Next-generation application firewall system and defense method

Abstract

The invention discloses a next-generation application firewall system and a defense method. The defense method can comprise the following steps of: acquiring a data package in a data stream; carrying out analyzing and verifying on the data in the data package; and collecting and analyzing verified results, and carrying out processing according to a corresponding preset strategy. According to the next-generation application firewall system and the defense method, the shortages of traditional safety devices are holistically solved, and meanwhile, the performances of the devices can not degrade after all functions are started.

Description

technical field [0001] The invention relates to the next generation application firewall technology, in particular to a next generation application firewall system and defense method. Background technique [0002] With the rapid development of network applications and the increasingly complex network structure, the limitations of traditional firewalls are clearly reflected: traditional firewalls are based on IP (Internet Protocol, a protocol for interconnecting networks) / ports, and provide access control policies (Access Control List, ACL) and abnormal packet filtering, but its working mode determines that it cannot intercept attacks from the application layer, such as: worms, viruses, and Trojan horses. Traditional firewalls are also unable to distinguish specific applications and their content in traffic, unable to distinguish users, let alone analyze and record user behaviors, that is, unable to distinguish applications and content, which will result in the inability to r...

AI Technical Summary

Problems solved by technology

[0004] (1) Low efficiency: The same data packet is repeatedly unpacked and analyzed repeatedly through various devices in series, which makes the efficiency of the entire network low and the operating speed very slow;

[0005] (2) High maintenance cost: Many devices need to provide sufficient space and environmental support, which greatly increases the maintenance cost;

[0006] (3) Complex management: Independent equipment and complex management require training of senior managers who are familiar with various types of equipment and equipment from various manufacturers; at the same time, it is impossible to conduct unified security risk analysis

[0008] (1), UTM equipment only simply integrates FW, IPS, and AV, and has poor control over applications and content, and there are still problems in the security and management of traditional firewalls, such as the lack of effective protection for WEB servers;

[0009] (2) The security devices connected in series in UTM need to be filtered by multiple security modules, but the security modules of multiple modules fight independently and passively protect, and cannot coordinate operations, resulting in low performance and efficiency;

[0010] (3) When the business requires high security policies, the UTM security protection policy is too complex and has poor visibility, making it difficult for administrators to maintain

Images