Intrusion detection system and method based on traceability information

Abstract

The invention discloses an intrusion detection system and method based on traceability information. The system includes a collector, a detector and an analyzer; the collector includes a traceability generation unit, a traceability trimming unit and a traceability storage unit, and the detector includes a rule base establishing unit , a rule matching unit and an output warning report unit, the analyzer includes a propagation query unit and a traceability query unit; the method is to collect the traceability information, store the traceability information in the form of a file on the file system, and store it in the traceability database at the same time. Based on the dependency information in the traceability database, a rule database is established based on the dependency information. During intrusion detection, the detected traceability information is compared with the traceability information in the rule base. When an intrusion is found, an early warning report is output, and the intrusion detection provided by the early warning report is used. The system and the method provided by the present invention improve the real-time performance of the intrusion detection.

Description

technical field [0001] The invention belongs to the technical field of computer system security, and more specifically relates to an intrusion detection system and method based on traceability information. Background technique [0002] At present, incidents of using computer networks to commit crimes are by no means uncommon. Facing an increasingly open network environment, data security is also under great threat. The security of information systems is generally protected by security mechanisms such as identification and authentication, access control, and encryption technologies. Firewall technologies are used to protect internal networks and external networks. However, these methods cannot completely prevent intrusions, and attackers may Use various system vulnerabilities (such as unpatched operating systems, program bugs, firewall configuration errors, simple passwords, etc.) to endanger computer systems, resulting in sensitive data being leaked or modified. Therefore,...

AI Technical Summary

Problems solved by technology

[0004] In view of the above defects or improvement needs of the prior art, the present invention provides an intrusion detection system and method based on traceability information, the purpose of which is to solve the technical problem of low real-time intrusion detection in the prior art

Images