Network security monitoring system for monitoring network data based on switch

Abstract

The invention discloses a network security monitoring system based on switch monitoring network data. The network security monitoring system comprises a vulnerability scanning module, a rule database, a processor and a switch, the vulnerability scanning module is used for scanning the network data according to a preset vulnerability scanning rule to find vulnerabilities; the rule database is used for storing vulnerability scanning data, known vulnerability features and known vulnerability processing rules; the processor is used for providing core operation data and a data interaction support protocol for the vulnerability scanning module, the rule database and the switch; the switch is provided with a port mirroring function and a network data monitoring function. And the data mirroring module is used for performing data mirroring on a request packet sent to the switch port by the network equipment in the network access process and a response packet corresponding to the request packet, and is used for identifying the network equipment connected with the data port of the switch and dynamically monitoring the network flow. According to the invention, the network security monitoring efficiency is improved.

Description

technical field [0001] The invention relates to the technical field of network security monitoring, in particular to a network security monitoring system based on switch monitoring network data. Background technique [0002] With the rapid development of network technology and attack technology, the security of network data becomes more and more important. The complete network structure is usually composed of operators, servers, switches, routers, and network equipment. The transmission of network data to network equipment It needs to rely on the switch to realize, therefore, the switch plays a major role in the network transmission system. In the traditional network data security monitoring technology, the network equipment part is often used as a carrier to detect network attacks and vulnerabilities, so as to discover, identify and handle network attacks. This network security monitoring method will give the host of the network equipment. Operation brings greater pressure...

AI Technical Summary

Problems solved by technology

In the traditional network data security monitoring technology, the network equipment part is often used as the carrier for network attack detection and vulnerability detection, so as to discover, identify and deal with network attacks. This kind of network security monitoring method will give the host of the network equipment The operation brings greater pressure, which in turn affects the normal use of large end users

Images