Networking alarm method and system for attack source

Abstract

The invention discloses a networking alarm method for an attack source. The networking alarm method comprises the following steps: receiving first attack source information reported by a first end management platform, updating current credit data according to the first attack source information, and generating a first credit data set; receiving second attack source information reported by a secondend management platform, and updating the first reputation data set according to the second attack source information to generate a second reputation data set; and issuing the second reputation dataset to the first end management platform, and sending the abnormal protocol message to a first-end management platform, so that the first-end management platform updates a matching rule of the first-end management platform, and the matching rule is used for identifying the abnormal protocol message, and after updating the matching rule of the first-end management platform, the first-end managementplatform issues the updated matching rule to a user side connected with the first-end management platform, so that the user side identifies the attack source according to the updated matching rule. According to the networking alarm method of the attack source, synchronization of matching rules of the attack source by the user side is achieved, and then mass prevention and mass treatment of the attack source are achieved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an attack source network alarm method and system. Background technique [0002] In recent years, cyber security incidents such as hacker attacks, cyber crimes, and cyber terrorism have occurred frequently, and state-level, organized, and large-scale cyber attacks are also common. Hacker attacks are developing from individuals to organizations and countries. They have strong purpose, obvious motives, and often have clear business, economic interests, or political demands. Attack methods have changed from traditional random viruses, Trojan horse infections, and network attacks to advanced How to effectively identify the source of attacks and respond in a timely manner has become a problem that cannot be ignored. The traditional intrusion detection system is based on its own rules for feature recognition, that is, it cannot be recognized beyond the coverage of the rules. A...

AI Technical Summary

Problems solved by technology

[0004] In general, the capabilities of existing solutions are relatively single, or limited to specific applications, and cannot achieve group prevention and group governance

Images