Software intrusion detection system and method

Abstract

The invention provides a software intrusion detection system and method. The software intrusion detection system includes three levels: a control kernel, a detection kernel and an output kernel, wherein the control kernel is used for interacting with an upper layer controller, and managing the information generated from the detection kernel and the output kernel; the detection kernel is used for performing acquisition and analysis on a data packet, based on DPDK (DataPlane DevelopmentKit), traversing a rule base to performing detection matching on the analyzed data packet; and the output kernel is used for recording the detection matching result obtained by the detection kernel in a system log on time, packaging the obtained invalid data packet information and then reporting the packaged invalid data packet information to the control kernel according to the detection matching result. The software intrusion detection system and method are flexible in deployment and high in scalability, have the advantages of reducing copy of messages and having nucleophilicity, and can significantly improve the processing capability of messages. Besides, the upper layer is opened for the control interface, so that the software intrusion detection system and method have controllability, and can be preferably compatible with a virtual and cloud computing platform.

Description

technical field [0001] The invention relates to the technical field of security monitoring, and more specifically, to a software-based intrusion detection system and method. Background technique [0002] Intrusion Detection System (Intrusion Detection System, IDS) is a software application or hardware device used to monitor malicious events in the network or computer. signs, and generate system logs to the management unit, so as to realize timely response and processing of intrusion or attack. [0003] Traditional intrusion detection systems include hardware intrusion detection systems and software intrusion detection systems. Among them, the hardware intrusion detection system is usually composed of hardware, manufactured and developed by professional equipment manufacturers, and needs to rely on multiple equipment and software to operate together. IDS hardware products can be basically divided into two categories according to the source of their input data: Host-based ID...

AI Technical Summary

Problems solved by technology

[0007] The present invention provides a software-based intrusion detection system and method, which can solve the problems existing in existing intrusion detection systems, such as poor scalability, inflexible deployment, poor performance and poor controllability, and inability to adapt to the development of switching technology and high-speed networks

Images