Isolation attack method and system for distributed virtual network

Abstract

The invention provides an isolation attack method and system for a distributed virtual network. The method comprises the following steps: collecting, analyzing and extracting feature vectors and flowtable entries in flow data by using an OpenFlow protocol; obtaining a communication relationship between virtual machines in a distributed virtual environment, carrying out micro-isolation grouping onthe virtual machines by using clustering processing; verifying whether a network attack behavior exists between the virtual machines in the communication relationship or not; dynamically deploying asecurity protection strategy for micro-isolation grouping of the virtual machine according to a verification result; situational values of a single device and a local network are evaluated, the architecture composition of the whole network is combined to obtain the situation value of the whole system, the situation values of different levels are imported into a neural network model for attack prediction, and finally, the security protection strategy of related micro-isolation groups is dynamically adjusted according to the prediction result.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and system for isolating attacks of a distributed virtual network. Background technique [0002] Now it is more and more common to use virtualization technology to build data centers, which brings new security issues. In a virtualized network environment, a large amount of traffic data is forwarded through virtual switches instead of firewalls, making traditional security protection measures ineffective. The communication flow between virtual machines becomes uncontrollable, and the threats of internal virtual machines cannot be detected or controlled. There are a large number of virtual machines in a distributed virtual environment. How to dynamically deploy security protection policies is also a technical problem that needs to be solved urgently. [0003] At the same time, a large number of virtual machines form a huge network structure, and potenti...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a distributed virtual network isolation attack method and system, to solve the lack of control methods for traffic data between massive virtual machines in the prior art, the lack of dynamic deployment security protection strategies, and the prediction of attacks against massive network structures technical issues

Images