摘要： 对事件响应进行了理论分析，给出了事件定义、事件分类、基于XML格式的事件描述和交换格式、事件的生命周期和状态转换和事件响应的协同处理方式等一套完整的规范。针对大规模网络环境设计了一个协同式事件响应系统来实现网络安全事件的协同处理。并介绍了CIRS的系统结构及其组成部分。

关键词: 网络安全, 事件响应, XML

Abstract: This paper discusses the theory of incident response and an integrative definition, incident object description and exchange format based on XML, incident taxonomy. The lifecycle and state transition of incident and the cooperative transaction between IRT are proposed. Aiming at large scale network environments, a cooperative incident response system (CIRS) is designed, which implements cooperative incident response through efficient, secure information exchange among managers in different places. At the same time, the architecture of CIRS is described, as well as its five components.

中图分类号: 

• TP393