Self-protection general unit of internal network security monitoring system

Abstract

The invention provides a self-protection general unit of an internal network security monitoring system, including an analysis module, a discrimination module, a processing module, a honeypot module and a policy library module; the general unit is compatible with the internal network system and the internal network security in terms of hardware deployment The monitoring system is separated. The analysis module first screens out the attack events for the internal network security monitoring system from the received attack events, and outputs them to the identification module and the processing module; the identification module classifies and marks the received attack events to distinguish different levels The corresponding authority; and transmit it to the corresponding user; the processing module takes corresponding protective measures for the internal network security monitoring system according to the type of attack event, and when the processing module cannot make effective protection, close all other external Connect, start the honeypot module at the same time, trap the attack event, collect evidence, and send it to the policy library module to update the attack event knowledge base.

Description

technical field [0001] The invention relates to a self-protection general unit of a safety monitoring system, in particular to a self-protection general unit of an internal network safety monitoring system, which belongs to the field of computer network safety. Background technique [0002] The complexity and variability of the network environment, as well as the vulnerability of information systems, determine the objective existence of network security threats. Following the development of informatization, the problem of network security has become increasingly prominent. Network security has become a common challenge faced by mankind in the information age. If this problem is not solved well, the process of informatization development will be hindered. Facts have shown that with the continuous development of computer technology and the Internet, cybercrime is also increasingly rampant. [0003] According to the survey of the US FBI, the US loses more than 17 billion US do...

AI Technical Summary

Problems solved by technology

Although these measures can be well integrated with the security monitoring system, because they are not independent, if a node of the security monitoring system fails to resist the attack, it will lead to the failure of the entire security monitoring system, resulting in the general protection of itself. unit failure

In addition, for the security monitoring system, due to its complexity, multi-level security protection is required

The existing self-protection technology only adopts a single layer of protection, lacking hierarchical design and deployment