Virtual network security management and control method based on multistage alarm and linkage defense

Abstract

The invention discloses a virtual network security control method based on multi-level alarm and linkage defense, and the method comprises the following steps: removing false alarms in original alarms according to attributes of the original alarms to obtain attack alarms; aggregating the attack alarms to obtain an aggregated alarm sequence; and based on the aggregated alarm sequence, obtaining an alarm association graph according to a Markov chain model and a frequent item set association rule. According to the method, firstly, false alarm removal and alarm aggregation preprocessing are carried out on alarms, so that redundant alarms are reduced, and the false alarm rate is reduced; and then correlation analysis is carried out on the alarms, the transition probability between the alarms is quantitatively and objectively calculated based on an alarm correlation method of a Markov chain and a frequent item set correlation rule, and logic correlation between alarm information is discovered, so an attack intention is identified, and a basis is provided for security defense.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a virtual network security management and control method based on multi-level alarm and linkage defense. Background technique [0002] Software Defined Network (SDN) is an emerging architecture. By separating control and forwarding, the control logic of switching devices in the network is concentrated on one computing device, which improves network management and configuration capabilities. At the same time, its open interface and programmable features make network management simpler, more dynamic and more flexible. SDN is mainly composed of an application layer, a control plane, and a data plane. The application layer meets the user's diverse business customization needs through an open northbound interface. The control plane has global network topology monitoring and infrastructure management capabilities, and receives and processes user requests through the northbound i...

AI Technical Summary

Problems solved by technology

[0009] In view of this, the embodiment of the present invention provides a virtual network security management and control method based on multi-level alarm and linkage defense to solve the technical problem of poor detection performance of the intrusion detection system in the prior art

Images