Network attack data analysis and intelligent processing method

Abstract

The invention relates to a network attack data analysis and intelligent processing method which comprises the steps that: S1, various network safety devices are connected to one or more SDN switches to form a safety resource pool; S2, a safety controller sends out a safety control instruction to operate the SDN switches, and according to different user safety demands, pulling network traffic to designated network safety devices to carry out processing; and S3, the safety controller carries out strategy centralized management and state real-time monitoring on the network safety devices, and when the network safety devices are abnormal, the safety controller sends out a safety strategy instruction to carry out balanced load or traffic migration so as to ensure no influence on normal network communication. The network attack data analysis and intelligent processing method is characterized by further comprising the steps of: by a Telent protocol, actively collecting real-time state information, local flash memory information and collection log center information of a network device, a safety device and a server; carrying out big data real-time comprehensive analysis; updating and synchronizing a third-party IDS feature library; carrying out whole network attack modeling; generating a defense instruction; and carrying out combination defense.

Description

technical field [0001] The invention relates to the technical field of network engineering, in particular to a network attack data analysis and intelligent processing method. Background technique [0002] The development of information technology has brought both convenience and threat to people, so solving security problems is an urgent task in network and information construction. Traditional network defense measures, such as anti-virus software, firewall technology, and intrusion detection systems, etc., are passive security defense strategies. When faced with a huge persecution attack in a short period of time, they will suffer heavy losses and lack protection against vulnerabilities. State correlation analysis, multi-vulnerability and threat assessment methods only study the impact of each attack event on host or network security in isolation, ignoring the logic and correlation between attack events, resulting in incomplete and accurate evaluation results . [0003] S...

AI Technical Summary

Problems solved by technology

Traditional network defense measures, such as anti-virus software, firewall technology, and intrusion detection systems, etc., are passive security defense strategies. When faced with a huge persecution attack in a short period of time, they will suffer heavy losses and lack protection against vulnerabilities. State correlation analysis, multi-vulnerability and threat assessment methods only study the impact of each attack event on host or network security in isolation, ignoring the logic and correlation between attack events, resulting in incomplete and accurate evaluation results

[0003] Since the assessment methods have not yet reached a consensus on early warning and real-time analysis, the existing security assessment mainly includes post-event assessment based on IDS, COPS and other alarm information and pre-event assessment based on network vulnerability analysis. The assessment is lagging and cannot provide an effective basis for the formulation of active defense strategies; the pre-assessment is static and cannot reflect the evolution of the network attack situation in real time. Therefore, there is currently no network security assessment that can meet both predictability and real-time requirements method

[0004] At present, network security equipment and network management software at home and abroad are still limited to a single function and strategy, or simple linkage, administrators also face greater learning and use costs, and work efficiency is low

Even if a security vendor provides a multi-device comprehensive solution of the same brand and provides professional technical training, it cannot cope well with complex network attack methods or cause great harm due to long lag time