Hardware independence method and system for realizing network traffic security analysis

Abstract

The invention provides a hardware independence method and system for realizing network traffic security analysis. The problems are solved that existing flow analysis is limited by a hardware platform,and effective deployment cannot be achieved. The method comprises the steps of: physically clustering the flow, and deploying a plurality of virtual machines on the platform to execute a traffic security analysis process, wherein the virtual machine can be distributed according to the speed of clustering flow; dynamically deploying a special virtual machine to process the specified flow; and meanwhile, arranging hardware probes on the bus, so that preliminary keyword matching can be directly carried out on the flow message, the flow message serves as an interface in butt joint with other third parties, abnormal points are found through deep detection of the flow by the virtual machine, tracing and morphological analysis comparison are carried out on the abnormal points to obtain an attackcoverage surface and virtual machine distribution, and effective deployment of a defense strategy is realized.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a hardware-independent method and system for implementing network traffic security analysis. Background technique [0002] Existing traffic analysis methods usually rely on a specific hardware platform. The greater the network traffic, the higher the requirements for hardware and deployment. However, the deployment environments in real scenarios are diverse, and the hardware facilities provided are also different, which puts forward new requirements for the traffic analysis system. [0003] The future traffic analysis system should be widely applicable to various hardware platforms. Users can ignore the hardware and leave it to the platform system to adapt. The platform system can be dynamically adjusted according to the current state of the hardware platform. [0004] Therefore, there is an urgent need for a targeted hardware-independent method and system fo...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a hardware-independent method and system for realizing network traffic security analysis, to solve the problem that the existing traffic analysis is limited by the hardware platform and cannot be effectively deployed, and adopts physical clustering traffic first, and deploys several The virtual machine executes the traffic security analysis process. The virtual machine can dynamically deploy a special virtual machine to process the specified traffic according to the speed distribution of the clustered traffic. At the same time, a hardware probe is arranged on the bus, which can directly perform a preliminary key on the traffic packet. Word matching, and as an interface with other third parties, through the in-depth inspection of the virtual machine to find abnormal points, and then trace the source of the abnormal points, and compare the attack coverage and virtual machine distribution obtained by morphological analysis, so as to realize the effective defense strategy deploy

Images