Linkage defense system based on deep learning and agent

Abstract

The invention discloses a linkage defense system based on deep learning and agent, which comprises a DPDK traffic acquisition module, a protocol analysis module, a file restoration and encryption storage module, a sensitive information detection module, a sensitive alarm module, a linkage defense policy decision module, a linkage defense tactical decision delivery module, a linkage defense policyexecution module, and a linkage defense policy verification module. The implementation process of the linkage defense system based on deep learning and agent in the present invention is of detecting an abnormal behavior in the monitoring scope, and generating an alarm for the abnormal behavior; forming a linkage defense policy according to the alarm information and delivering the linkage defense policy to the agent of an assigned host; carrying out, via the agent of the host, the operation of policy definition after receiving the linkage defense policy and finishing linkage defense. The linkage defense system based on deep learning and agent in the invention uses the policy linkage mechanism to organically link the detection result with the host defense, thereby greatly reducing the response time of linkage defense and increasing the effectiveness of linkage defense; and obvious and important social significance and the practical significance are achieved.

Description

technical field [0001] The invention relates to a linkage defense system based on deep learning and agent, and belongs to the technical field of safety monitoring and linkage defense. Background technique [0002] On June 1, 2017, the country officially implemented the "National Cyber ​​Security Law", which emphasized the importance of sensitive information monitoring, and data leakage violations will definitely have a serious negative impact on the social image and economic benefits of the industry. [0003] The breakdown of data leakage behaviors includes the leakage of structural data stored in databases, corporate development strategies, contracts, project development plans, and other office documents involving business secrets during corporate operations. The more commonly used detection of data leakage violations is based on sensitive keyword matching. This method has a high rate of false negatives and false positives. For example, an ordinary document contains "unspea...

AI Technical Summary

Problems solved by technology

The more commonly used detection of data leakage violations is based on sensitive keyword matching. This method has a high rate of false negatives and false positives. For example, an ordinary document contains "unspeakable secrets, plans, next steps, plans", etc. When sensitive keywords are used, they will be misjudged as sensitive files based on the sensitive keyword matching program, and it will take a lot of manpower to review later

On the other hand, most of the existing behavior blocking methods are individual defense responses, that is, the monitoring system generates an alarm after detecting data leakage violations, and the handling personnel use manual means to deal with the alarm after seeing the alarm information. When the volume is large, firstly, it is difficult for operators to effectively confirm the alarm information; secondly, operators cannot quickly deal with timely and effective blocking of data leakage violations

[0004] To sum up, the traditional detection methods of data leakage and violations are relatively mechanized, which are prone to a large number of false negatives and false positives, and the defense response method is relatively single and lagging behind, which is not conducive to the comprehensive detection and timely processing of incidents.

Images