A kind of network protection software method and system based on linux kernel

Abstract

The invention discloses a network protective software method and system based on a linux kernel. The system comprises a kernel module, a monitoring module, a feature library and a control module. Thekernel module is used for screening, capturing, filtering and blocking data packets; the monitoring module is in charge of monitoring, analyzing and processing the network, receiving a network data packet of a kernel layer in a certain rule, analyzing the protocol, the content and the traffic of the data packet, judging whether the application type of the data packet is normal by comparing the feature library, discovering a potential safety risk in advance and taking effective measures; the feature library saves a great number of sample data, provides a data feature comparison function for ananalyzing module and is the headstone of analysis; the control module is in charge of managing other modules and controlling the method and system in the invention to design the protective scheme intotwo modes of simple filtering protection and feature identification protection, thereby breaking through the problem of a single function of the Linux traditional network protective software, increasing rule self-update and feature identification functions as well as making up for shortcomings of application analysis and comprehensively ensuring network safety of the Linux system.

Description

technical field [0001] The invention relates to a network protection software method and system based on a linux kernel, belonging to the technical field of network security. Background technique [0002] There are many Linux network protection software, most of which are developed based on the linux kernel, mainly the packet filtering function, the general steps are to define the filtering rules first, and then the kernel will filter the data packets according to the rules, but once the network structure changes, the rules need to be readjusted , and for the network structure that changes frequently, adjusting the rules will be very time-consuming. In addition, although the rules restrict access to certain ports, open ports will undoubtedly greatly increase the possibility of being attacked. [0003] Most small and medium-sized enterprises will adopt open source software solutions, such as iptables, an open source Linux firewall software, which is a typical Linux packet fi...

AI Technical Summary

Problems solved by technology

[0004] However, iptables will only filter data packets according to the preset rules. Although the data packet filtering technology plays a certain protective role, the network structure itself is complex and changeable, and the functions of iptables cannot be fully covered.

Images