Intrusion detection and analysis system on basis of service data flow of virtual machines

Abstract

The invention provides an intrusion detection and analysis system on the basis of service data flow of virtual machines. The intrusion detection and analysis system comprises a data acquisition module, an intrusion detection module, a communication interface, an alarm response module and a safety management module. The data acquisition module is used for acquiring audit data when access request operation is started; the intrusion detection module is used for analyzing the acquired audit data and detecting the audit data to determine whether the audit data are intrusion events or not; the intrusion detection module and the data acquisition module are bidirectionally communicated with each other via the communication interface; an intrusion detection system can generate alarm information by the aid of the alarm response module when the intrusion events occur, and the alarm information is transmitted to the safety management module by the aid of the alarm response module, so that the alarm information can be visually displayed; the safety management module is used for combining and scheduling forecasting methods, transmitting access control strategies, the forecasting methods and alarm correlation information to the intrusion detection module, transmitting response strategies to the alarm response module and receiving safety update information transmitted by the alarm response module.

Description

technical field [0001] The invention specifically relates to an intrusion detection and analysis system based on virtual machine service data flow. Background technique [0002] Recently, information attacks have seriously threatened the stability of the network. These attacks take advantage of the interconnection and interaction characteristics of the network, and spread very fast, and the attack technology is getting more and more sophisticated, and the attack methods are becoming more and more complex. Traditional information security systems, such as firewalls and intrusion detection systems (IDS), have serious deficiencies in network attack prediction, and usually respond only after these attacks have caused serious damage. [0003] Most traditional intrusion detection systems use a network-based or host-based approach to identifying and responding to attacks. These systems often use two types of intrusion detection methods, namely anomalous intrusion detection and ch...

AI Technical Summary

Problems solved by technology

In most cases, intruders use the loopholes and insecure configurations of the application system to invade the system, and the application layer attack can use the border defense back door of the legitimate user to invade the system. Therefore, it is difficult for the above two IDS systems to detect such attacks

Images