Distributed self-optimized intrusion detection alarm associated system

Abstract

The invention discloses a distributed self-optimized intrusion detection alarm associated system, which comprises a local alarm associated analysis module, a system response component, an overall associated analysis module, a human-computer interface module, an intrusion detection unit and a plurality of databases. The system utilizes the property of an intrusion detection system, alarm multimediamessage weighting information and the like to improve the accuracy rate and reduce the processed data quantity, can achieve automatic optimized configuration by means of three feedback loops to avoidthe influence of error configuration, and can support distributed application environment and expansibility through the combination of local association and overall association; the system response component can automatically execute related response actions so as to reduce the workload of a security administrator and have more response time; and the human-computer interface module provides a convenient and quick management interface for the security administrator so as to reduce the using threshold of the system. The system overcomes the defects of the prior system, remarkably improves the detection accuracy rate and efficiency of the system, can defend distributed large-scale intrusion, and is suitable for modern distributed network application environments.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a distributed self-optimizing intrusion detection and alarm correlation system. Background technique [0002] Among the current mainstream security protection technologies, the firewall (Firewall) strategy determines that it can only be used as a barrier on the network boundary, but cannot prevent attacks that do not pass through the firewall, and it is also difficult to prevent attacks from inside the network and the threat of network viruses; The safety isolation technology generally has limitations such as high construction and maintenance costs, inconvenient use, poor usability, slow transmission speed and high hardware failure rate, and requires dedicated communication hardware and proprietary switching protocols, thus limiting its application range; and security assessment Technology cannot adopt different protection methods according to different attac...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to overcome the above disadvantages, and propose a distributed self-optimizing intrusion detection and alarm correlation system, which solves the problems of poor reliability, low effi

Images