Network intrusion detection and active defense linkage control device

Abstract

The invention discloses a network intrusion detection and active defense linkage control device, comprising a packet forwarding module, a packet mirroring traffic preprocessing module, a linkage control device module, a network behavior detection and analysis module and a traffic database cluster system.The invention combines the traditional network anomaly detection PHAD model method, combines the limited depth detection and analysis to the critical segment of the packet and tries to accurately determine whether the network traffic has the characteristic with attack behavior. On this basis, implement the dynamic intervention through the forwarding rules table of the packet forwarding module to achieve the abnormal data traffic block.The main characteristic of the device is to analyze the attack behavior and reverse control the forwarding behavior. When the abnormal network attack is detected, the data flow can be effectively cut off in real time so as to achieve the active detection attack and the active defense.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network intrusion detection and active defense linkage control device. Background technique [0002] Traditional intrusion detection techniques are divided into two types: misused-based techniques and anomaly-based techniques. The former detects by describing the special pattern of each attack, which is the main technique used in intrusion detection commercial products at present. It relies on artificial preset alarm rules to achieve, so it has its own advantages in the face of ever-changing network attacks. inherent flaws. The behavior of network attacks is changing, and the methods and methods are constantly changing. Traditional intrusion detection technologies almost fix the detection methods in the program, and it is difficult to cope with real-time changing intrusion methods (although some products currently provide upgrade strategies, but The imple...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a network intrusion detection and active defense linkage control device, which aims to solve the traditional intrusion detection has its own inherent defects in the face of ever-changing network attacks, the meaning of the alarm is vague, and the false alarm rate is high , it is difficult to coordinate between the systems, and the defense strategy cannot be actively implemented when an intrusion is detected. The network administrator needs to manually configure the device for defense, but it is impossible to achieve real-time linkage defense.

Images