Unknown file detection system and method based on security baseline sample machine

Abstract

The invention provides an unknown file detection system and method based on security baseline sample machine; the system and method are implemented through sandbox and honeypot technology, vulnerability detection technology and data access technology; file security is judged and a corresponding defensive strategy is generated when an unknown file enters an industrial personal network; an industrial personal computer terminal in the network handles the unknown file according to the defensive strategy. The security of an unknown file is judged through a security baseline arranged at a service end at a network entry; the unknown file entering the industrial personal network is detected by the service end first instead of being issued directly to the industrial personal computer terminal; the environmental security of the industrial personal network can be guaranteed, and infection by the unknown file is avoided.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to an unknown file detection system and method based on a security baseline sample machine. Background technique [0002] With the rapid development of computer technology, the security problems of industrial computers are gradually exposed. Before the power outage in Ukraine, industrial computer users did not pay much attention to the security of industrial computers. They thought that the physically isolated environment was already very safe, because industrial computers could not be patched. Repair, the system is very old, and there are many loopholes that need to be repaired. Pure physical isolation can no longer meet the security needs of the industrial computer. A system that configures policies based on the actual vulnerability of the internal industrial computer to effectively maintain the security of industrial control equipment. Contents of the invention ...

AI Technical Summary

Problems solved by technology

[0002] With the rapid development of computer technology, the security problems of industrial computers are gradually exposed. Before the power outage in Ukraine, industrial computer users did not pay much attention to the security of industrial computers. They thought that the physically isolated environment was already very safe, because industrial computers could not be patched. Repair, the system is very old, and there are many loopholes that need to be repaired. Pure physical isolation can no longer meet the security needs of the industrial computer. The actual vulnerability situation configuration strategy system of the internal industrial computer to effectively maintain the security of industrial control equipment

Images