Attack surface protection method and system for virtual micro-isolation network

Abstract

The invention provides an attack surface protection method and system for a virtual micro-isolation network. The method comprises the following steps: collecting, analyzing and extracting feature vectors and flow table entries in traffic data by using an OpenFlow protocol; obtaining a communication relationship between virtual machines in a distributed virtual environment, carrying out micro-isolation grouping on the virtual machines by using clustering processing; verifying whether a network attack behavior exists between the virtual machines in the communication relationship or not; dynamically deploying a security protection strategy for micro-isolation grouping of the virtual machine according to a verification result; checking data fragments through each virtual machine, extracting available attack vectors, analyzing whether the data fragments are abnormal or not, and whether a plurality of abnormal data fragments are logically associated or not, thereby determining and labeling abnormal points and adjusting a security protection strategy of related micro-isolation groups.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to an attack surface protection method and system for a virtual micro-isolated network. Background technique [0002] Now it is more and more common to use virtualization technology to build data centers, which brings new security issues. In a virtualized network environment, a large amount of traffic data is forwarded through virtual switches instead of firewalls, making traditional security protection measures ineffective. The communication flow between virtual machines becomes uncontrollable, and the threats of internal virtual machines cannot be detected or controlled. There are a large number of virtual machines in a distributed virtual environment. How to dynamically deploy security protection policies is also a technical problem that needs to be solved urgently. [0003] At the same time, the current network communication is facing more and more hidden sec...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a method and system for protecting the attack surface of a virtual micro-isolated network, which solves the lack of control methods for traffic data between massive virtual machines in the prior art and the lack of dynamic deployment security protection strategies. Technical Issues in Detecting Attack Surfaces in

Images