Scene-based hybrid invasion detection method and system

Abstract

The present invention discloses a scene-based hybrid intrusion detection method and system. The method includes the following steps: S1, the intrusion detection system extracts the characteristics of the collected audit data according to the access control policy and relevant application scene information; S2, according to the audit Based on the characteristics of the data, the combined forecasting method is used to forecast suspicious intrusion events; S3, combined with suspicious intrusion events and alarm related information, to determine the intrusion event; S4, if an intrusion event occurs, the intrusion detection system generates alarm information and sends it to the security management platform for visualization. The invention can improve the accuracy rate of intrusion detection, perform safety protection on the system physical layer, and prevent system internal attacks.

Description

technical field [0001] The invention relates to a scene-based hybrid intrusion detection method and system, belonging to the technical field of industrial control security. Background technique [0002] Recently, information attacks have seriously threatened the stability of the network. These attacks take advantage of the interconnection and interaction characteristics of the network, and spread very fast, and the attack technology is getting more and more sophisticated, and the attack methods are becoming more and more complex. Traditional information security systems, such as firewalls and intrusion detection systems (IDS), have serious deficiencies in network attack prediction, and usually respond only after these attacks have caused serious damage. [0003] Most traditional intrusion detection systems use a network-based or host-based approach to identifying and responding to attacks. These systems often use two types of intrusion detection methods, namely abnormal in...

AI Technical Summary

Problems solved by technology

Therefore, traditional application-based IDS systems are difficult to manage and deploy

[0007]The disadvantage of some current commercial IDS systems is the lack of security policies

These systems mainly rely on built-in static algorithms and cannot flexibly adapt to such systems that change the security behavior of the system

For systems employing anomaly detection, any deviation from the contours of normal behavior is considered suspicious, which greatly increases the probability of false alarms for the system

Images