Network safety warning system based on cluster and relavance

Abstract

This invention relates to an system based on alarming cluster and associated network safety including a monitor module, a buffer memory module, a hierachi clustering module, a database process module, an associated analysis module and an alarm and response module integrated on the upper control stand. The hierachi clustering module can reduce the same or similar redundant alarm information, so as to reduce its transmission volume or extra loads and reduce process burden of network managers who can be even more clear about the attack behavior and configurated safety strategy.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network security alarm system based on clustering and association. Background technique [0002] In the age of electronic information, with the development of network technology and the popularization of network applications, computer networks have penetrated into all fields and levels of social life, bringing more and more convenience and wealth to people; It has developed rapidly and improved significantly, and the means of attack have become increasingly complex and diverse. Security issues have become a major issue affecting national independence and security, economic operation and development, and social stability and prosperity. Network users are facing increasing security threats and threats. crisis. Therefore, while improving and developing network security technologies such as intrusion detection and firewall, it is also of great significance to ...

AI Technical Summary

Problems solved by technology

Therefore, the following problems will be caused: for the same attack behavior, there may be multiple consecutive identical or similar redundant alarm information in the same time period; the transmission volume of network information increases, and the security system often has to deal with a large number of Alarm, the overall processing capacity of the system is reduced; security administrators need to deal with a large amount of redundant alarm information, it is difficult to correctly analyze and identify attack behaviors in real time, configure network security policies, and deal with network security vulnerabilities; cannot clearly discover new or unknown attack mode; it is difficult to predict and prevent certain large-scale attacks with correlation or coordination

Images