A kind of active defense system method and method based on biological immunity

Abstract

The invention discloses an active defense system and method based on biological immunity. The system includes: a terminal equipped with a known behavior library trained through the cloud, and through a mechanism similar to biological immunity, the behavior generated based on internal and external data Carry out local detection, real-time monitoring, first-level active defense, and send unidentified unknown behaviors to the cloud; the cloud has a known behavior library trained on the cloud to collect unknown behaviors sent by the terminal, Introduce deep learning, carry out cloud detection and behavior early warning, and push new behaviors to the terminal in real time for second-level defense. Safe computer behavior, realize the overall defense and active defense of the cloud-terminal collaborative computing environment.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a biological immunity-based active defense system method and method for a cloud-end collaborative computing environment. Background technique [0002] In the early stage of computer development, when stand-alone computer viruses appeared, it was generally adopted to install stand-alone anti-virus software to solve security problems. With the popularization of the network, security problems such as worms and Trojan horses that can spread in the network have appeared, and network security software with cloud scanning and killing can be installed to partially solve the security problem. At present, with the emergence of new network computing models such as the Internet, cloud computing, Internet of Things, fog computing, and edge computing, network applications are becoming more and more extensive, user needs are changing, environments are heterogeneous, networks are comple...

AI Technical Summary

Problems solved by technology

[0003] The current methods to solve network security problems have the following problems: ①It can only prevent existing security problems. If new system vulnerabilities or security problems appear, it is necessary to wait until the security software and equipment manufacturers release solutions and upgrade the software or equipment to solve them. ; ②It can only stop the security behaviors that have already occurred, and cannot warn and solve the security risks lurking in the terminal in advance; ③The security problems of the terminal are mostly solved by the security software installed by itself, and there is no integration of cloud and terminal Collaborative defense function

[0004] In the prior art, the author is Ren Xianghua, and Harbin University of Science and Technology published a master's degree thesis "Research and Implementation of an Intrusion Detection System Based on Biological Immunity" in May 2006, which proposed an intrusion detection system based on biological immunity. Composed of detection subsets distributed in different nodes, combined with normal detection and misuse detection methods, expert rules are used as innate detectors to detect some known intrusions, but it cannot solve the problem of actively detecting unknown viruses and intrusions; by "University of Electronic Science and Technology of China "Published in 2012, the author is Tao Xu "Research on Intrusion Detection Method Based on Biological Immunity", referring to the mechanism of memory cells, designing an information detection method based on biological immunity, and designing common antibodies and effective antibodies on the basis of conventional intrusion detection The three detectors, memory antibody and memory antibody, can detect some abnormalities, but have a certain false detection rate

Images