Attack mode automatic identification system based on Internet of Things

Abstract

The invention discloses an attack mode automatic identification system based on the Internet of Things, which comprises a network security monitoring system, an attack mode automatic identification module and a host, and is characterized in that the network security monitoring system comprises a security interaction platform and logic isolation equipment which are arranged at the boundary of an information intranet server and an information extranet server, and IPS / IDS equipment identifies intrusion threats; a honeypot system extracts intruder attack features; an APT attack detection equipmentidentifies advanced persistent threats; attack tracing equipment restores the attack behavior and locates the intruder through the intruder information locating module; a DNS monitoring system positions an attacked host; a behavior tracking system and a behavior analysis and verification module form service access control, and the host is in signal connection with the intranet server through theattack mode automatic identification module; intrusion threats are actively recognized, intruder attack features are extracted, advanced persistent threats are recognized, attack behaviors are restored, intruders are positioned, and protection on the host and data is improved.

Description

technical field [0001] The invention relates to the technical field of the Internet of Things, in particular to an automatic identification system for attack methods based on the Internet of Things. Background technique [0002] The traditional Internet is mature and widely used, but there are still security loopholes. As an emerging product, the Internet of Things has a more complex architecture, no unified standards, and more prominent security issues in all aspects. The key implementation technology is the sensor network. In the natural environment where the sensor is exposed, especially some sensors placed in the harsh environment, how to maintain the integrity of the network for a long time puts forward new requirements for the sensor technology. The sensor network must have its own healing function. This is not only affected by environmental factors, but also by human factors. RFID is another key implementation technology, which is to put electronic tags into items ...

AI Technical Summary

Problems solved by technology

[0004] While improving the level of automation, digitalization and intelligence in the power system, it is necessary to pay more attention to the network security monitoring system. Once the power network is attacked, the consequences will be even more unimaginable. Because in the existing technology, there is a lack of IoT-based The automatic identification system of attack methods makes it difficult to identify intrusion threats, extract the attack characteristics of intruders, identify advanced persistent threats, restore attack behaviors, locate intruders, and locate attacked hosts. The protection effect is not satisfactory, so it is necessary to redesign an automatic identification system for attack methods based on the Internet of Things

Images