Application level intrusion tolerance system and method

Abstract

The invention provides application level intrusion tolerance system and method. The application level intrusion tolerance system comprises a boundary judging unit, an application unit and an application system module which are sequentially connected. The application level intrusion tolerance method includes steps of (1) access distribution and analysis; (2) application system virtualization; and (3) convergence and backspacing of application behaviors. By virtualizing the application into multiple virtual applications, and by means of the intrusion tolerance method, the problem about how to guarantee availability of application system software when network intrusion occurs is solved.

Description

technical field [0001] The invention belongs to the field of information security, and in particular relates to an application-level intrusion tolerance system and method. Background technique [0002] Application system software is an information integration environment, which is a collective term for software that aggregates scattered and heterogeneous applications and information resources, and realizes certain types of special functions through one or more access portals. [0003] With the advancement of network technology, the attack and anti-attack technology for application system software is constantly developing. The continuous advancement of protocol analysis and pattern recognition technology enables effective discovery and defense of attacks directly targeting the bottom layer of the system. Attacks against application systems emerge in endlessly, such as SQL injection, cross-site attack, session hijacking, and cookie-poisoning. At present, the detection and def...

AI Technical Summary

Problems solved by technology

[0004] Attacks against the application layer are often complex, usually with a huge data structure, a large number of data packets, various modes, and staged processing.

For such attack events, the use of feature-based identification and defense methods requires maintaining an extremely large feature library and performing contextual correlation analysis, but often cannot cover all attack modes and emerging attack methods, which eventually leads to network attacks. The system is affected, making it unavailable, data tampered with or illegally used, etc.

Images