NFV-based dynamic intrusion detection method and system

Abstract

The invention relates to an NFV-based dynamic intrusion detection method and system. The method comprises the steps of: constructing a plurality of virtual detection node groups, wherein each virtual detection node group comprises a plurality of virtual detection nodes, and each virtual detection node stores a corresponding detection feature group and has the same node detection capability threshold value; when the to-be-detected data exceeds the node detection capability threshold, copying the to-be-detected data by adopting an SDN flow copying technology, and simultaneously distributing the to-be-detected data to each virtual detection node group in parallel; distributing the to-be-detected data to each virtual detection node according to the node detection capability threshold value and the node real-time detection capability value of each virtual detection node in each virtual detection node group; and enabling each virtual detection node to perform intrusion detection on the to-be-detected data allocated to the virtual detection node at the same time. According to the invention, the flexibility of the intrusion detection network can be improved, the maintenance and procurement cost is reduced, and the business fusion degree is improved.

Description

technical field [0001] The present invention relates to the field of network security, and more specifically, to a dynamic intrusion detection method and system based on NFV (Network Functions Virtualization, network function virtualization). Background technique [0002] The issue of information system security is a very complex issue, that is, how complex the information system is, the complexity of the information system security issue. Similarly, information security is a concept that is difficult to quantify. We can compare the "performance" and "security" of an information system. For performance issues such as network throughput, system computing speed, database storage, query indicators, etc., users can consider choices according to their actual business needs, budget and other conditions. Although users cannot touch or feel the improvement of system performance, they can actually see it. Therefore, it is very important to improve the performance and stability of i...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to provide a dynamic intrusion detection method and system based on NFV for the above-mentioned defects of the prior art, which utilizes NFV network technology, distributed computing architecture, SDN (SoftwareDefined Network, software defined network ) Network orchestration technology, on the premise of maintaining superior intrusion detection performance, solves the problems of traditional detection equipment hardware specificity, non-sharing of resources, poor business integration, and inflexible detection resource scheduling, improving the flexibility of intrusion detection networks and reducing maintenance and procurement costs, and improve business integration

Images