Computer information security defense system

Abstract

The invention discloses a computer information security defense system. The computer information security defense system comprises an initialization module, an intelligent acquisition module, a log analysis module, a server analysis module, a client analysis module, an on-line analysis module, a high-speed retrieval module and an attack analysis engine module, wherein the log analysis module, the server analysis module, the client analysis module and the on-line analysis module are connected between the initialization module and the intelligent acquisition module. According to the computer information security defense system, the optimal rule deployment scheme is determined through a period of study with the various factors such as the network environment, the type of services provided by a server, the type of access objects, attacks which the server suffers from and the access time period as initial values, dynamic rule deployment can be carried out according to common attacks and potential threats of a whole network, a security defense rule template is set through study and dynamic observation on the various factors for guaranteeing network security, and network security defense pertinence is improved.

Description

Technical field [0001] The invention belongs to the technical field of network computer security, and relates to a computer information security defense system. Background technique [0002] The traditional deployment of security rules is to add all rules or some of the rules to the system as needed. Because the network environment targeted by security products is not unique, many security rules are not necessary for a specific network environment, but which ones are Necessary, this requires diagnosis and intelligent learning. It is unscientific to configure security rules blindly. Too many redundant rules are configured, which has a great impact on the waste of resources of security products and the speed of the entire network. The inaccurate rules are configured, that is, the rules that should be configured for the environment are not matched, which will affect the defense effect of the security product, thereby releasing the loopholes for the protected server. The configura...

AI Technical Summary

Problems solved by technology

But it is static, while network security is dynamic and holistic, hackers have countless attack methods, firewalls are not omnipotent, and it is impossible to completely prevent these intentional or unintentional attacks

Images