Distributed intrusion detection method, device and system

Abstract

The invention relates to the field of network communication, in particular to a distributed intrusion detection method, a distributed intrusion detection device and a distributed intrusion detection system. The method comprises the following steps of: acquiring own flow information and generating a flow table; calculating early warning information according to the flow table; when the flow table only comprises own flow information or when the early warning information meets neighbor communication conditions, acquiring the flow information of a neighbor node and flow information acquisition time, and updating the flow table and the early warning information; when the early warning information meets global communication conditions, acquiring the flow information of a global node and the flow information acquisition time, and updating the flow table and the early warning information; and when the early warning information meets early warning conditions, performing intrusion early-warning. In the technical scheme provided by the embodiment of the invention, only the flow information of the neighbor node needs acquiring when the early warning information meets the neighbor communication conditions, so the data traffic in distributed intrusion detection is reduced and the influence of the distributed intrusion detection on network performance is reduced.

Description

technical field [0001] The invention relates to the field of network communication, in particular to a distributed intrusion detection method, device and system. Background technique [0002] Denial of Service (Denial of Service, DoS) is a very simple but very effective way of network attack. The purpose of DoS is to deny service access, disrupt the normal operation of the organization, and eventually it will disable part of the network connection or network system. There are many types of DoS attacks. The most basic DoS attack is to use reasonable service requests to occupy too many service resources, so that legitimate users cannot get services. For example, the attacker sends many requests with false addresses to the server, and the server waits for the return information after sending the reply information. Since the address is forged, the server has not been able to wait for the return message, and the resources allocated to this request will be never been released. ...

AI Technical Summary

Problems solved by technology

[0011] The purpose of the embodiments of the present invention is to provide a distributed intrusion detection method, device and system to solve the problem that the large amount of data communication in distributed intrusion detection affects network performance

Images