Module Introduction

SiCAP-Data Analysis, based on data, scenario-oriented and algorithm-supported, conducts comprehensive intelligent analysis of IT asset configuration, monitoring, operation, logs, processes and other data based on big data, machine learning, deep learning and other technologies, including landing scenarios in multiple technological directions such as anomalous risk analysis, multi-dimensional primary cause, root cause analysis, intelligent auditing, intelligent operation, intelligent prediction, and intelligent robotic assistants, which improves the overall risk perception and security dynamic protection.

Feature Introduction

• Unusual Risk Analysis

  Key Inclusions:Log anomaly detection: based on log clustering, pattern recognition and other machine learning techniques and algorithms to discover abnormal logs and potential risks.
  Abnormal Behavior Analysis: Establish a behavioral baseline, correlate user and asset behaviors, and use machine learning and other algorithms to identify suspicious abnormal behaviors that seriously deviate from the baseline.
  Threat Attack Monitoring: Based on network traffic, apply artificial intelligence technologies and algorithms such as machine learning, deep learning, etc. to backtrack and analyze abnormal network behaviors, and discover potential security threats and unknown network attacks by matching them with threat intelligence and behavioral models.
• Multidimensional Principal Cause Analysis

  It is mainly a multi-dimensional principal cause analysis of traffic events that can identify the main dimensions that generate traffic anomalies.
• Root Cause Analysis

  For alarms or anomalous events, combined with network topology, asset and service correlation relationships, and fault transmission relationships, intelligent algorithms such as decision trees and correlation analysis are applied to locate the root cause of the problem and effectively shorten the fault resolution time.
• Intelligent Audit

  Apply big data and machine learning algorithms to operation sessions and historical audit records, form a rule base by analyzing character commands and user behaviors, audit operation commands and behaviors to see if they are normal by matching the rule base, carry out intelligent auditing of operation sessions, provide intelligent scoring and health level, assist audit administrators in their daily audit work, and dynamically update the rule base based on the final audit results.
• Intelligent Operation

  Key Inclusions：①　Operation Authorization Recommendation: Apply intelligent algorithms to recommend authorization for new users based on historical authorization, user roles, attributes, and asset information for quick authorization.。
  Rapid Dispatch Recommendation: When an asset malfunction or abnormality occurs, based on intelligent algorithms and automated scripts to collect malfunction characteristics, analyze the cause of the malfunction, form malfunction characteristics, and generate work order recommendation information based on these malfunction characteristics and historical operation behaviors, which facilitates the rapid formation of special operation work orders for operation processing.
  運③　Operation Failure Solution Recommendation: By analyzing historical operation information and combining the knowledge of operation solutions provided by users to form an operation knowledge base, we recommend solutions based on failure characteristics and related historical operation information to assist users in quickly resolving failures.。
• Intelligent Prediction

  Relying on big data analysis and machine learning capabilities, it establishes a failure prediction model for business scenarios, and conducts correlation analysis and deep learning based on the correlation of historical alarms. Meanwhile, it is combined with the data acquired by the monitoring system in real time to perform trend analysis and prediction of IT failures, capacity, etc., to provide early warning of possible future failures and realize intelligent prediction of failures.
• Intelligent Assistants

  It builds a bridge between information producers and information consumers, adopts a high-performance computing framework, organizes data such as the collection of users' historical behaviors and functional correlations, establishes a user portrait system based on machine learning, data mining and other technologies, integrates a variety of algorithmic models, and makes all-round, multi-dimensional and accurate predictions and recommendations of the functions or contents required by users, so as to reduce users' operating costs.

Module Introduction

SiCAP-Traffic Analysis, by collecting, storing and analyzing the full volume of network traffic and combining with SiCAP's other functional modules, identifies abnormal access behaviors based on retrospective analysis of packet characteristics, abnormal access behaviors, abnormal network behaviors and correlation analysis, and identifies vulnerabilities, Trojan horses, APT attacks, and other known and unknown security threat behaviors, and is equipped with multi-dimensional data analysis and in-depth mining capabilities, providing End-to-end visual analysis capability of full traffic behavior and performance, helping users focus on the real security risks from massive data, effectively reducing the impact of risks, and helping users establish a visual, controllable, performance-optimized adaptive network security architecture.

Feature Introduction

• Full Traffic Acquisition and Parsing

  Supports real-time collection of traffic from various data sources such as network packets and Netflow stream data; Support thousands of network protocols such as TCP/IP, HTTP, ICMP, SSL and other network protocol recognition and real-time decoding, network metadata can be extracted for analysis.
• Full traffic Traceability and Statistics

  Provide complete records of original full-flow data, which can realize complete attack traceability, forensic analysis, and provide real and reliable evidence basis when defining responsibility; Support real-time statistics and analysis of full traffic data, visualization of traffic size, packet loss rate, retransmission rate, network delay, link blocking and other network quality conditions.
• Flow Forecasts

  Based on historical traffic data, it forms a traffic baseline, predicts traffic trends, and alerts abnormal events for situations exceeding the predicted trend, while intelligent algorithms can be used to perform multi-dimensional principal cause analysis to analyze the cause of the abnormality.
• Abnormal Traffic Analysis and Alerts

  Abnormal access behavior analysis, which can analyze network access behavior, output session-level metrics, and compare behavioral baselines to discover abnormal access behavior; Threatening analysis, which can analyze traffic behavior characteristics as well as network metrics in depth and compare them with abnormal behavior models to discover threatening behaviors in the network in a timely manner; Correlation analysis, which can be correlated with all kinds of security events on SiCAP platform to assist in locating the root cause and reducing the scope of influence. Risk alerts, supporting client, email, SMS, and WeChat alerts to ensure timely response to abnormal events.。
• Threatening analysis, which can analyze traffic behavior characteristics as well as network metrics in depth and compare them with abnormal behavior models to discover threatening behaviors in the network in a timely manner;。
  Correlation analysis, which can be correlated with all kinds of security events on SiCAP platform to assist in locating the root cause and reducing the scope of influence.
  Risk alerts, supporting client, email, SMS, and WeChat alerts to ensure timely response to abnormal events.
• Traffic Application and Visualization

  Based on the traffic data, it can be used for a wide range of applications, including: forming network traffic topology, auto-discovery of IT assets, auto-discovery of asset protocols, and so on. Visualization display, multi-dimensional data with all kinds of icon styles for rich and diverse visualization, convenient for data analysis.