Network security protection method and network security protection system

Abstract

The invention discloses a network security protection method and a network security protection system and is used for improving protection of an unknown attack mode and judgment of a malicious attack, and enabling a service system to be more secure. The method provided by the embodiment of the invention comprises the steps that a security agent receives a request data stream; the security agent sends the request data stream to a shadow system; a monitor monitors performance of the request data stream carried out by the shadow system, thereby obtaining a monitoring result, and sends the monitoring request to the security agent; the security agent judges whether the monitoring result satisfies a security standard or not; and the security agent forwards the request data stream to the service system if the monitoring result satisfies the security standard.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a network security protection method and a network security protection system. Background technique [0002] The rapid development of Internet technology has brought revolutionary changes to traditional business. Many enterprises have migrated their business to the Internet, which greatly facilitates people's life, but it also brings many security problems. Attackers seek related benefits by exploiting system vulnerabilities and business vulnerabilities. [0003] Existing security solutions center on attack methods and vulnerabilities. Through the analysis of existing attack methods and vulnerabilities, extract character strings and regular expressions as static features described by rules, and find and clear them based on static feature matching. known threats. [0004] However, existing security solutions have the following problems: [0005] (1) The development of the ...

AI Technical Summary

Problems solved by technology

Existing security solutions simply look at the content of the data flow statically, but do not know the context and semantics, and cannot distinguish between normal business and malicious behavior of attackers

[0007] (3) Existing security solutions are based on content identification, cannot process encrypted data, and cannot determine whether it is an effective attack, resulting in a large number of useless logs. For example, some are just scans by attackers, and the server does not actually This vulnerability does not exist

Images