Large-scale network security defense system based on collaborative intrusion detection

Abstract

The invention discloses a large-scale network security defense system based on collaborative intrusion detection, and belongs to the field of network security intrusion detection.The large-scale network security defense system comprises the steps that firstly, an intrusion unit node detection module preliminarily conducts intrusion detection by monitoring feature data of network equipment, and an intrusion detection analysis instruction is sent to a collaborative analysis module; the collaborative analysis module receives an intrusion detection analysis instruction, collaboratively analyzes network security audit log data, screens intrusion detection results and matches a defense strategy, and finally, the management control module filters and blocks network traffic according to the defense strategy. Through the large-scale network security defense mode of collaborative intrusion detection, data and resources of a plurality of nodes are fully utilized, distributed intrusion detection and defense are realized, intrusion behaviors can be detected and blocked more quickly, the influence of network security events is reduced, potential security threats can be quickly responded, and the security risk of the network is reduced. And the network security is effectively protected.

Description

Technical Field

[0001] The present invention relates to the field of network security intrusion detection, and specifically to a large-scale network security defense system based on collaborative intrusion detection. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly severe. Malicious attackers exploit loopholes and weaknesses to invade, threatening the network assets and data of individuals, enterprises and countries. Traditional network security defense systems usually use a centralized approach to intrusion detection and defense, but in a large-scale network environment, there are certain limitations when dealing with ever-changing threats, and single point failures and performance bottlenecks are prone to occur, which cannot effectively guarantee large-scale network security; therefore, the present invention proposes a large-scale network security defense system based on collaborative intrusion detection to solve the above problems.

[0003] Prior art, such as the invention patent application with publication number: CN111865974A, discloses a network security defense system and method. This solution includes: a network intrusion detection and defense unit, a network login verification unit, a network traffic monitoring unit, a controller, a traffic management server and a network status monitoring server. The controller is data-connected to the network intrusion detection and defense unit, the network login verification unit, the network traffic monitoring unit, the traffic management server and the network status monitoring server respectively; the defense system adopted by the present invention can realize real-time monitoring of network viruses, network traffic, network operation status and user identity, multi-faceted defense, and improve the defense effect.

[0004] Prior art, such as the invention patent application with publication number: CN1668015A, discloses a large-scale network security defense system based on collaborative intrusion detection. Among them, the parallel firewall subsystem adopts advanced parallel technology and a unique trust-based model to effectively resist DDoS attacks; the parallel IDS subsystem adopts a combination of parallel technology and popular state detection technology; the traffic detection subsystem is based on an artificial neural network model, has a high degree of recognition ability for irregular data, can detect known attacks and discover new attack behaviors. The parallel firewall subsystem, parallel IDS subsystem, traffic detection subsystem, and correlation analysis and alarm clustering subsystem are functionally independent and complete. They use a message-driven mechanism to exchange detection information and transmit detection and defense rules through the internal interface, so as to achieve collaborative response and mutual complementation. Each subsystem is uniformly managed through the console management subsystem to form a triple-granularity parallel collaborative response system, thereby effectively preventing collaborative intrusion.

[0005] Combined with the above solutions, it is found that in the current large-scale network security defense of intrusion detection, there is rarely any analysis of important influencing factors of each node in the network equipment, such as log data, traffic data, behavior data, etc., which may lead to misjudgment or omission of security threats, and thus fail to effectively respond to potential security risks. It may also lead to difficulties in tracing the source of security incidents, making it difficult to track and analyze the origin and propagation path of security incidents, thereby affecting the timely handling of security threats, and may not be able to effectively protect large-scale network security. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a large-scale network security defense system based on collaborative intrusion detection, which can effectively solve the problems involved in the above-mentioned background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a large-scale network security defense system based on collaborative intrusion detection, including an intrusion unit node detection module, which is used to monitor and analyze the characteristic data of network equipment, and each node collaborates to perform preliminary intrusion detection and send intrusion detection analysis instructions at the same time.

[0008] The collaborative analysis module is used to receive intrusion detection analysis instructions, collaboratively collect and analyze network security audit log data, and screen intrusion detection results to match defense strategies.

[0009] The management control defense module is used to filter and block network traffic according to defense strategies.

[0010] Furthermore, the monitoring and analysis of characteristic data of network equipment, and each node cooperates in intrusion detection. The specific process is: setting a monitoring cycle, and traversing the log data in each node of the network device, counting the access IPs in each node of the network device during the monitoring cycle, counting the number of visits of each access IP and the duration of the monitoring cycle, and calculating the access frequency of each access IP in each node of the network device.

[0011] The defined access frequencies stored in the cloud database are extracted and processed to obtain the access intrusion assessment values ​​of each node of the network device.

[0012] The usage traffic and the size of the data packets sent by each access IP in each node of the network device during the monitoring period are collected, and the defined usage traffic and reference sending data packet size stored in the cloud database are extracted. After processing, the traffic intrusion assessment value of each node of the network device is obtained.

[0013] The number of system errors, service crashes and total IP connections in each node of the network device during the monitoring period are collected, and the defined number of system errors, single service crash impact factors and defined number of connections stored in the cloud database are extracted. After processing, the behavioral intrusion assessment value of each node of the network device is obtained.

[0014] The access frequency, usage traffic, size of sent data packets, number of system errors, number of service crashes and total number of IP connections of each access IP are combined as characteristic data of each node of the network device.

[0015] Based on the access intrusion assessment value, traffic intrusion assessment value and behavior intrusion assessment value of each node of the network device, the preliminary intrusion assessment value of each node of the network device is comprehensively calculated.

[0016] Furthermore, the preliminary intrusion assessment value of each node of the network device is specifically a preliminary quantitative result for evaluating the degree of intrusion detection obtained by numerically quantifying and analyzing the characteristic data of each node of the network device, which is used as a numerical basis for executing and sending an intrusion detection analysis instruction.

[0017] Furthermore, the specific process of sending the intrusion detection and analysis instruction is: comparing the preliminary intrusion assessment value of each node of the network device with the set intrusion assessment threshold to obtain the intrusion detection and analysis instruction sending judgment result, the intrusion detection and analysis instruction sending judgment result is a sending instruction or a non-sending instruction, wherein if the preliminary intrusion assessment value of a node of the network device is higher than or equal to the intrusion assessment threshold, the intrusion detection and analysis instruction sending judgment result is defined as a sending instruction, and the node is marked as an abnormal node, if the preliminary intrusion assessment value of each node of the network device is lower than the intrusion assessment threshold, the intrusion detection and analysis instruction sending judgment result is defined as a non-sending instruction, thereby controlling the execution of sending the intrusion detection and analysis instruction.

[0018] Furthermore, the collaborative collection and analysis of network security audit log data has the following specific analysis process: counting the abnormal nodes of the network equipment and collaboratively collecting the security audit log data of the network equipment, including the number of network configuration changes in each abnormal node, the number of abnormal file accesses and the average IP access connection duration.

[0019] The number of changes to the defined network configuration, the abnormal factor of a single abnormal file access, and the average access connection duration of the defined IP stored in the cloud database are extracted to calculate the intrusion characterization value of the network device.

[0020] Furthermore, the intrusion characterization value of the network device is specifically obtained by numerically quantifying and analyzing the network security audit log data of each abnormal node of the network device to obtain a quantitative result for further evaluating the intrusion detection degree of the network device, so as to serve as an analysis basis for the intrusion detection result.

[0021] Furthermore, the specific process of screening the intrusion detection results and matching the defense strategy is as follows: based on the preliminary intrusion assessment value of each abnormal node of the network device and the intrusion characterization value of the network device, comprehensively calculating the intrusion measurement index of the network device.

[0022] The intrusion measurement index of the network device is compared with the set intrusion index threshold to obtain the intrusion detection result. The intrusion detection result is either invaded or not invaded. If the intrusion measurement index of the network device is higher than or equal to the intrusion assessment threshold, the intrusion detection result is defined as invaded, and matched with the matching defense strategy corresponding to each intrusion measurement index threshold interval stored in the cloud database to obtain the defense strategy of the intrusion detection result. If the intrusion measurement index of the network device is lower than the intrusion index threshold, the intrusion detection result is defined as not invaded.

[0023] Furthermore, the intrusion measurement index of the network device is specifically obtained by numerically quantifying and analyzing the characteristic data of each node of the network device and the network security audit log data to obtain a quantitative result for the final evaluation of the degree of intrusion detection results, so as to serve as an analysis basis for the defense strategy.

[0024] Furthermore, the calculation formula for the preliminary intrusion assessment value of each node of the network device is: ; In the formula, is the preliminary intrusion assessment value of the i-th node of the network device, is the access intrusion assessment value of the i-th node of the network device, is the traffic intrusion assessment value of the i-th node of the network device, is the behavioral intrusion assessment value of the i-th node of the network device, is the weight factor corresponding to the set access intrusion assessment value, is the weight factor corresponding to the set traffic intrusion assessment value, is the weight factor corresponding to the set behavior intrusion assessment value, e represents a natural constant, i is the number of each node of the network device, , n represents the number of nodes.

[0025] Furthermore, the intrusion measurement index of the network device is calculated by: according to the preliminary intrusion assessment value of each node of the network device, the preliminary intrusion assessment value of each abnormal node of the network device is counted; ; In the formula, Indicates the intrusion measurement index of network devices. is the initial intrusion assessment value of the jth abnormal node of the network device, is the intrusion characterization value of the network device, j is the number of each abnormal node of the network device, , m represents the number of abnormal nodes, .

[0026] The present invention has the following beneficial effects: (1) The present invention provides a large-scale network security defense system based on collaborative intrusion detection. First, the intrusion unit node detection module performs preliminary intrusion detection by monitoring the characteristic data of the network device, and sends an intrusion detection analysis instruction to the collaborative analysis module. Secondly, the collaborative analysis module receives the intrusion detection analysis instruction, collaboratively analyzes the network security audit log data, screens the intrusion detection results and matches the defense strategy. Finally, the management control module filters and blocks the network traffic according to the defense strategy. Through this large-scale network security defense method based on collaborative intrusion detection, the data and resources of multiple nodes are fully utilized, and distributed intrusion detection and defense are realized. It can detect and block intrusion behaviors more quickly, reduce the impact of network security incidents, and quickly respond to potential security threats, effectively protecting network security.

[0027] (2) The present invention sets a monitoring cycle first, arranges a sliding window to traverse the log data, counts the number of visits of each access IP and the duration of the monitoring cycle, and calculates the access frequency, thereby obtaining the access intrusion assessment value of each node of the network device; then, based on the usage traffic, data packet size and other data of each IP, a preliminary intrusion assessment value of each node is obtained by comprehensive calculation. By comprehensively and multi-dimensionally analyzing the characteristic data and behavior of the network device, comprehensive monitoring and evaluation of the intrusion behavior is achieved, and potential security threats can be discovered and responded to in a timely manner, thereby improving the effectiveness and reliability of network security defense.

[0028] (3) By analyzing and comparing the number of network configuration changes, the number of abnormal file accesses, and the average IP access connection duration in each abnormal node, the present invention can more comprehensively evaluate the security status of network devices, discover abnormal behaviors and respond quickly, which helps to improve overall network security and defense capabilities.

[0029] (4) The present invention obtains the intrusion measurement index of the network device by comprehensively evaluating the quantitative result of the intrusion detection result, which is used as the analysis basis of the defense strategy and finally determines the intrusion detection result. By comprehensively evaluating the intrusion index of each node, it is possible to more accurately judge whether the network device has been invaded and adopt corresponding defense strategies, thereby further improving the effect and response capability of network security defense.

[0030] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of system module connection of the present invention.

[0032] Figure 2 It is a structural schematic diagram of the management console of the present invention. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] In the description of the present invention, it should be understood that the terms "opening", "upper", "lower", "thickness", "top", "middle", "length", "inside", "all around" and the like indicating orientation or positional relationship are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the components or elements referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0035] See also Figure 1 As shown, an embodiment of the present invention provides a technical solution: a large-scale network security defense system based on collaborative intrusion detection, including an intrusion unit node detection module, which is used to monitor and analyze the characteristic data of network equipment, and each node collaborates to perform preliminary intrusion detection and sends intrusion detection analysis instructions at the same time.

[0036] The collaborative analysis module is used to receive intrusion detection analysis instructions, collaboratively collect and analyze network security audit log data, and screen intrusion detection results to match defense strategies.

[0037] The management control defense module is used to filter and block network traffic according to defense strategies.

[0038] It should be noted that a large-scale network security defense system based on collaborative intrusion detection also includes a user interface, a management console, a communication module, and a data sharing and synchronization mechanism unit.

[0039] See also Figure 2 As shown, the management console includes a user interface, an authentication and access control module, a system status and monitoring module, a configuration management module, a log and audit module, and a report and alarm module.

[0040] The intrusion detection node unit also includes transmitting the detection results to other nodes for collaborative analysis. Each node can independently perform intrusion detection and clean, transform and process these data to prepare for subsequent intrusion detection.

[0041] The collaborative analysis engine also includes a data collector, a data preprocessing module, a feature extraction module, an analysis algorithm module, a collaborative decision-making module, and a visualization and reporting module. The collaborative analysis engine is also used to receive intrusion detection results from various intrusion detection node units and perform collaborative analysis. By comparing the detection results of different nodes, the actual intrusion behavior is identified and the corresponding defense strategy is generated.

[0042] The defense node unit includes a firewall, an intrusion prevention system (IDS), a virtual private network (VPN), a security audit and log management module, a security policy and rule management module, and a network monitoring and alarm system. The defense node unit is used to filter and block network traffic according to the defense strategy generated by the collaborative analysis engine to prevent the further spread of intrusion behavior; the defense node unit can also be dynamically adjusted as needed to adapt to different network environments and intrusion threats.

[0043] The management console includes a user interface, an authentication and access control module, a system status and monitoring module, a configuration management module, a log and audit module, and a report and alarm module; the management console is used to monitor and manage the entire system in real time, view the status and performance indicators of each node through the console, perform system configuration and policy management operations, generate real-time reports and alarms, provide intrusion details and recommended defense measures, and help administrators make decisions in a timely manner.

[0044] The data sharing and synchronization mechanism unit includes a data storage module, a data access interface, a data synchronization algorithm module, a data replication and distribution module, a data authority and security module, and a data consistency detection and repair module; the data sharing and synchronization mechanism unit is used to complete collaborative analysis between nodes, and uses distributed databases or message queues and other technologies to achieve data sharing and synchronization between nodes to ensure the accuracy and real-time nature of collaborative analysis.

[0045] The intrusion detection node unit also includes a network monitor, which is responsible for collecting and monitoring network traffic data. The network traffic data can be obtained through network packet capture technology or the logging function of network equipment, and transmitted to the intrusion detection engine for analysis; the intrusion detection engine, which is the core component of the intrusion detection node, is responsible for analyzing and detecting the collected network traffic data to identify potential intrusion behaviors. The intrusion detection engine can use a variety of technologies, such as rule-based detection, abnormal behavior-based detection, machine learning, etc., to identify different types of intrusion behaviors.

[0046] Specifically, the characteristic data of network equipment is monitored and analyzed, and each node cooperates to perform intrusion detection. The specific process is: set a monitoring cycle, and traverse the log data in each node of the network device, count the access IPs in each node of the network device during the monitoring cycle, count the number of visits of each access IP and the duration of the monitoring cycle, and calculate the access frequency of each access IP in each node of the network device.

[0047] It should be noted that the access frequency of each access IP in each node of the network device indicates the number of times each IP address in each node of the network device accesses the system or service within a certain period of time. The network analysis tool can be used to capture and analyze network traffic and obtain the access frequency of each access IP. The data of each access IP and access time in each node of the network device can also be analyzed and processed. The calculation formula is: ; In the formula, is the access frequency of the cth access IP of the ith node of the network device, Indicates the number of visits to the cth access IP of the ith node of the network device, Indicates the duration of the monitoring cycle, i is the number of each node of the network device, , n represents the number of nodes, c is the number of each access IP, , b represents the number of access IPs.

[0048] The defined access frequencies stored in the cloud database are extracted and processed to obtain the access intrusion assessment values ​​of each node of the network device.

[0049] It should be noted that the access intrusion assessment value of each node of the network device represents the quantitative result obtained by analyzing the access IP and access time of each node of the network device, which is used to analyze the access intrusion degree of each node of the network device, and serves as the analysis basis for the intrusion assessment of each node of the network device. The access intrusion assessment value can be obtained not only through the analysis of the historical preparation operation data evaluation platform, but also through a more accurate calculation method. The specific calculation method is as follows: ; In the formula, is the access intrusion assessment value of the i-th node of the network device, Indicates the access frequency of the cth access IP of the ith node of the network device, Indicates the defined access frequency. Indicates the correction factor corresponding to the set access frequency.

[0050] The usage traffic and the size of the data packets sent by each access IP in each node of the network device during the monitoring period are collected, and the defined usage traffic and reference sending data packet size stored in the cloud database are extracted. After processing, the traffic intrusion assessment value of each node of the network device is obtained.

[0051] It should be noted that the traffic intrusion assessment value of each node of the network device represents the quantitative result obtained by analyzing the traffic usage of each access IP and the size of the data packet sent in each node of the network device, which is used to analyze the degree of traffic intrusion of each node of the network device, and serves as the analysis basis for the intrusion assessment of each node of the network device. The traffic intrusion assessment value of each node of the network device can be obtained not only by analyzing the pattern and characteristics of the traffic, identifying abnormal or malicious traffic behavior and abnormal data traffic pattern, frequency, and protocol usage, but also by a more accurate calculation method. The specific calculation method is as follows: ; In the formula, is the traffic intrusion assessment value of the i-th node of the network device, Indicates the usage flow of the cth access IP of the ith node of the network device, Indicates the size of the data packet sent by the cth access IP of the ith node of the network device. Indicates the defined usage flow, Indicates the size of the data packet sent. Indicates the correction factor corresponding to the set usage flow rate. Indicates the correction factor corresponding to the set data packet size.

[0052] The number of system errors, service crashes and total IP connections in each node of the network device during the monitoring period are collected, and the defined number of system errors, single service crash impact factors and defined number of connections stored in the cloud database are extracted. After processing, the behavioral intrusion assessment value of each node of the network device is obtained.

[0053] It should be noted that the behavior intrusion assessment value of each node of the network device represents the quantitative result obtained by analyzing the number of system errors, service crashes and connections in each node of the network device, which is used to analyze the degree of intrusion of each node of the entire network device, and serves as the analysis basis for the intrusion assessment of each node of the network device. The traffic intrusion assessment value of each node of the network device can not only be determined by using machine learning, deep learning and other technologies to establish an abnormal traffic detection model to detect abnormal behaviors that are inconsistent with normal behaviors, thereby determining the behavior intrusion assessment value, but also by its calculation formula: ; In the formula, is the behavioral intrusion assessment value of the i-th node of the network device, Indicates the number of system errors of the i-th node of the network device, Indicates the number of service crashes of the i-th node of the network device, Indicates the number of connections of the ith node of the network device, Indicates the number of defined system errors. Indicates the number of connections defined. Indicates the correction factor corresponding to the set number of system errors. Represents the impact factor of a single service crash, Indicates the correction factor corresponding to the set number of connections.

[0054] The access frequency, usage traffic, size of sent data packets, number of system errors, number of service crashes and total number of IP connections of each access IP are combined as characteristic data of each node of the network device.

[0055] Based on the access intrusion assessment value, traffic intrusion assessment value and behavior intrusion assessment value of each node of the network device, the preliminary intrusion assessment value of each node of the network device is comprehensively calculated.

[0056] In this implementation scheme, the intrusion index of the network device is obtained. The intrusion index is obtained by numerically quantifying and analyzing the characteristic data of each node of the network device and the network security audit log data. It is a quantitative indicator used to finally evaluate the intrusion result and becomes the analysis basis of the defense strategy. Subsequently, the intrusion index of the network device is compared with the set intrusion index threshold to obtain the intrusion result. If the intrusion index is higher than or equal to the intrusion assessment threshold, the intrusion result is defined as an invasion, and the defense strategy corresponding to the intrusion index threshold interval stored in the corresponding cloud database is matched. If the intrusion index of the network device is lower than the intrusion index threshold, the intrusion result is defined as non-intrusion. This large-scale network security defense method based on collaborative intrusion detection can quickly and accurately judge the degree of intrusion through numerical analysis and dynamic adjustment of the intrusion threshold, and then adopt corresponding defense strategies, which helps to improve the overall network security and defense effectiveness.

[0057] Specifically, the preliminary intrusion assessment value of each node of the network device is obtained by numerically quantifying and analyzing the characteristic data of each node of the network device to obtain a preliminary quantitative result for evaluating the degree of intrusion detection, which serves as a numerical basis for executing and sending an intrusion detection analysis instruction.

[0058] Specifically, an intrusion detection and analysis instruction is sent, and the specific process is: comparing the preliminary intrusion assessment value of each node of the network device with the set intrusion assessment threshold to obtain the intrusion detection and analysis instruction sending judgment result, the intrusion detection and analysis instruction sending judgment result is a sending instruction or a non-sending instruction, wherein if the preliminary intrusion assessment value of a node of the network device is higher than or equal to the intrusion assessment threshold, the intrusion detection and analysis instruction sending judgment result is defined as a sending instruction, and the node is marked as an abnormal node, if the preliminary intrusion assessment value of each node of the network device is lower than the intrusion assessment threshold, the intrusion detection and analysis instruction sending judgment result is defined as a non-sending instruction, thereby controlling the execution of sending the intrusion detection and analysis instruction.

[0059] In this implementation, intrusion detection and analysis instructions can be sent in a targeted manner according to the intrusion situation of the node, thereby effectively controlling the use of system resources, improving the efficiency and accuracy of network security defense, reducing the false alarm rate, and helping to promptly discover and respond to potential security threats.

[0060] It should also be noted that the intrusion detection and analysis instructions include alarm notifications, blocking IP addresses that trigger abnormal behavior, closing ports with abnormal access, updating firewall rules, etc.

[0061] Specifically, collaboratively collect and analyze network security audit log data. The specific analysis process is: count the abnormal nodes of network devices, and collaboratively collect security audit log data of network devices, including the number of network configuration changes in each abnormal node, the number of abnormal file accesses, and the average IP access connection duration.

[0062] It should also be noted that the number of network configuration changes refers to the number of configuration changes made on network devices, including configuration modifications to network devices such as routers, switches, and firewalls, such as modifying routing tables, changing access control lists, and updating firewall rules.

[0063] It should also be noted that the number of abnormal file accesses refers to the number of abnormal file accesses that occurred on network devices. Abnormal file accesses may include unauthorized file accesses, access to deleted files, access to system critical files, and other abnormal behaviors.

[0064] It should also be noted that the average IP access connection duration refers to the average connection duration of each IP address accessing the network device. This indicator can be used to measure the persistence and frequency of the access behavior of each IP address. Connections with longer durations may indicate normal user behavior, while connections with shorter durations may be more likely to arouse suspicion and may involve attacks or malicious behavior.

[0065] The number of changes to the defined network configuration, the abnormal factor of a single abnormal file access, and the average access connection duration of the defined IP stored in the cloud database are extracted to calculate the intrusion characterization value of the network device.

[0066] It should be noted that the intrusion characterization value of the network device represents the quantitative result obtained by analyzing the node intrusion degree of each abnormal node of the entire network device through data analysis and processing of the number of network configuration changes, the number of abnormal file accesses, and the average IP access connection duration corresponding to each abnormal node of the network device, and serves as the analysis basis for the intrusion assessment of each abnormal node of the network device. The intrusion characterization value of the network device can be obtained not only through the analysis of the historical preparation and operation data evaluation platform, but also through a more accurate calculation method. The specific calculation method is as follows: ; In the formula, is the intrusion characterization value of the network device, Indicates the number of changes in the network configuration of the cth access IP in the jth abnormal node of the network device, Indicates the number of abnormal file accesses of the cth access IP in the jth abnormal node of the network device, represents the average access connection duration of the cth access IP in the jth abnormal node of the network device, Indicates the number of changes to define the network configuration. It indicates the average duration of IP access connection. Indicates the correction factor corresponding to the number of changes to the set network configuration. Indicates the abnormal factor of a single abnormal file access, Indicates the correction factor corresponding to the set average IP access connection duration.

[0067] Specifically, the intrusion characterization value of the network device is obtained by numerically quantifying and analyzing the network security audit log data of each abnormal node of the network device, and the quantitative result is used to further evaluate the intrusion detection degree of the network device, so as to serve as the analysis basis of the intrusion detection result.

[0068] Specifically, the intrusion detection results are screened and the defense strategies are matched. The specific process is: based on the preliminary intrusion assessment value of each abnormal node of the network device and the intrusion characterization value of the network device, the intrusion measurement index of the network device is comprehensively calculated.

[0069] The intrusion measurement index of the network device is compared with the set intrusion index threshold to obtain the intrusion detection result. The intrusion detection result is either invaded or not invaded. If the intrusion measurement index of the network device is higher than or equal to the intrusion assessment threshold, the intrusion detection result is defined as invaded, and matched with the matching defense strategy corresponding to each intrusion measurement index threshold interval stored in the cloud database to obtain the defense strategy of the intrusion detection result. If the intrusion measurement index of the network device is lower than the intrusion index threshold, the intrusion detection result is defined as not invaded.

[0070] In this implementation, the defense strategy can be dynamically adjusted according to the intrusion situation of the network device, which improves the accuracy and timeliness of the defense and helps to protect network security more effectively.

[0071] Specifically, the intrusion measurement index of network equipment is obtained by numerically quantifying and analyzing the characteristic data of each node of the network equipment and the network security audit log data, and the quantitative result used to finally evaluate the degree of intrusion detection results is used as the analysis basis for the defense strategy.

[0072] Specifically, the preliminary intrusion assessment value of each node of the network device can be obtained not only through the analysis of the historical preparation and operation data evaluation platform, but also through a more accurate calculation method. The specific calculation method is as follows: ; In the formula, is the preliminary intrusion assessment value of the i-th node of the network device, is the access intrusion assessment value of the i-th node of the network device, is the traffic intrusion assessment value of the i-th node of the network device, is the behavioral intrusion assessment value of the i-th node of the network device, is the weight factor corresponding to the set access intrusion assessment value, is the weight factor corresponding to the set traffic intrusion assessment value, is the weight factor corresponding to the set behavior intrusion assessment value, e represents a natural constant, i is the number of each node of the network device, , n represents the number of nodes.

[0073] Specifically, the intrusion measurement index of the network device is calculated by: according to the preliminary intrusion assessment value of each node of the network device, the preliminary intrusion assessment value of each abnormal node of the network device is counted; ; In the formula, Indicates the intrusion measurement index of network devices. is the initial intrusion assessment value of the jth abnormal node of the network device, is the intrusion characterization value of the network device, j is the number of each abnormal node of the network device, , m represents the number of abnormal nodes, .

[0074] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0075] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A large-scale network security defense system based on collaborative intrusion detection, characterized in that: include: The intrusion unit node detection module is used to monitor and analyze the characteristic data of network devices, and each node cooperates to perform preliminary intrusion detection and send intrusion detection analysis instructions at the same time; Collaborative analysis module, used to receive intrusion detection analysis instructions, collaboratively collect and analyze network security audit log data, and screen intrusion detection results to match defense strategies; The management control defense module is used to filter and block network traffic according to defense strategies.

2. A large-scale network security defense system based on collaborative intrusion detection according to claim 1, characterized in that: The monitoring and analysis of the characteristic data of the network equipment and the collaboration of each node to perform intrusion detection are as follows: Set a monitoring cycle, and traverse the log data in each node of the network device, count the access IPs in each node of the network device during the monitoring cycle, count the number of visits of each access IP and the duration of the monitoring cycle, and calculate the access frequency of each access IP in each node of the network device; Extract the defined access frequencies stored in the cloud database and obtain the access intrusion assessment values ​​of each node of the network device after processing; Collect the usage traffic and the size of the data packets sent by each access IP in each node of the network device during the monitoring period, extract the defined usage traffic and reference sending data packet size stored in the cloud database, and obtain the traffic intrusion assessment value of each node of the network device after processing; Collect the number of system errors, service crashes and total IP connections in each node of the network device during the monitoring period, extract the defined number of system errors, single service crash impact factors and defined number of connections stored in the cloud database, and obtain the behavioral intrusion assessment value of each node of the network device after processing; The access frequency, usage traffic, size of sent data packets, number of system errors, number of service crashes and total number of IP connections of each access IP are combined as characteristic data of each node of the network device; Based on the access intrusion assessment value, traffic intrusion assessment value and behavior intrusion assessment value of each node of the network device, the preliminary intrusion assessment value of each node of the network device is comprehensively calculated.

3. A large-scale network security defense system based on collaborative intrusion detection according to claim 2, characterized in that: The preliminary intrusion assessment value of each node of the network device is specifically a preliminary quantitative result for evaluating the degree of intrusion detection obtained by numerically quantifying and analyzing the characteristic data of each node of the network device, so as to serve as a numerical basis for executing and sending an intrusion detection analysis instruction.

4. A large-scale network security defense system based on collaborative intrusion detection according to claim 1, characterized in that: The specific process of sending the intrusion detection analysis instruction is as follows: The preliminary intrusion assessment value of each node of the network device is compared with the set intrusion assessment threshold to obtain the intrusion detection analysis instruction sending judgment result, which is a sending instruction or a non-sending instruction. If the preliminary intrusion assessment value of a node of the network device is higher than or equal to the intrusion assessment threshold, the intrusion detection analysis instruction sending judgment result is defined as a sending instruction, and the node is marked as an abnormal node. If the preliminary intrusion assessment value of each node of the network device is lower than the intrusion assessment threshold, the intrusion detection analysis instruction sending judgment result is defined as a non-sending instruction, thereby controlling the execution of sending the intrusion detection analysis instruction.

5. A large-scale network security defense system based on collaborative intrusion detection according to claim 1, characterized in that: The collaborative collection and analysis of network security audit log data includes the following specific analysis processes: Count the abnormal nodes of network devices and collaboratively collect security audit log data of network devices, including the number of network configuration changes in each abnormal node, the number of abnormal file accesses, and the average IP access connection duration; The number of changes to the defined network configuration, the abnormal factor of a single abnormal file access, and the average access connection duration of the defined IP stored in the cloud database are extracted to calculate the intrusion characterization value of the network device.

6. A large-scale network security defense system based on collaborative intrusion detection according to claim 5, characterized in that: The intrusion characterization value of the network device is specifically obtained by numerically quantifying and analyzing the network security audit log data of each abnormal node of the network device to further evaluate the quantitative result of the intrusion detection degree of the network device, so as to serve as the analysis basis of the intrusion detection result.

7. A large-scale network security defense system based on collaborative intrusion detection according to claim 1, characterized in that: The specific process of screening intrusion detection results and matching defense strategies is as follows: Based on the preliminary intrusion assessment value of each abnormal node of the network device and the intrusion characterization value of the network device, the intrusion measurement index of the network device is comprehensively calculated; The intrusion measurement index of the network device is compared with the set intrusion index threshold to obtain the intrusion detection result. The intrusion detection result is either invaded or not invaded. If the intrusion measurement index of the network device is higher than or equal to the intrusion assessment threshold, the intrusion detection result is defined as invaded, and matched with the matching defense strategy corresponding to each intrusion measurement index threshold interval stored in the cloud database to obtain the defense strategy of the intrusion detection result. If the intrusion measurement index of the network device is lower than the intrusion index threshold, the intrusion detection result is defined as not invaded.

8. A large-scale network security defense system based on collaborative intrusion detection according to claim 7, characterized in that: The intrusion measurement index of the network device is specifically obtained by numerically quantifying and analyzing the characteristic data of each node of the network device and the network security audit log data to obtain a quantitative result for the final evaluation of the degree of intrusion detection results, so as to serve as an analysis basis for the defense strategy.

9. A large-scale network security defense system based on collaborative intrusion detection according to claim 3, characterized in that: The calculation formula for the preliminary intrusion assessment value of each node of the network device is: ； In the formula, is the preliminary intrusion assessment value of the i-th node of the network device, is the access intrusion assessment value of the i-th node of the network device, is the traffic intrusion assessment value of the i-th node of the network device, is the behavioral intrusion assessment value of the i-th node of the network device, is the weight factor corresponding to the set access intrusion assessment value, is the weight factor corresponding to the set traffic intrusion assessment value, is the weight factor corresponding to the set behavior intrusion assessment value, e represents a natural constant, i is the number of each node of the network device, , n represents the number of nodes.

10. A large-scale network security defense system based on collaborative intrusion detection according to claim 8, characterized in that: The intrusion measurement index of the network device is calculated as follows: According to the preliminary intrusion assessment value of each node of the network device, the preliminary intrusion assessment value of each abnormal node of the network device is counted; ； In the formula, Indicates the intrusion measurement index of network devices. is the initial intrusion assessment value of the jth abnormal node of the network device, is the intrusion characterization value of the network device, j is the number of each abnormal node of the network device, , m represents the number of abnormal nodes, .

Images