Data packet marking traceability device based on knowledge graph

Abstract

The invention discloses a data packet marking traceability device based on a knowledge graph, which combines intrusion detection technology and attack traceability technology. The intrusion detection technology mainly detects and analyzes the behavior of network traffic described by the knowledge graph technology, and draws the information of both sides of the communication. Association relationship, counting the number of connections, once it exceeds the set threshold, it will be judged that abnormal traffic occurs, and corresponding operations will be implemented for abnormal behavior; the traceability technology emphasizes a technology of tracing back to the source, which reproduces the history of data according to the trace path Traceability, path traceability is more about using the tag information in the data packet to determine the forwarded path of the data packet during network transmission. When the network receives a malicious data packet attack, the marking device can be used to accurately and efficiently trace the source of the data packet, which can quickly alleviate or defend against distributed denial of service attacks or malicious data packet attacks to a certain extent.

Description

technical field [0001] The invention relates to the field of attack traceability in network security, in particular to a data packet mark traceability device based on a knowledge graph. Background technique [0002] my country has become one of the countries that suffer the most serious cyber attacks in the world. The current situation of network security is very severe. How to carry out targeted defense has plagued the industry, academia and research circles of network security at home and abroad for many years. It is currently a major issue in network security research. problem. [0003] In order to block network attacks from the source, it is often necessary to trace the source of the attack, such as the IP address of the attack, the hacker and his organization that carried out the attack, and so on. Most of the existing security protection systems focus on the discovery and blocking of network attacks, and it is difficult to provide accurate traceability to the source of...

AI Technical Summary

Problems solved by technology

[0005] In view of the problem that most of the existing security protection systems focus on the discovery and blocking of network attacks, and it is difficult to provide accurate traceability to the source of the attack, the present invention discloses a data packet marking based on knowledge graph suitable for regional networks Traceability device, which combines intrusion detection technology and attack traceability technology, and applies it to the regional network

Images