoring of monitoring personnel in the 8.4 communication system; the above specific application areas are extensive, such as the national border area by setting the wireless sensor for vibration sensing # Billion into the only non-licensed personnel Ί

Out, or set up water quality sensors in various sections of the river to monitor changes in water quality or pollution status or to maintain temperature and vibration sensing to achieve monitoring function and information notification effect, and can be used for automatic grazing in remote areas. It is distributed around the ranch to distribute wireless sensors. If it senses that the herd exceeds the range of grazing, it will drive the bulls to keep the collars to the deterrent effect. Simply speaking, through environmental data detection and wireless network transmission as real-time monitoring. Information transfer to provide system analysis and subsequent event processing.

In addition, a plurality of security monitoring instant messaging systems of the present invention are integrated to form a joint defense system according to another embodiment of the present invention. Since a plurality of security monitoring instant messaging systems 1 are combined, the system architecture of the joint defense system of the present embodiment is The first and second figures are similar, except that the joint defense system of the plurality of security monitoring instant messaging systems of the embodiment has a plurality of linked contact lists, and each of the linked contact lists is located in each of the security monitoring instant messages. In the system, each of the linked contact lists stores the monitoring personnel information and the instant messaging agent information of the full-monitoring instant messaging system of the company, and encapsulates the monitoring events obtained by the local instant messaging agent through the notification module. Chenglian anti-message and immediately transmitted to the list of the joint contact person's 111314 12 201122895 . Therefore, the maximum difference between the security monitoring and instant messaging system of the present embodiment and the foregoing is that the contact person list is in addition to the monitoring personnel of the security monitoring instant messaging system of the local end, and includes other instant messaging agents. The relationship between the instant messaging agents forms a tree structure, which in turn produces the effect of joint defense. In a preferred embodiment, the aforementioned security monitoring instant messaging joint defense system can be a joint security monitoring system for monitoring instant messaging, and the monitoring events and event records are respectively a security incident and a security record, and thus the notification module The group's joint defense information is transmitted by the security incident report or the security record. The information on the incidents of the security incidents is the content, status and analysis results of the Zi'an incidents. The records of the security records are the records generated by any of the security monitoring instant messaging systems. They can be provided to other security monitoring instants. The communication system acts as a record to guard against the future. In another embodiment, the instant messaging agent in the security monitoring system of the security monitoring instant messaging system uses the joint defense message to perform the event information update, that is, when the instant messaging agent receives the joint defense message, The event database will be updated with these joint defense messages. Since the joint defense messages include information related to the security incidents, analysis results, and processing methods, the event database can be updated after receiving the joint defense message for subsequent security analysis. more complete. As shown in Fig. 3A, it is a schematic diagram for explaining the joint prevention implementation of the joint defense system of the present invention integrating a plurality of security monitoring instant messaging systems. First of all, the function of the instant messaging agent in each information security monitoring center in the joint defense mechanism is the same as the above. The main difference is the contact person. 13 111314 201122895 List In addition to the original monitoring personnel, there are other instants. The communication agent, in simple terms, when any member joins the contact list, can be equal to joining the entire defense system and indirectly connected to other members. As shown in the figure, the instant messaging agent is the contact person of the instant messaging agent C, so (H, c) forms a joint defense system, and the instant messaging agent is the contact person of the instant messaging agent c, so (I, C ) Forming a joint defense system, and thus (H, c^〇(ic) is combined to form a larger joint defense system (H'CJ), which is analogized by the above method. In Figure 3, it represents a joint defense system with 13 members. (A, B, C, D, E, F, G, H, I, J, K, L, M). Assume that the instant messenger C is subject to a security attack, generating a security incident X, instant messaging agent C There are three joint defense members in the list of contacts', so the instant messaging agent C sends the security incident to the postal instant messaging agent through the Internet, and immediately passes the agent to the instant messaging agent! This security incident χ check the list of people on the basin and found that only the instant messenger c is no longer sent to other contacts. The instant messaging agent can send it to (B, D, E) after receiving this security incident X. An instant messenger will pass the message related to the security incident x to all members. The knot "sends" to prevent the order into the order, first the instant messaging agent sends it to (with the outline, the instant messenger Β sends _, the agent C 杳 gives (Η, Ι), and the analogy is passed to All members. Because each Cheng Chang Lu Cheng will threaten to analyze the results, ^ mother has a different ability to deal with the attack, through the transmission of the joint defense message, as long as the company has the processing capacity, that is, 1314 14 201122895. The analysis results can be quickly distributed to all members, thus improving the overall protection capability through the joint defense mechanism. As shown in Fig. 3B, the invention discloses a joint defense system integrating multiple security monitoring instant messaging systems with a wireless sensing network. In the embodiment, the security monitoring centers A' to D' can be respectively combined with the wireless sensing network, such as the security monitoring center A' is connected to a wireless sensing network, the wireless sensing network The road includes a plurality of wireless sensors 30, 3.1, 32, 33, each of which senses the environmental state of the location, such as temperature, light, water quality or vibration, etc. The line sensors 30-33 transmit the captured sensing data through wireless transmission technology, and finally to the wireless sensor 40 with the coordinator identity to record and process the sensing data, or Send to the security monitoring center A' to perform sensing data record and corresponding processing. Similarly, the other end of the joint defense system, such as the security monitoring center D', is also received by the wireless sensor 34-36 and the coordinator. · The sensing data transmitted by the wireless sensor 41, and finally all the security monitoring centers A'~D' form a joint prevention system, and the information analysis and data transmission are performed on the sensing data, thereby forming A joint defense system for real-time data transfer and analysis processing. As shown in Fig. 4, it is a flowchart for explaining the joint prevention method of the security monitoring and the instant communication of the present invention. As shown in the figure, in this embodiment, the joint defense mode is applied to the information security monitoring center for information security monitoring, instant notification, and processing. In the process S401, the instant messaging agent receives the security event. When the information security monitoring center detects the security attack, the instant messaging agent judges the security event, and then proceeds to step S402. 15 111314 201122895 In this step S402, it is determined whether the security event starts the joint defense; because there are many types of security attacks, it is determined according to the level and status of the security event whether to start the joint defense mechanism, if it is not necessary to start the joint defense, then Go to step S403; otherwise, if the security event is important and the joint defense mechanism needs to be activated, proceed to step S407. In the step S403, the event processing countermeasure is determined, that is, the security event is determined by the local end of the security monitoring instant messaging system (for example, the information security monitoring center) to process or notify the monitoring personnel for processing. Usually, the comparison records are made through the security records of the event database. If the security record has been stored, the local security monitoring instant messaging system can handle the processing itself, and then proceed to step S404; The security incident cannot be handled by the local security monitoring instant messaging system itself, that is, the security incident to be notified, and the process proceeds to step S406. In the step S404, the preset processing countermeasure is started to exclude or process the security event, and the preset processing countermeasure is stored in the event database, wherein most of the records are common security attacks and their processing methods, and then Proceed to step S405. In the step S405, the monitoring result of the security event is notified to the monitoring personnel through the instant messaging network, and the processing of the joint security prevention and instant messaging prevention method of the present embodiment can be ended. In this step S406, since the local security monitoring instant messaging system cannot directly process, the monitoring personnel can be notified through the instant messaging network, and wait for the monitoring personnel to provide instructions for subsequent processing, thereby ending the security monitoring of the embodiment. The handling of the joint defense method with instant messaging. 16 111314 201122895 In this step S407, since the security event is required to start the joint defense mechanism, the security event is encapsulated into a joint defense message, so as to immediately notify the other members of the security monitoring instant messaging system, and then proceed to step S408. . It is also stated that the monitoring personnel can also be notified through the instant messaging network, that is, the monitoring personnel responsible for monitoring the local security monitoring instant messaging system are first notified to wait for the monitoring personnel to provide instructions for subsequent processing. In the step S408, it is notified to the joint defense members in the contact list, and the joint defense members described herein are other instant messaging agents on the contact list, waiting for other instant messaging agents to The security incident provides a processing method, which can end the processing of the joint defense method of the security monitoring and instant messaging of the embodiment. As shown in Fig. 5, it is a flowchart for explaining the processing of an external communication agent receiving an external message in the joint prevention method of the security monitoring and the instant communication of the present invention. In this embodiment, the information security monitoring center is also applied to the information security monitoring, instant | notification and processing. As shown in the figure, in step S501, the instant messaging agent receives an external message, which means that the monitoring personnel may be The message transmitted by the other instant messaging agent is returned, and then proceeds to step S502. In the step S502, determining the type of the message, that is, determining that the received external message is an instruction transmitted by the monitoring personnel, or a joint defense message transmitted by another instant messaging agent, if the external message is determined to be a joint defense message, then proceed to Step S503; conversely, if the external message is judged to be an instruction transmitted by the monitoring personnel, the process proceeds to step S510. 17 111314 201122895 In the step S503, it is determined that the joint defense message is an analysis and record of a security event or a security event. If the external message belongs to the security event, the process proceeds to step S504; otherwise, if the external message belongs to The analysis and record of the security incident proceeds to step S508. In the step S504, the instant messaging agent of the local security monitoring instant messaging system that receives the joint defense message updates the database to the database, so that the joint defense messages are stored for use as the next security incident. The criterion then proceeds to step S505. In the step S505, the relevant information of the security information is compared with the security record to compare whether there is a corresponding security record for use as a countermeasure reference, and if the result of the comparison is not compared with the capital If the security record is not encountered, the process proceeds to step S506. If the result of the comparison is comparable to the security record, that is, the security event has been previously encountered, then the process proceeds to step S507. In the step S506, the security event is continuously transmitted to other instant messaging agents, and the processing of the joint security monitoring and instant messaging prevention method of the embodiment can be ended. In the step S507, the record of the analysis result and the like are transmitted to the other instant communication agent, and the processing of the joint prevention method of the security monitoring and the instant communication of the embodiment can be ended. In the step S508, since it is determined that the joint defense message is an analysis and record of the security event, the event database is updated as the next security event determination criterion, and then proceeds to step S508. In the step S509, the received analysis result and the security record 18 111314 201122895 ., * are transmitted to other instant messaging agents, and the processing of the joint security prevention and control method of the present embodiment can be terminated. In the step S510, since it is determined that the received message type is an instruction transmitted by the monitoring personnel, the instruction corresponding program transmitted by the monitoring personnel is executed, that is, the instant messaging agent performs the security according to the instruction sent by the monitoring personnel. Event processing, and then proceeds to step S511. In the step S511, the processing result is reported to the monitoring personnel end, and the method of the joint defense method of the security monitoring and the instant communication of the embodiment can be ended. In addition, the security monitoring and instant messaging prevention method can be combined with the wireless sensing network, and the sensing data sensed by the plurality of wireless sensors is wirelessly transmitted, and finally sent to the security monitoring center. The data transmission and processing is performed by the relationship between the plurality of security monitoring centers, thereby forming a joint defense system by combining the wireless sensing network with the security monitoring instant messaging system of the present invention.

In summary, the security monitoring instant messaging system and the integrated anti-W system and the joint prevention method of the present invention achieve the effect of instant messaging through instant messaging agents through instant messaging software, thereby solving the inconvenience of traditional mail or personnel monitoring. Furthermore, there is an event record in the event database as the basis for judgment, and the corresponding countermeasures are included, thereby enabling the security monitoring instant messaging system to self-exclude various types of security attacks or environmental sensing messages within the capability range. In addition, through the contact relationship of multiple instant messaging agents, the concept of joint defense is formed, and only other instant messaging agents need to be added to the list of contacts, which constitutes a tree-like structure. 19 111314 201122895 The system can transmit information such as monitoring events, analysis results and event records in real time to alert or assist in solving problems in the shortest time. Therefore, through the above-mentioned joint prevention practices, the shortcomings of most information security monitoring centers cannot be mutually assisted. At the same time, to reach the information on the advance incident Execution monitoring, prevention and treatment assistance benefits. In addition, in addition to the application of the anti-theft system to information security monitoring, it can also be applied in combination with the wireless sensing network to achieve the effect of instant transmission and analysis of the sensing data, thereby enabling the joint defense. The application level is more extensive. The above-described embodiments are merely illustrative of the principles of the invention and its effects, and are not intended to limit the invention. Any person skilled in the art can make modifications to the above embodiments in light of the spirit and scope of the present invention. Therefore, the avoidance of B 丨 丨 本 丨 丨 、 、 、 、 、 、 、 、 、 *Protection protection of the trunk, should be patented as described later [Simple description of the diagram] Figure 1 is a block diagram of the security monitoring instant messaging architecture and its application architecture of the present invention; Basic architecture, 2 diagram further illustrates Figure 1 Safely monitor the instant messaging system and only apply the (4) sole agent's core structure block; and Fig. 3A is a schematic diagram of the joint prevention implementation of the integrated safety supervision system of the present invention; The invention integrates multiple security "^ joint defense system combined with wireless sensing network implementation on the J diagram. ~ ^ system flow: Figure 4 Figure = invention security monitoring and instant messaging joint prevention method 111314 20 201122895 5 is a flow chart of the process of receiving an external message by the instant messaging agent in the joint prevention method of the security monitoring and the instant communication of the present invention.

1 Security monitoring instant messaging system 1, security monitoring instant messaging system 10, 10, instant messaging agent 101 analysis module 102 receiving module 103 processing board group 104 notification module 11 event database 12 contact list 20 monitoring personnel 21 instant messaging software 30 ~ 36 wireless sensor 40 ' 41 wireless sensor A with coordinator identity 即时 instant messaging agent 〜, ~ D, security monitoring center S401 ~ S408 Step S501-S511 Step X 资安事件Y threat analysis result 111314

Claims (1)

201122895 VII. Patent application scope: 1. A security monitoring instant messaging system for security monitoring center to conduct things = monitoring and instant notification. The security monitoring instant messaging system includes: an event database for storing a plurality of event records; Event: = Γ 人 ' 用以 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据 依据― 卩 传送 传送 Γ Γ Γ , , , , , , , , 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10丨 (4) Full Μ & (4) Track (such as = #安安事件, and the material (4) is the security record: The security monitoring and immediate policy of the Shen-month patent cadre 3. 'The security record is for the security incident. The results of the analysis and processing of the 5.. patent application scope of the third paragraph of the security, the instant messaging agent re-packaged ^ word pass "system, which analyzes the value of the status and level of the analysis of the security incident, knife precipitation疋No to use the event database to clarify the information on the six secretaries of the 辜 〜 廿 廿 廿 廿 廿 廿 = = = = = : : : : : : : : : : : : : : : : : : : : : : : : : : : : : Transmitting the security event to the receiving module is for receiving an instruction transmitted by the monitoring personnel; to process the module, and determining, according to the analysis result of the analyzing module, the receiving module The receiving monitor monitors the order of the transmission or the processing of the asset security database. The handling of the security incident is as follows: 6. If you apply for the security monitoring instant messaging system of the fifth item, the analysis module Associated with the security record and the security record An analysis is performed to analyze the "An incident" and the security record, and the processing module processes the security incident with the security record stored in the event database. Ό m Patent 1 & The security monitoring instant messaging system of the project, wherein the monitoring event is a sensing event. 8. If the application is for the security monitoring instant messaging system of the VII, the Queen’s control system and the wireless sensing network The wireless sensing network is formed by a plurality of sensors, and the sensing data captured by the sensing H is transmitted back to the security monitoring center via wireless technology as the instant messaging agent processes the Sensing events detected by the Security Monitoring Center. 9. A joint defense system that integrates multiple security monitoring instant messaging systems as described in the scope of the patent application. The joint defense system includes: The list is located in each of the safety monitoring systems. The system towel, each of the linked contact lists is the storage monitoring personnel 111314 23 201122895 information and other such safety supervision That is, '' 'personal information, for each security monitoring 5 = the monitoring person stored in the instant messaging anti-contact list == the local communication agent information will be the local end ^4 or the other instant control event Transmitted to the supervisor 2 = the supervisory communication system handled. - The full-monitoring of the female monitor. 10. The integrated multi-system joint defense system of claim 9 of the patent scope, wherein the local instant messaging system Transmitting via instant messaging software; the U-bike or other security monitoring is flooded to H. For example, the joint defense system of the ninth system of the patent application scope, wherein: Qing;:: Wang & control instant messaging event record is f An record. In order to ride the security incident, and 12. If the patent application scope is integrated with multiple security systems, the information related to the security incident handled by the local communication is the Baoan Er'an processing record. For example, please refer to the nth item of the patent scope to integrate multiple instants = anti-systems. Among them, each of the security monitoring instant messaging:: The update of the local event database. The information related to the event is carried out as the joint defense system of the integrated system of the scope of patent application No. u, wherein each of the security monitoring;; the instant messaging agent includes: R, first, 111314 24 201122895, analysis module, It is used to analyze the status and level of the security incident, and analyze whether the information stored in the incident database is used to record the information of the monitoring personnel stored in the security incident or (4) the list of joint contact persons or The other instant messaging agent data will be transmitted; the thousand notification module is for the analysis module to monitor the event, or the other instant messaging agent; the receiving module is used to receive the monitoring personnel The transmitted message transmitted by the referring person or the other instant messaging agent is related to the 2 pieces; and the 7-beautiful child handling group, and the receiving module determined according to the analysis module is determined by the receiving module The receiving supervisor (4) sends the fingerprint, reduces the information sent by the instant messaging agent and the information about the security incident handled or the information stored in the local event database. Text processing events. x greedy application for the scope of patents, the integration of multiple security monitoring (4) prevention system, in which the analysis module is analyzed by the sex of the security incident to analyze the security incident: Haibe *The record has money linkage, the ship's storage area is stored in the material bank (4) material. Event greedy. 16. If the scope of application for patent scope 9 is integrated, multiple safety supervisors 17=m system The event is the sensing event I. The second item: Integrating multiple security monitoring instant messaging ', · · Eight, the full monitoring instant messaging system is connected with Π1314 25 201122895 wireless sensing network, the wireless sensing network Formed by a plurality of sensors, the sensory data captured by the sensor is transmitted back to the security monitoring center through wireless technology, as the instant messaging agent processes the sensing detected by the security monitoring center. 18. A joint prevention method for security monitoring and instant messaging is used for the joint defense of information security and event tracking among a plurality of security monitoring centers. The method for preventing security monitoring and instant messaging includes the following steps: Each of the security monitoring centers establishes a list of contact prevention contacts, each of which lists the monitoring personnel data and other information of the security monitoring center; and causes the security monitoring center to analyze the received monitoring events, which is to monitor the monitoring events. The event is correlated with the stored event record to analyze whether the monitoring event is related to the event record; and when the security monitoring center analyzes the non-relevance, the monitored monitoring event is encapsulated into a joint defense The message is notified to the monitoring personnel and the other security monitoring center according to the list of the joint contact person. 19. The method for preventing and controlling security monitoring and instant messaging according to claim 18 of the patent scope, wherein the monitoring event is a security incident, and the The event is recorded as a security record. 20. In the case of the joint application of the security monitoring and instant messaging of claim 19, the analysis of the unrelated security monitoring center updates the stored security records with the joint defense message. ' 21. Security monitoring and instant messaging as claimed in item 19 of the patent application Joint defense 26 111314 201122895 ,., '· I , method, wherein the joint defense information system includes the security incident notification or the security security record. 22. For the joint defense and security communication method of claim 19, The analysis of the correlation between the security incident and the stored security record indicates whether there is a treatment strategy for handling the security incident in the security record. 23. For security monitoring and instant messaging of claim 18 The joint defense method, wherein the security monitoring center is connected to the wireless sensing network, and the wireless sensing network is formed by a plurality of sensors, and the sensing data captured by the sensor is wirelessly The security monitoring center is returned, and the monitoring event is a sensing event for the security monitoring center to analyze the received sensing event. 24. The method for joint prevention of security monitoring and instant messaging in claim 23, wherein each of the security monitoring centers receives the sensing data returned by the sensor to immediately notify the contact list of the contact person Monitor personnel and other security monitoring centers. 27 111314