A network intrusion detection and active defense linkage control device

Abstract

The invention discloses a network intrusion detection and active defense linkage control device, comprising a packet forwarding module, a packet mirroring traffic preprocessing module, a linkage control device module, a network behavior detection and analysis module and a traffic database cluster system.The invention combines the traditional network anomaly detection PHAD model method, combines the limited depth detection and analysis to the critical segment of the packet and tries to accurately determine whether the network traffic has the characteristic with attack behavior. On this basis, implement the dynamic intervention through the forwarding rules table of the packet forwarding module to achieve the abnormal data traffic block.The main characteristic of the device is to analyze the attack behavior and reverse control the forwarding behavior. When the abnormal network attack is detected, the data flow can be effectively cut off in real time so as to achieve the active detection attack and the active defense.

Description

Technical field [0001] The invention belongs to the technical field of network security, and particularly relates to a network intrusion detection and active defense linkage control device. Background technique [0002] Traditional intrusion detection techniques are divided into two types: misused-based techniques and anomaly-based techniques. The former is detected by describing the special mode of each attack. It is the main technique used in current intrusion detection commercial products. It relies on artificial pre-set alarm rules to achieve, so it has its own in the face of constantly changing network attacks. Inherent flaws. The behavior of network attacks is changing, and the methods and methods are constantly changing. Almost all traditional intrusion detection technologies solidify the detection methods in the program, and it is difficult to deal with real-time changes in intrusion methods (although some products currently provide upgrade strategies, but The implement...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a network intrusion detection and active defense linkage control device, which aims to solve the traditional intrusion detection has its own inherent defects in the face of ever-changing network attacks, the meaning of the alarm is vague, and the false alarm rate is high , it is difficult to coordinate between the systems, and the defense strategy cannot be actively implemented when an intrusion is detected. The network administrator needs to manually configure the device for defense, but it is impossible to achieve real-time linkage defense.

Images