Network intrusion detection system

Abstract

The invention relates to a network intrusion detection system, which is arranged at an important network node, and used for detecting and monitoring a network packet. The network intrusion detection system comprises a network card and a system core processor. When the network packet is received, a microprocessor of the network card performs a packet parsing program and a packet preprocessing program to distinguish packet type and source address and convert the packet into an intrusion detection format packet in advance. Later, the system core processor judges whether the intrusion detection format packet is an intrusion packet. Because calculation burden of the programs for parsing the packet and preprocessing is shared by the network card, the network intrusion detection system is not easy to lose the packet due to overweight calculation burden, and improves accuracy greatly.

Description

technical field [0001] The invention relates to an intrusion detection system, and in particular to an intrusion detection system, which has a network card capable of performing packet analysis and packet preprocessing. Background technique [0002] In the past, network security solutions mostly consisted of antivirus software and firewalls to achieve basic network security protection. The anti-virus software prevents the computer system from being infected with computer viruses, and the firewall protects private data from being stolen. Although firewalls and anti-virus viruses can control most malicious intrusions by those who intend to invade computer systems, some hackers can still break through firewalls and invade computer systems. The network intrusion detection system (Intrusion Detection System, IDS) technology has developed into an important technology to protect the computer system from being stolen data or maliciously destroying the computer. The intrusion detect...

AI Technical Summary

Problems solved by technology

However, no matter what kind of network intrusion detection system it is, it needs to consume considerable system resources when performing intrusion detection.

The network intrusion detection system needs to analyze the type of each packet and even analyze the content of the packet. Therefore, in some networks with relatively high transmission speed or heavy traffic, such as Gigabit Ethernet, the intrusion attack may be complicated. If the speed or propagation speed is too fast, the response capability of the network intrusion detection system cannot keep up, and it is impossible to detect network intrusion attacks in real time

Images