Network safety guarded distributing invading detection and internal net monitoring system and method thereof

Abstract

The method is suitable to exchange type LAN, sharing type LAN, multiple sub networks distributed type large and medium size type network. The system including three layers type structure contains detector in host, CPU, management and control center, and background database. The method includes following procedures: establishing safety rules; based on safety rules, intrusion detection and monitoring and controlling Intranet according to IP address and MAC address; breaking, alarming intrusion and violation, and recording it to background database; auditing recorded information; recovering destroyed data etc. The integrated system possesses features of favorable expansibility, maintainability, portable and reuse.

Description

technical field [0001] The invention relates to a system and method for network security protection, in particular to a distributed intrusion detection and intranet monitoring system and method for network security protection. The system and method can provide network security guarantees for internal LAN and network users connected to the Internet. It is suitable for secret-related networks with strict requirements on network security, as well as financial, insurance, electric power, tobacco, education, securities, etc. Large and medium-sized networks with large networks, complex network conditions, and centralized management of network security. Background technique [0002] With the wide application of the Internet and the rapid development of e-commerce, higher and higher requirements are put forward for network security technology, and network security has become an important issue of concern to governments and enterprises all over the world. At present, anti-virus soft...

AI Technical Summary

Problems solved by technology

These security products and technologies play a certain protective role in network security, but because these are all split, single security products and technologies, and lack of strong monitoring of the intranet, the protection of the entire network security has the following defects : 1. A single network security product can only protect the security of the network from different aspects, and cannot provide an overall protection scheme for network security. There are related problems, and the firewall is directly blocked, which affects the network speed; another example is the intrusion detection system IDS lacks the internal network monitoring function, and cannot intelligently refine network management according to network management requirements

2. The current network product security blocking strategy is inflexible and has poor scalability, making it difficult to improve and upgrade in time with the continuous improvement of network attack technology and the continuous change of attack methods

3. When the current intrusion detection system IDS detects communication data, it will affect the speed of the data flow; and the IDS system generally uses document records, the amount of records is not large, and the processing is not flexible

4. General intrusion detection system IDS is based on IP address access control, and IP address is easy to change and counterfeit, which will affect the accuracy of monitoring

Images