A Multi-Layered Cooperative Defense Model Adapted to Source-Network-Load Control Private Network
A collaborative defense and source-network-load technology, applied in digital transmission systems, secure communication devices, electrical components, etc., can solve problems such as interruption and increase the difficulty of source-network-load control private network security prevention, etc., to achieve correct monitoring and improve security protection The effect of capacity, rapid response and disposition
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0037] The threat information found by each module through monitoring and can be reported layer by layer includes security events, abnormal operation, equipment failures, and personnel operations. Threat information levels are divided into general, important, and urgent from low to high; The security collaborative defense policies delivered by the collaborative defense module and the collaborative defense control module include access control, security access, and intrusion prevention. Threat events should adopt a high-priority collaborative protection strategy. Some threat information and security collaborative defense strategies are shown in Tables 1 and 2 below.
[0038] Table 1 Threat information reported by monitoring
[0039]
[0040]
[0041] Table 2 Security collaborative defense strategy
[0042]
[0043]
Embodiment 2
[0045] Among them, collaborative services are divided into three collaborative service modes: event-based collaborative judgment, security-based collaborative control, and threat-based collaborative blocking.
[0046] 1) Event-based collaborative judgment is based on the mutual verification of security event information discovered by multiple security collaborative devices through different monitoring methods, and complement each other to realize the collaborative judgment of network security events. For example, when a host launches a DDoS network traffic attack on the local network, the domain module where the host is located will simultaneously monitor the host abnormal operation behavior information sent by the host security monitoring software, the host flow abnormal information sent by the network device, and the network attack information sent by the security device wait for news. Through the mutual matching and verification of the source host network IP address, networ...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More