Network security system and system load automatic adjusting method thereof

Abstract

The invention provides a network security system. The network security system has a system load automatic adjusting function and comprises a load detector, a decision arbiter and an adjustment actuator which are sequentially connected, wherein the load detector is used for detecting the system load and feeding anomalous events back to the decision arbiter; the decision arbiter is used for generating an adjustment decision according to the anomalous events and providing the adjustment decision to the adjustment actuator; and the adjustment actuator is used for carrying out adjustment according to the adjustment decision so as to cause the system load of the network security system to tend to a normal range. The network security system and the system load automatic adjusting method thereof in the invention can ensure that the system load of the network security system is in a safe and stable operating state.

Description

technical field [0001] The invention relates to network security technology, in particular to a network security system and a method for automatically adjusting system load. Background technique [0002] Mainstream security products that protect network security, such as intrusion detection system (Intrusion Detection System, IDS), intrusion prevention system (Intrusion Prevention System, IPS), intrusion detection and prevention system (Intrusion Detection & Prevention, IDP), multi-function security gateway ( USG, UTM) and network audit systems, etc., when they are running, their operating load, that is, the occupancy rate of the hardware CPU (X86, MIPS architecture central processing unit, or other architecture processors), memory occupancy rate, input The occupancy rate of the / output (I / O) interface and the occupancy ratio of core resources of the operating system, such as file handles, etc., not only depend on the amount of input data that these systems must process, suc...

AI Technical Summary

Problems solved by technology

[0003] It is precisely because of the above basic principles of data processing of network security products, in the actual network environment, due to the limitation of the processing capacity of the hardware used, it is often impossible to predict whether the hardware resources and software resources of security products can run safely. Once the hardware resources and software resources exceed the upper limit, it will immediately affect the safe operation of the network security product itself. Even if the monitoring and adjustment are carried out manually, due to the limited response speed and measures, it often leads to the failure of the network security defense function. Interruption, for online network security systems (IPS, USG, IDP, FireWall), etc. will cause interruption of data communication at the same time. It is originally a product to protect the user's business security. Due to the existence of the above problems, it will lead to the security of the user's business and assets. suffered heavy losses

Images