Computer firewall for automatically adjusting security policies according to network security alarm

Abstract

The invention provides a computer firewall for automatically adjusting security policies according to a network security alarm. The computer firewall calculates a series of relevant alternative firewall shielding rules according to the latest alarm information sent by an intrusion detection system (IDS), and quantitatively calculates advantages and disadvantages of each alternative shielding rule according to preset parameters so as to decide whether the rule is adopted. In the invention, each adopted firewall rule is given a period of validity; and when one firewall rule successfully stops the alarm, the firewall appropriately prolongs the period of validity of the rule according to importance of the stopped alarm, and the invalid firewall rules are deleted.

Description

Technical field [0001] The patent of the present invention relates to a computer firewall system that automatically adds and deletes network data filtering rules by analyzing network security alarms. Background technique [0002] A firewall (Firewall) is a device configured between two computer networks (a single computer can also be regarded as a micro-network). Its core is a computer program, but it can also be solidified on hardware such as a router to become a part of the hardware. All communication between the two networks must pass through the firewall, and the firewall selectively allows or prohibits the passage of certain data according to preset rules. [0003] The core of the firewall is the preset rules, which programmatically describe which data conforms to which characteristics should be allowed or forbidden to pass through. The rules of the firewall are usually manually set by the network administrator, and the quality of the rules directly affects the effect...

AI Technical Summary

Problems solved by technology

Once the computer inside the network is used maliciously, it will be difficult to effectively stop it until the harm develops to be clearly detected

Therefore, once the computers in the internal network are used maliciously, it often leads to serious consequences such as leakage of secrets

[0009] Although the intrusion detection system brings some convenience for network administrators to formulate and modify firewall rules, because its false alarm rate is too high, its alarm content cannot be directly used to formulate and modify firewall rules, but must first be manually screened. It is difficult to provide substantial help in maintaining network security