Network invading event risk evaluating method and system

Abstract

A risk estimating system of network intrusion event comprises engine module for carrying out effectiveness analyzing filter and risk estimating calculation to intrusion event according to set condition , controlling and managing unit of engine module , display and report module of risk estimation result on intrusion event .

Description

technical field [0001] The present invention relates to the field of computer network security, and is a method and system in which a network intrusion detection system (NIDS: Network Intrusion Detection System) and a vulnerability scanning system (Scanner) work together to reduce the data volume of IDS alarm events and improve IDS alarm The precision of the event. Background technique [0002] NIDS is installed in the protected network segment, and its monitoring network card works in promiscuous mode. It performs pattern matching analysis on all data packets in the network segment based on network behavior characteristics and feature database (knowledge base), and performs real-time detection and monitoring of network security events. response. In terms of the amount of data reported by events and the accuracy of detection, this single matching detection method has a certain degree of defects. A simple example can illustrate this point. Imagine the following environment:...

AI Technical Summary

Problems solved by technology

Assuming that a hacker on the extranet of the enterprise conducts an exhaustive guessing of user passwords based on the FTP service of the server, in fact, because the server does not provide FTP services and port 21 is closed, the intrusion does not really pose a threat , but since the traditional IDS has no records about the server system configuration, this event will also be reported

Images