Scene-based hybrid invasion detection method and system

Abstract

The invention discloses a scene-based hybrid invasion detection method and a scene-based hybrid invasion detection system. The method comprises the following steps that: 1, an invasion detection system extracts the characteristics of acquired audit data according to an access control strategy and related application scene information; 2, the invasion detection system forecasts a suspicious invasion event by a combined forecasting method according to the characteristics of the audit data; 3, the invasion detection system determines an invasion event by combining the suspicious invasion event and alarm associated information; and 4, if a certain invasion event occurs, the invasion detection system generates alarm information, and transmits the alarm information to a security management platform for visual display. By the method and the system, the accuracy of invasion detection can be improved, the security of a physical layer of the system can be protected, and internal attacks of the system can be prevented.

Description

technical field [0001] The invention relates to a scene-based hybrid intrusion detection method and system, belonging to the technical field of industrial control security. Background technique [0002] Recently, information attacks have seriously threatened the stability of the network. These attacks take advantage of the interconnection and interaction characteristics of the network, and spread very fast, and the attack technology is getting more and more sophisticated, and the attack methods are becoming more and more complex. Traditional information security systems, such as firewalls and intrusion detection systems (IDS), have serious deficiencies in network attack prediction, and usually respond only after these attacks have caused serious damage. [0003] Most traditional intrusion detection systems use a network-based or host-based approach to identifying and responding to attacks. These systems often use two types of intrusion detection methods, namely abnormal in...

AI Technical Summary

Problems solved by technology

Therefore, traditional application-based IDS systems are difficult to manage and deploy

[0007]The disadvantage of some current commercial IDS systems is the lack of security policies

These systems mainly rely on built-in static algorithms and cannot flexibly adapt to such systems that change the security behavior of the system

For systems employing anomaly detection, any deviation from the contours of normal behavior is considered suspicious, which greatly increases the probability of false alarms for the system

Images