Method for sending safety strategy

Abstract

Setting up maximal down delivering rate, the method carries out following steps: (1) storing new security policy generated based on each attack; (2) when toggle condition is satisfied, obtaining present rate for down delivering security policy, determining whether present rate for down delivering security policy is smaller than maximal down delivering rate; if yes, then, obtaining and down delivering foremost security policy stored; otherwise, quitting down delivering security policy. The invention also discloses two methods for down delivering security policy. The invention controls quantity of down delivering security policy by security detection device to prevent device to be tested from being unable to run normally caused by large quantity of security policy down delivered. Through effective aggregation of security policy, the invention does not down deliver identical security policy repeatedly.

Description

technical field [0001] The invention relates to network security detection technology, in particular to a method for issuing security policies. Background technique [0002] Intrusion detection is to collect and analyze information from several key points in a computer network or computer system, to find out whether there are behaviors violating security policies and signs of being attacked in the network or system, and to take targeted actions and take these effective actions. Targeted actions are delivered to all intrusion detection targets, including network devices such as switches, routers, and firewalls. The combination of software and hardware for intrusion detection is an intrusion detection system (IDS). The objects that IDS detects and take targeted actions, such as switches, routers, firewalls, etc., are called IDS linkage devices. The IDS formulates different strategies for blocking attacks for different attacks, which are called linkage rules. Usually, a bloc...

AI Technical Summary

Problems solved by technology

However, due to the limited ability of the linkage device to process linkage rules, when a large number of attacks occur, the IDS will continuously deliver a large number of linkage rules to the linkage device in response to a large number of attacks. normal operation of the equipment

Especially for the same attack, not only sending a large number of linkage rules to the linkage device will greatly affect the normal operation of the linkage device, but also for the same attack, it is meaningless to repeatedly issue the same attack within the time when the linkage rule is still valid

Images