Intrusion detection system based on software defined security architecture

Abstract

The invention discloses an intrusion detection system based on a software defined security architecture in the field of network information security. The intrusion detection system comprises a clientmodule and a cloud module; The cloud module comprises a cloud agent, an intrusion detection engine, an expert rule base, a machine learning base and a log database. The intrusion detection engine adopts Snort-based feature detection technology and machine learning-based anomaly detection technology. The software-defined security architecture provides programmable control and global state monitoring of the network. A unified transparent access mode is provided for a lower abstraction bottom layer security device. A northbound security application is expanded. The advantages of the cloud computing technology on elastic computing, distributed computing, load balancing and big data processing capacity are brought into play. An expert rule library, an intrusion detection engine and a related artificial intelligence detection algorithm are deployed at a cloud end. The intelligent detection efficiency of the system is improved, and the dynamic expansion capacity of the system and the rapid response capacity to new security threats are enhanced.

Description

technical field [0001] The present application belongs to the field of network information security, and in particular, relates to an intrusion detection system and a detection method under a software-defined security architecture. Background technique [0002] In recent years, with the rapid development of Internet technology, the continuous expansion of network scale, the continuous increase of network traffic, and the increasing complexity of network architecture, traditional network architecture is facing more and more severe challenges and tests. At the same time, the complex network environment has also brought many network security problems, such as malicious software attacks, spoofing attacks and distributed denial of service attacks. The increasingly prominent network security issues have gradually posed more serious challenges to the traditional security system architecture, service models and technical means. On the one hand, with the continuous development of re...

AI Technical Summary

Problems solved by technology

However, the currently commonly used feature-based detection methods need to accurately describe the features and pre-define the rules to match the intrusion target, and cannot realize the identification and detection of unknown attacks. Detect inevitable trends and needs of development

Images