Network security posture information acquisition system and method based on SFLOW and OWAMP (One Way Active Measurement Protocol)

Abstract

The invention belongs to the field of network security posture awareness, and relates to a network security posture information acquisition system and a method based on an SFLOW and an OWAMP (One Way Active Measurement Protocol). The network security posture information acquisition system comprises that a management control module which comprises an endpoint management module, a task configuration module and a task distribution module; a data preprocessing module is responsible for performing data standardization process on SFLOW data information and OWAMP data information acquired by a data acquisition module, removing redundant information acquired by different nodes, and storing the preprocessed data to a data processing center; and a visual module is responsible for displaying assessment information generated by the performance assessment module to a user in an imaging way. A session between a session initiating end and a session receiving end is encrypted by an HMAC (Hash Message Authentication Code) and an NTP clock synchronization protocol, therefore, the network security posture information acquisition system has great advantages in safety and timeliness; furthermore, for a measuring way is compared with a measuring way based on roundtripping, and the round-trip delay can be reduced.

Description

Technical field [0001] The invention belongs to the field of network security situation awareness, and specifically relates to a network security situation information acquisition system and method based on SFLOW and OWAMP. Background technique [0002] New network applications with the theme of virtual private network (VPN), real-time video services, voice services, etc. [0003] In this way, users’ focus has shifted from traditional data applications to network security. Therefore, the current network security requirements require the ability to obtain data information in the network efficiently and in real time, without having a major impact on network equipment and network operating conditions, and to be able to effectively analyze and evaluate various security event information contained in network data , Provide information about the global operating status of the controlled network, improve the system’s cognition and understanding of the entire network, timely hand over var...

AI Technical Summary

Problems solved by technology

[0004] At present, the data information of the network security situation can be collected through SNMP, SFLOW, NETFLOW and other methods. However, these measurement methods have a common defect of passive measurement, and the corresponding network security performance needs to be processed after the collected data is processed. Evaluate

Images