Detecting system and method for network invasion behaviour

Abstract

The system comprises: network processor, high speed switch device, high speed buffer and content filter. Wherein, the content filter comprises a stream reassembling unit, a stream reassembling memory and a mode match chip. The stream reassembling unit and the stream reassembling memory reassembles the network message into the network data stream. The method comprises: 1) when the network message enters into the system, firstly the network processor makes the state check for the header of network message; the network message passing the rule check is saved in the high speed buffer; otherwise, abandoning the message; 2) reassembling the network message in high speed buffer into network data stream, and saving the reassembled stream into the memory; 3) the mode match chip extracts the network data stream, and uses a invasion rule to make match; the stream passing the examination will be replayed; otherwise, it will be abandoned.

Description

technical field [0001] The invention relates to a network intrusion behavior detection system and detection method, relates to network security equipment, and belongs to the technical field of network security. Background technique [0002] With the wide application of the network, the focus of network security has also changed. The main target of attacks has gradually changed from TCP / IP and other protocol layers to application layer attacks. More and more attacks are mainly aimed at specific applications or Therefore, the detection and prevention of application layer attacks has become a new hotspot in the field of network security. [0003] Network administrators are in great need of a gateway-level device with functions such as firewall and intrusion detection. It is deployed between the internal network and the external network to play the role of access control and intrusion prevention, and provide security protection for the internal network. [0004] The firewall de...

Images