Intrusion defence system having active defence capability and method thereof

Abstract

The invention discloses an intrusion defense system having an active defense capability and a method thereof to actively defend security threats in a network. The method comprises the following steps: after receiving a data stream, setting a processing operation for an event in the data stream; setting an initial defense level for an event set consisting of multiple events based on the current network condition and the defense level requirements; matching the event in the event set based on the initial defense level, and obtaining a dynamic identification result with respect to network security situation based on a network flow and a matching result; determining the current defense level of the event set based on the initial defense level and the dynamic identification result; determiningthe current defense level of the event set based on the dynamic identification result; and automatically adjusting the processing operation of each event in the event set based on the current defenselevel, and responding to each event. The defense level can be automatically adjusted so as to actively prevent the further generation of attacks by using the various implementation manners of the invention.

Description

technical field [0001] The invention relates to the field of information security, in particular to an intrusion prevention system and method with active defense capability. Background technique [0002] Since the introduction of firewalls in the network, network security solutions have been finalized as firewall-based solutions. This type of firewall solution is characterized by dividing the network into network segments with different security levels, and placing firewalls at the boundaries of network segments for network segment isolation and access control. This traditional intrusion detection system product can only detect malicious and illegal network traffic and process it. In fact, it matches according to the preset signature library. [0003] Various worms, viruses, and application-layer attack technologies are combined with email and mobile codes to form a compound attack method, making threats more dangerous and difficult to resist. Most of these threats can pen...

AI Technical Summary

Problems solved by technology

Although this method can partially solve the problem of untimely update of passive defense features, it will be limited by the timely accuracy of the manufacturer's push service capabilities and the speed of intrusion outbreaks.

Images