Security gateway based on intelligent behavior analysis, and security protection system

Abstract

The invention discloses a security gateway based on intelligent behavior analysis, comprising: a traffic parameter extraction function module for calculating a user network traffic behavior mode parameter through real-time sampling; a user behavior intelligent analysis module; and an application intelligent identification and traffic management and control function module for performing intelligent protocol identification on a mainstream application protocol based on the user behavior intelligent analysis module. The invention further discloses a security protection system, comprising: an intelligent cloud security center, and a security gateway; the centers of the intelligent cloud security center and the security gateway are linked in real time, the security gateway transmits the extracted user network traffic behavior mode parameter in the network to the intelligent cloud security center and executes a defense instruction issued by the intelligent cloud security center in real time,and the intelligent cloud security center performs deep learning and security analysis on the traffic behavior mode parameter, generates the defense instruction based on a risk quantification resultof an abnormal behavior and issues the defense instruction to the security gateway. The security gateway disclosed by the invention is applicable to the security detection of most network traffic, andcan achieve an accuracy rate of more than 80% in actual network test.

Description

technical field [0001] The invention belongs to the technical field of network security protection, relates to a security gateway based on intelligent behavior analysis, and also relates to a security protection system based on intelligent behavior analysis. Background technique [0002] At present, network security incidents occur frequently, and the network security situation is becoming more and more serious. The international competition for the mastery of information resources and Internet development is intensifying. Developed countries are vying to introduce cyberspace development strategies. National network security strategy, information security has been completely raised to the height of national security strategy. [0003] At present, security detection data analysis technologies at home and abroad are mainly divided into two categories: misuse detection and anomaly detection. Misuse detection searches audit event data to see if there are predefined misuse patte...

AI Technical Summary

Problems solved by technology

However, in many environments, it is difficult to establish characteristic profiles of normal user activity patterns and determine thresholds for alerting to abnormalities in activity

Images