Network intrusion detection and response system and method

Abstract

The invention discloses a network intrusion detection and response system and method, relates to the technical field of computer network security, and adopts the technical scheme that the network intrusion detection and response system comprises an intrusion detection response management platform module which comprises a flow data access module, a data analysis processing module and a response display module, the system has the advantages that safety and operation and maintenance pressure is relieved, assets contained in the flow are automatically recognized, the efficiency and accuracy of asset carding are greatly improved, and the system is high in practicability and easy to popularize and apply. According to the method, great convenience is brought to asset management, the security of a network system is effectively protected, exposed sensitive data can be identified at the first time by monitoring API changes in real time, existing security problems can be found in time, and proper measures can be taken in time to deal with related problems, so that the data security is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to a network intrusion detection and response system and method. Background Art

[0002] In the Internet age where information is the key to success, the importance of information resources has become more prominent. Since the information that a single enterprise can obtain or provide is limited, public information service platforms have emerged. Most of these platforms are invested by multiple entities such as the government, enterprises, universities, and industry organizations, operate using market-oriented mechanisms, are open to the public, serve small and medium-sized enterprises, research and develop common and key technologies in the industry, and enhance the innovation capabilities of the region.

[0003] The existing network security equipment generates a large number of alarms, making it difficult to quickly identify real alarms and effective attacks at the server level, and unable to respond to attacks in a timely and effective manner, resulting in high pressure and low efficiency in security duty work. Summary of the invention

[0004] To this end, the present invention provides a network intrusion detection and response system and method to solve the problem that the number of network security equipment alarms is very large, it is difficult to quickly identify real alarms and effective attacks that have invaded the server level, and it is impossible to respond to the attacks in time, resulting in high pressure and low efficiency in security duty work.

[0005] In order to achieve the above-mentioned purpose, the present invention provides the following technical solutions: a network intrusion detection and response system, including an intrusion detection response management platform module, the intrusion detection response management platform module includes a traffic data access module, a data analysis and processing module and a response display module, the output end of the traffic data access module is data connected to the input end of the data analysis and processing module, and the output end of the data analysis and processing module is data connected to the input end of the response display module.

[0006] Preferably, the traffic data access module includes a physical network data traffic module, a host data traffic module, a container data traffic module, an application data traffic module and a cloud data traffic module, and the traffic data access module is data-connected to the physical network data traffic module, the host data traffic module, the container data traffic module, the application data traffic module and the cloud data traffic module respectively.

[0007] Preferably, the data analysis and processing module includes a traffic convergence analysis module, an asset identification module, an asset monitoring module, a behavior analysis module, a source tracing investigation module and a sensitive data identification module; the sensitive data identification module includes a network attack identification module, a system attack identification module, an API attack identification module and an application attack identification module.

[0008] Preferably, the response display module includes an asset management module, a threat analysis module, an API security module, a sensitive data module, a source tracing analysis module, a response disposal module and a collaborative linkage module.

[0009] Preferably, the data analysis and processing module is respectively connected to the traffic convergence analysis module, the asset identification module, the asset monitoring module, the behavior analysis module, the source tracing investigation module and the sensitive data identification module, and the sensitive data identification module is respectively connected to the network attack identification module, the system attack identification module, the API attack identification module and the application attack identification module.

[0010] Preferably, the response display module is respectively connected to the asset management module, the threat analysis module, the API security module, the sensitive data module, the source tracing analysis module, the response disposal module and the collaborative linkage module.

[0011] Preferably, the flow data access module includes a storage box, a storage server is provided inside the storage box, a plurality of limiting holes are provided on both sides of the storage server, two side cavities are provided inside the storage box, a fixing component is provided inside the side cavity, the fixing component includes a connecting rod, the connecting rod is connected to the inner wall of the side cavity through a bearing, a cam is fixedly sleeved on the outside of the connecting rod, a fixing plate is provided on one side of the cam, the cam is in contact with the fixing plate, a plurality of plug rods are fixedly provided on one side of the fixing plate, the plug rods extend into the limiting holes, a spring is sleeved on the outside of the plug rods, a fixing shell is fixedly provided on one side of the storage box, a worm is connected to the inner wall of the fixing shell through a bearing, a worm wheel is fixedly connected to one end of the connecting rod, and the worm wheel is meshed with the worm wheel.

[0012] Preferably, a connecting shell is fixedly provided on both sides of the storage box, a threaded rod is connected to the inside of the connecting shell through a bearing, a knob is fixedly connected to one end of the threaded rod, a connecting frame is provided on the outside of the threaded rod through a threaded sleeve, and two movable wheels are connected to the bottom of the connecting frame through a bearing.

[0013] Preferably, a connector is fixedly provided on one side of the top of the storage box, a handle is movably connected to one side of the connector via a rotating shaft, and a baffle is provided on the other side of the top of the storage box.

[0014] A network intrusion detection and response method, the specific steps are as follows:

[0015] S1. The traffic data access module can capture various traffic data in real time and store them in a database or disk. The target traffic can be located by setting filtering rules, using network mirroring or port mirroring, etc. The traffic data access module can also support data import and export to facilitate data interaction and sharing with other systems.

[0016] S2. The captured data is parsed, filtered and aggregated through the data analysis and processing module, including functions such as traffic identification, traffic extraction, and traffic merging. It can parse network protocols at all levels, filter and group data based on indicators such as protocol, source IP, and target IP. It can also perform data preprocessing, anomaly detection, and data cleaning operations, and use different means to process data in different dimensions and convert them into usable data.

[0017] S3. Establish a detailed asset list through the response display module, including network devices such as servers, switches, firewalls, routers, storage devices, terminal devices, and other software and data such as application software, databases, and websites. The list needs to record the device information, usage, and relevant information such as the person in charge, to achieve unified collection and management of key host behavior data. Use this data to evaluate the harmful behavior of the intrusion alarm that has occurred, restore the intranet penetration path, capture the host's behavioral clues, achieve all-round control of the host's security situation, and respond to the intrusion behavior in a linked manner for timely defense.

[0018] The embodiments of the present invention have the following advantages:

[0019] 1. Alleviate security and operation and maintenance pressures, automatically identify assets contained in traffic, greatly improve the efficiency and accuracy of asset sorting, bring great convenience to asset management, comprehensively discover threat events, and take bypass blocking or linkage with other products to effectively prevent the spread of attack behaviors, so as to avoid adverse effects on the system. For different threat events, appropriate response measures can be taken to solve problems in a timely and effective manner, thereby effectively protecting the security of the network system. By real-time monitoring of API changes, exposed sensitive data can be identified at the first time, existing security issues can be discovered in a timely manner, and appropriate measures can be taken to deal with related issues in a timely manner to ensure data security;

[0020] 2. The cam is driven to rotate by the connecting rod, the cam pushes the fixed plate to move, the fixed plate pushes the plug rod to move, the spring outside the plug rod is compressed, and the plug rod is inserted into the limiting hole on the side of the storage server, thereby fixing the storage server, improving the protection performance of the storage server, and facilitating the replacement and use of the storage server. The control connection frame drives the moving wheel to move downward, and the moving wheel moves out of the connecting shell, so that the moving wheel supports the storage box. By pulling the handle, the handle is convenient for dragging the storage box to move, which is convenient for the transportation of the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0022] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0023] Figure 1 A schematic diagram of the overall system structure provided by the present invention;

[0024] Figure 2 A schematic diagram of the flow data access module system structure provided by the present invention;

[0025] Figure 3 A schematic diagram of the data analysis and processing module system structure provided by the present invention;

[0026] Figure 4 A schematic diagram of the structure of the response display module system provided by the present invention;

[0027] Figure 5 A front view of the storage box provided by the present invention;

[0028] Figure 6 A cross-sectional view of a connection shell provided by the present invention;

[0029] Figure 7 A front cross-sectional view of a storage box provided by the present invention;

[0030] Figure 8 A side cross-sectional view of a storage box provided by the present invention.

[0031] In the figure: 1. Intrusion detection response management platform module; 2. Traffic data access module; 3. Data analysis and processing module; 4. Response display module; 5. Physical network data traffic module; 6. Host data traffic module; 7. Container data traffic module; 8. Application data traffic module; 9. Cloud data traffic module; 10. Traffic aggregation analysis module; 11. Asset identification module; 12. Asset monitoring module; 13. Behavior analysis module; 14. Tracing investigation module; 15. Sensitive data identification module; 16. Network attack identification module; 17. System attack identification module; 18. API attack identification module; 1 9. Application attack identification module; 20. Asset management module; 21. Threat analysis module; 22. API security module; 23. Sensitive data module; 24. Tracing analysis module; 25. Response and disposal module; 26. Collaborative linkage module; 27. Storage box; 28. Connecting shell; 29. ​​Fixed shell; 30. Worm; 31. Connecting frame; 32. Moving wheel; 33. Baffle; 34. Knob; 35. Threaded rod; 36. Connector; 37. Handle; 38. Worm gear; 39. Connecting rod; 40. Side cavity; 41. Cam; 42. Fixed plate; 43. Insert rod; 44. Storage server; 45. Spring. DETAILED DESCRIPTION

[0032] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] See attached Figure 1 -Attached Figure 8 The present invention provides a network intrusion detection and response system, including an intrusion detection response management platform module 1, the intrusion detection response management platform module 1 includes a flow data access module 2, a data analysis and processing module 3 and a response display module 4, the output end of the flow data access module 2 is data-connected to the input end of the data analysis and processing module 3, and the output end of the data analysis and processing module 3 is data-connected to the input end of the response display module 4;

[0034] In this implementation scheme, the traffic data access module 2 is responsible for collecting various traffic flows and preprocessing them. The data analysis and processing module 3 uses different means to process the data in different dimensions and converts them into understandable and usable data for the cloud platform. The response display module 4 provides interface management capabilities.

[0035] Among them, in order to achieve the purpose of traffic data collection, the present device is implemented by the following technical scheme: the traffic data access module 2 includes a physical network data traffic module 5, a host data traffic module 6, a container data traffic module 7, an application data traffic module 8 and a cloud data traffic module 9, and the traffic data access module 2 is respectively connected to the physical network data traffic module 5, the host data traffic module 6, the container data traffic module 7, the application data traffic module 8 and the cloud data traffic module 9, and the data transmission volume in the computer network is collected through the physical network data traffic module 5. The physical network data traffic module 5 records and reflects the important carrier of the network and its user activities. Through statistical analysis of network traffic, the use of the network can be indirectly understood, thus providing a strong basis for decision-making. The abnormality of the host data traffic module 6 usually reflects whether the host has been invaded by viruses, Trojans and other malicious programs and has become a puppet machine in network attacks. The host data is collected through the host data traffic module 6, and the container data traffic module 7 continuously monitors and analyzes the process information and behaviors of various containers. It can deal with the massive data analysis and processing of a large number of tasks issued by customers and the advent of large-scale attacks, and always maintain stable performance. The application data traffic is collected through the application data traffic module 8, and the network cloud data traffic is collected through the cloud data traffic module 9;

[0036] Among them, in order to achieve the purpose of data processing, the present device is implemented by the following technical scheme: the data analysis and processing module 3 includes a traffic convergence analysis module 10, an asset identification module 11, an asset monitoring module 12, a behavior analysis module 13, a source tracing investigation module 14 and a sensitive data identification module 15, the sensitive data identification module 15 includes a network attack identification module 16, a system attack identification module 17, an API attack identification module 18 and an application attack identification module 19, the data analysis and processing module 3 is respectively connected with the traffic convergence analysis module 10, the asset identification module 11, the asset monitoring module 12, the behavior analysis module 13, the source tracing investigation module 14 and the sensitive data identification module 15, the sensitive data identification module 15 is respectively connected with the network attack identification module 16, the system attack identification module 17, the API attack identification module 18 and the application attack identification module 19, the traffic convergence analysis module 10 parses, filters and aggregates the captured data, including functions such as traffic identification, traffic extraction and traffic merging, and can perform data tracing on network protocols at all levels. It can parse the data and filter and group the data based on the protocol, source IP, target IP and other indicators. It can also perform data preprocessing, anomaly detection and data cleaning to ensure the accuracy and integrity of the data. Through the asset identification module 11, various data materials on the network, including source code, database data, system documents, operation management procedures, plans, reports, user manuals and other assets, are identified. The asset monitoring module 12 automatically monitors the consumption of assets and can also provide a powerful log function to provide a basis for use audits. Through the behavior analysis module 13, the network user behavior is analyzed, the page dwell time information, click hot spots and browsing path behavior are analyzed. Through the traceability investigation module 14, the logs, network traffic data and malicious codes left by the intruder are collected. By analyzing these evidences, the intruder's attack methods and behavior trajectories can be understood. It is necessary to analyze the attack path, including tracking the source P address of the attack, the tools and techniques used by the intruder, etc. The sensitive data identification module 15 identifies sensitive data and determines the attack location of the network intrusion.

[0037] Among them, in order to achieve the purpose of response, the present device is implemented by the following technical scheme: the response display module 4 includes an asset management module 20, a threat analysis module 21, an API security module 22, a sensitive data module 23, a traceability analysis module 24, a response disposal module 25 and a collaborative linkage module 26. The response display module 4 is respectively connected with the asset management module 20, the threat analysis module 21, the API security module 22, the sensitive data module 23, the traceability analysis module 24, the response disposal module 25 and the collaborative linkage module 26. The asset management module 20 establishes a detailed asset list, including network devices such as servers, switches, firewalls, routers, storage devices, terminal devices, and other software and data such as application software, databases, websites, etc. The list needs to record the information of the equipment, usage, and relevant information such as the person in charge for daily management and monitoring. The threat analysis module 21 realizes the unified collection and management of the key behavior data of the host, and uses these data to evaluate the harmful behavior of the intrusion alarm that has occurred, restore the intranet penetration path, capture the host's behavior clues, and achieve Comprehensively control the host's security situation. The traffic data access module 2 performs identity authentication, access control, data encryption, log monitoring and vulnerability scanning. The sensitive data module 23 customizes sensitive data rules, identifies sensitive data in the traffic, and discovers behaviors that steal sensitive data. The source tracing analysis module 24 analyzes the attack path to preliminarily determine the intruder's geographical location and attack methods, collects, analyzes and protects electronic evidence such as hard disks, memory, and network traffic. Through digital forensics, more evidence can be obtained to further reveal the intruder's behavior and motives. The response and disposal module 25 sets specific ports to remain open and only allows access to specific IP addresses, providing a means for host emergency response to disconnect the network connection in a timely manner with one click. The collaborative linkage module 26 redefines the threat analysis function from the perspective of operational processes, allowing scattered alarms and logs to be aggregated into events and restore the complete attack process. The network connection, network trend and process connection of key assets can be analyzed and displayed in a graphical form, which can clearly and intuitively evaluate the health status of assets and discover potential threats early.

[0038] Among them, in order to achieve the purpose of fixation, the present device is implemented by the following technical solutions: the flow data access module 2 includes a storage box 27, a storage server 44 is arranged inside the storage box 27, a plurality of limit holes are opened on both sides of the storage server 44, two side cavities 40 are opened inside the storage box 27, a fixing component is arranged inside the side cavity 40, and the fixing component includes a connecting rod 39, the connecting rod 39 is connected to the inner wall of the side cavity 40 through a bearing, a cam 41 is fixedly sleeved on the outside of the connecting rod 39, a fixing plate 42 is arranged on one side of the cam 41, the cam 41 is in contact with the fixing plate 42, a plurality of plug rods 43 are fixedly arranged on one side of the fixing plate 42, and the plug rods 43 extend into the limit The outer sleeve of the plug rod 43 is provided with a spring 45, and a fixed shell 29 is fixedly provided on one side of the storage box 27. The inner wall of the fixed shell 29 is connected to a worm 30 through a bearing. One end of the connecting rod 39 is fixedly connected to a worm wheel 38. The worm 30 is meshed with the worm wheel 38. The storage server 44 is pushed into the storage box 27, and then the worm 30 is rotated. The worm 30 drives the worm wheel 38 to rotate, and the worm wheel 38 drives the connecting rod 39 to rotate. The connecting rod 39 drives the cam 41 to rotate, and the cam 41 pushes the fixed plate 42 to move. The fixed plate 42 pushes the plug rod 43 to move, and the spring 45 outside the plug rod 43 is compressed. The plug rod 43 is inserted into the limiting hole on the side of the storage server 44, thereby fixing the storage server 44;

[0039] Among them, in order to achieve the purpose of transportation, the present device adopts the following technical solutions: both sides of the storage box 27 are fixedly provided with a connecting shell 28, the inside of the connecting shell 28 is connected with a threaded rod 35 through a bearing, one end of the threaded rod 35 is fixedly connected with a knob 34, the outside of the threaded rod 35 is provided with a connecting frame 31 through a threaded sleeve, and the bottom of the connecting frame 31 is connected with two moving wheels 32 through a bearing, and the knob 34 is turned, and the knob 34 drives the threaded rod 35 to rotate, and the threaded rod 35 drives the connecting frame 31 to move downward, and the connecting frame 31 drives the moving wheel 32 to move downward, and the moving wheel 32 moves out of the connecting shell 28, so that the moving wheel 32 supports the storage box 27;

[0040] Among them, in order to achieve the purpose of convenient pulling, the present device is implemented by adopting the following technical solutions: a connector 36 is fixedly provided on one side of the top of the storage box 27, and a handle 37 is movably connected to one side of the connector 36 through a rotating shaft, and a baffle 33 is provided on the other side of the top of the storage box 27. When the baffle 33 is pushed downward, the baffle 33 blocks the opening on one side of the storage box 27, thereby protecting the storage server 44. By pulling the handle 37, the handle 37 facilitates the dragging of the storage box 27.

[0041] A network intrusion detection and response method, the specific steps are as follows:

[0042] S1, through the flow data access module 2, various flow data are captured in real time and stored in the database or disk. The target flow can be located by setting filtering rules, using network mirroring or port mirroring, etc. At the same time, the flow data access module 2 can also support data import and export, so as to interact and share data with other systems;

[0043] S2. The captured data is parsed, filtered and aggregated through the data analysis and processing module 3, including functions such as traffic identification, traffic extraction, and traffic merging. It can parse network protocols at all levels, filter and group data based on indicators such as protocols, source IP, and target IP. It can also perform data preprocessing, anomaly detection, and data cleaning operations, and use different means to process data in different dimensions and convert them into usable data.

[0044] S3. Establish a detailed asset list through the response display module 4, including network devices such as servers, switches, firewalls, routers, storage devices, terminal devices, and other software and data such as application software, databases, websites, etc. The list needs to record the information of the equipment, usage, and relevant information such as the person in charge, to achieve unified collection and management of key behavioral data of the host, and use these data to evaluate the harmful behavior of the intrusion alarm that has occurred, restore the intranet penetration path, capture the host's behavioral clues, achieve all-round control of the host's security situation, and respond to the intrusion behavior in a linked manner to prevent it in time.

[0045] The use process of the present invention is as follows: when using the present invention, the storage server 44 is pushed into the storage box 27, and then the worm 30 is rotated, the worm 30 drives the worm wheel 38 to rotate, the worm wheel 38 drives the connecting rod 39 to rotate, the connecting rod 39 drives the cam 41 to rotate, the cam 41 pushes the fixed plate 42 to move, the fixed plate 42 pushes the insertion rod 43 to move, the spring 45 outside the insertion rod 43 is compressed, and the insertion rod 43 is inserted into the limiting hole on the side of the storage server 44, thereby fixing the storage server 44, and then the baffle 33 is pushed downward, the baffle 33 blocks the opening on one side of the storage box 27, thereby protecting the storage server 44, when the storage box 27 needs to be transported, the knob 34 is turned, the knob 34 drives the threaded rod 35 to rotate, the threaded rod 35 drives the connecting frame 31 to move downward, the connecting frame 31 drives the moving wheel 32 to move downward, the moving wheel 32 moves out of the connecting shell 28, so that the moving wheel 32 supports the storage box 27, and by pulling the handle 37, the handle 37 facilitates the towing of the storage box 27.

[0046] The above is only a preferred embodiment of the present invention. Any person skilled in the art may modify the present invention by using the above technical solution or modify it into an equivalent technical solution. Therefore, any simple modification or equivalent replacement made according to the technical solution of the present invention shall fall within the scope of protection claimed by the present invention.

Claims

1. A network intrusion detection and response system, comprising an intrusion detection response management platform module (1), characterized in that: The intrusion detection response management platform module (1) comprises a flow data access module (2), a data analysis and processing module (3) and a response display module (4); the output end of the flow data access module (2) is data-connected to the input end of the data analysis and processing module (3); and the output end of the data analysis and processing module (3) is data-connected to the input end of the response display module (4).

2. A network intrusion detection and response system according to claim 1, characterized in that: The flow data access module (2) comprises a physical network data flow module (5), a host data flow module (6), a container data flow module (7), an application data flow module (8) and a cloud data flow module (9), and the flow data access module (2) is respectively data-connected to the physical network data flow module (5), the host data flow module (6), the container data flow module (7), the application data flow module (8) and the cloud data flow module (9).

3. A network intrusion detection and response system according to claim 1, characterized in that: The data analysis and processing module (3) comprises a traffic convergence analysis module (10), an asset identification module (11), an asset monitoring module (12), a behavior analysis module (13), a source tracing investigation module (14) and a sensitive data identification module (15), wherein the sensitive data identification module (15) comprises a network attack identification module (16), a system attack identification module (17), an API attack identification module (18) and an application attack identification module (19).

4. A network intrusion detection and response system according to claim 1, characterized in that: The response display module (4) includes an asset management module (20), a threat analysis module (21), an API security module (22), a sensitive data module (23), a source tracing analysis module (24), a response handling module (25) and a collaborative linkage module (26).

5. A network intrusion detection and response system according to claim 3, characterized in that: The data analysis and processing module (3) is respectively connected to the traffic convergence analysis module (10), the asset identification module (11), the asset monitoring module (12), the behavior analysis module (13), the source tracing investigation module (14) and the sensitive data identification module (15), and the sensitive data identification module (15) is respectively connected to the network attack identification module (16), the system attack identification module (17), the API attack identification module (18) and the application attack identification module (19).

6. A network intrusion detection and response system according to claim 4, characterized in that: The response display module (4) is respectively connected to the asset management module (20), the threat analysis module (21), the API security module (22), the sensitive data module (23), the source tracing analysis module (24), the response disposal module (25) and the collaborative linkage module (26).

7. A network intrusion detection and response system according to claim 1, characterized in that: The flow data access module (2) comprises a storage box (27), a storage server (44) is arranged inside the storage box (27), a plurality of limit holes are provided on both sides of the storage server (44), two side chambers (40) are provided inside the storage box (27), a fixing assembly is arranged inside the side chamber (40), the fixing assembly comprises a connecting rod (39), the connecting rod (39) is connected to the inner wall of the side chamber (40) through a bearing, a cam (41) is provided on the outer fixed sleeve of the connecting rod (39), and the cam (41) A fixed plate (42) is provided on one side, the cam (41) is in contact with the fixed plate (42), a plurality of insertion rods (43) are fixedly provided on one side of the fixed plate (42), the insertion rods (43) extend into the limiting holes, a spring (45) is sleeved on the outside of the insertion rods (43), a fixed shell (29) is fixedly provided on one side of the storage box (27), a worm (30) is connected to the inner wall of the fixed shell (29) through a bearing, one end of the connecting rod (39) is fixedly connected to a worm wheel (38), and the worm (30) is meshed with the worm wheel (38).

8. A network intrusion detection and response system according to claim 7, characterized in that: A connecting shell (28) is fixedly provided on both sides of the storage box (27); a threaded rod (35) is connected inside the connecting shell (28) via a bearing; a knob (34) is fixedly connected to one end of the threaded rod (35); a connecting frame (31) is provided outside the threaded rod (35) via a threaded sleeve; and two moving wheels (32) are connected at the bottom of the connecting frame (31) via a bearing.

9. A network intrusion detection and response system according to claim 8, characterized in that: A connector (36) is fixedly provided on one side of the top of the storage box (27), a handle (37) is movably connected to one side of the connector (36) via a rotating shaft, and a baffle (33) is provided on the other side of the top of the storage box (27).

10. A network intrusion detection and response method, based on a network intrusion detection and response system as described in any one of claims 1 to 9 above, characterized in that: The specific steps are as follows: S1, various traffic data are captured in real time through the traffic data access module (2) and stored in a database or disk. The target traffic can be located by setting filtering rules, using network mirroring or port mirroring, etc., and the traffic data access module (2) can also support data import and export, so as to interact and share data with other systems; S2. The captured data is parsed, filtered and aggregated through the data analysis and processing module (3), including functions such as traffic identification, traffic extraction, and traffic merging. It can parse network protocols at all levels, filter and group data based on indicators such as protocol, source IP, and target IP, and can also perform data preprocessing, anomaly detection, and data cleaning operations. It uses different means to process data in different dimensions and convert them into usable data. S3. Establish a detailed asset list through the response display module (4), including network devices such as servers, switches, firewalls, routers, storage devices, terminal devices, and other software and data such as application software, databases, websites, etc. The list needs to record the information of the equipment, usage, and relevant information such as the person in charge, so as to achieve unified collection and management of key behavioral data of the host. Use this data to evaluate the harmful behavior of the intrusion alarm that has occurred, restore the intranet penetration path, capture the host's behavioral clues, achieve all-round control of the host's security situation, and respond to the intrusion behavior in a linked manner to prevent it in time.

Images