Intrusion prevention system and method

Abstract

The invention discloses an intrusion prevention system and method. The intrusion prevention system comprises a data packet capture module, a data pack analysis module, a matching filter module, an FPGA (field programmable gate array) acceleration platform and a feature learning module; the data packet capture module is responsible for capturing and storing data packets entering a host; the data packet analysis module is used for analyzing and reorganizing the data packets captured by the data packet capture module; the matching filter module is used for matching and filtering the data packetscaptured in a matching filter through a matching filter algorithm; the FPGA acceleration platform is used for accelerating data by the aid of an FPGA calculation system and execution speed in algorithm of a packet classification module, the matching filter module and a neural training module; the feature learning module is used for performing neutral training on the data subjected to matching filter by the aid of a neutral network algorithm embedded in the FPGA acceleration platform. By the above principle, high calculation capability is achieved, intrusion behaviors can be detected in time before occurrence of the intrusion behaviors, misinformation and false report cannot happen, prevention effect is good, and the intrusion prevention system and method is quite suitable for intrusion prevention of big data.

Description

technical field [0001] The invention relates to the field of network security, in particular to an intrusion prevention system and method. Background technique [0002] With the advent of the era of big data, various big data technologies continue to emerge, bringing great convenience to people's social life. At the same time, issues related to the security of big data and the use of big data to carry out network attacks have become increasingly prominent, especially the most threatening APT attack. This has brought great threats to our network environment, especially for large enterprises and important national departments. The detection of APT attacks has also become the key detection object of network detection. Traditional intrusion detection / prevention systems have the disadvantages of high false positives and false negatives. [0003] The current mainstream solution is to use the fusion of multiple defense technologies, such as the combination of firewalls and intru...

AI Technical Summary

Problems solved by technology

This method has the following shortcomings: 1. In the face of the impact of high-speed and large-scale data, effective detection cannot be carried out, and the rate of false positives and false positives will be high; 2. Without a high-performance computing platform, it may not be detected in time An attack has been detected or an attack has been detected

This method has the following disadvantages: the high-performance computing capability of a single-chip NetFPGA chip is limited, and when large-scale high-speed data enters the intrusion prevention system, the defense effect is not ideal, performance bottlenecks will occur, and the false positive rate and false positive rate will be relatively high. Not suitable for defending against big data attacks

Images