Macro Network Environment, The Automatic Response System, And Realization

A macroscopical network is a large scope network entity which includes various subnets and regards the subnets as research units. Automated Incident Response is one of the key technologies for network security incident solving. An Automated Incident Response system under a macroscopical network will have more complex requirement than normal network in many aspects.Refer to the existed Automated Incident Response technologies, this paper lucubrated the characters of macroscopical networks, analyzed the distribution, function and capability of an Automated Incident Response system under macroscopical networks, and designed a complete structure model for Automated Incident Response system under a macroscopical network base on the characters and analytic result.As to the core technologies for Automated Incident Response, this paper designed a dangerous index and its calculating method for response policy. At the same time, for the distribution and execution scope of the policy, this paper designed a policy descript standard based on response actions. This standard enhances the policy's compatibility and do a basis work for further researches.Based on the research works, this paper designed an Automated Incident Response system under macroscopical networks. The test result proved that the system can met the expected requirements so that the works of this paper has a certain value for real applications.