Network intrusion prevention system based on behavior check

Abstract

The embodiment of the invention discloses a network intrusion prevention system based on behavior check, and the system comprises a strategy management platform which carries out the analysis of the operation information of a user, transmits the operation information to an information detector according to a control object, and generates a linkage control instruction; a data capture module which is used for receiving a host and a network data source, obtaining log information, reading intrusion rules through a rule base and sending alarm information to the strategy management platform according to a unified alarm format; an attack detection response module which is used for carrying out attack detection on the captured data according to the linkage control instruction; a data control module which is used for monitoring and controlling data in the network according to the on-off of the firewall, storing various captured data information in the system through the data storage module. A distributed multi-point defense strategy is adopted, so that the whole system has a sensitive intrusion response mechanism and accurate attack positioning, user data content cannot be changed randomly,the packet loss rate is low, smooth network communication can be ensured, and the network intrusion attack intensity is weakened.

Description

technical field [0001] The embodiment of the present invention relates to the technical field of behavior inspection, and in particular to a network intrusion prevention system based on behavior inspection. Background technique [0002] In recent years, security threats have shown a development trend of "many, fast, and high". "Many" refers to a large number of security incidents; The latest worm virus can spread to the whole world within a few minutes, and attack behaviors or tools targeting the vulnerabilities appear within a few hours after the announcement of the new vulnerabilities; "high" means that the level of security threats is getting higher and higher. Most threats have developed from the network layer to the application layer, including intrusions, worms, and P2P abuse. From a macro perspective, many security incidents are accompanied by a series of behavioral characteristics. For example, Trojan viruses are mainly spread through file downloads, and For example...

AI Technical Summary

Problems solved by technology

[0003] To this end, the embodiment of the present invention provides a network intrusion prevention system based on behavior inspection, which adopts a distributed multi-point defense strategy, uses the internal nodes of the network to traverse the entire network scene after being invaded, and selects the optimal attack prevention node for network data transmission Or exchange, the entire system ...

Images