Network security defense system based on collaborative intrusion detection

Abstract

A network security defense system based on collaborative intrusion detection relates to the technical field of network security and comprises a master control center which is in communication connection with a data acquisition module, a data processing module, an intrusion detection module, a collaborative analysis module and an information feedback module. The data acquisition module is used for acquiring detection data and intrusion data; the data processing module is used for obtaining available data; the intrusion detection module is used for performing log analysis, behavior analysis and flow analysis on a computer network to judge whether an independent intrusion behavior exists or not, and generating a detection result; the collaborative analysis module is used for obtaining an intrusion coefficient, judging whether a collaborative intrusion behavior exists or not, and generating alarm information; the information feedback module is used for feeding back a detection result and alarm information; through the technical scheme of the invention, the accuracy of intrusion detection can be obviously improved, and the occurrence of false alarms during single intrusion detection can be effectively reduced.

Description

Technical Field

[0001] The invention relates to the technical field of network security, and in particular to a network security defense system based on collaborative intrusion detection. Background Art

[0002] Collaborative intrusion detection refers to the cooperation, information sharing and collaborative analysis between multiple intrusion detection systems to improve the effectiveness and accuracy of intrusion detection. Traditional single intrusion detection may have some limitations when facing complex intrusion behaviors. Collaborative intrusion detection attempts to make up for these shortcomings through the cooperation between intrusion detection systems. In the prior art, the collaboration of collaborative intrusion detection often only involves superimposing the detection results obtained by different intrusion detection systems. Although this method improves the coverage of intrusion detection, it also increases the alarm volume of the system and fails to improve the accuracy of intrusion detection. In addition, the prior art also fails to make effective use of historical intrusion data. In view of the shortcomings of the prior art, the present invention provides a network security defense system based on collaborative intrusion detection. Summary of the invention

[0003] The purpose of the present invention is to provide a network security defense system based on collaborative intrusion detection.

[0004] The object of the present invention can be achieved by the following technical solutions: A network security defense system based on collaborative intrusion detection, comprising a main control center, wherein the main control center is communicatively connected with a data acquisition module, a data processing module, an intrusion detection module, a collaborative analysis module, and an information feedback module; The data acquisition module is used to collect and store detection data and intrusion data of the computer network; The data processing module is used to process the acquired detection data to obtain corresponding usable data; The intrusion detection module is used to perform log analysis, behavior analysis, and traffic analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generate corresponding detection results; The collaborative analysis module is used to set the matching degree and collaborative weight for the detection results of log analysis, behavior analysis, and traffic analysis to obtain an intrusion coefficient, determine whether there is collaborative intrusion behavior based on the intrusion coefficient, and generate corresponding alarm information; The information feedback module is used to provide feedback on the obtained detection results and alarm information.

[0005] Furthermore, the process of the data acquisition module collecting and storing the detection data and intrusion data of the computer network includes: A database and a data collection unit are set up, and the detection data and intrusion data of the computer network are collected through the data collection unit. The detection data includes user behavior and activity data, network traffic data, host logs, security device logs, threat intelligence, assets and configuration information. The intrusion data refers to the detection data when the computer network is invaded. The main control center reviews the obtained detection data and intrusion data, and uploads the reviewed detection data and intrusion data to the database for storage.

[0006] Furthermore, the process of the data processing module processing the acquired detection data to obtain corresponding usable data includes: A data processing unit is set up to process the detection data. The data processing unit processes the detection data, and the processing process of the detection data by the data processing unit includes: outlier processing, missing value processing and normalization processing, and the detection data obtained after processing is marked as corresponding available data.

[0007] Furthermore, the intrusion detection module performs log analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior, and generates a corresponding detection result, including: Obtain available data of host logs and security device logs in the detection data, mark them as log available data, perform feature extraction on the obtained log available data to obtain corresponding feature information, wherein the feature information includes the number of login failures, illegal file access, and abnormal network connection; A machine learning algorithm is used to obtain an intrusion log standard based on the host log and the security device log in the intrusion data, and the intrusion log standard is continuously updated. The obtained log available data is compared with the intrusion log standard. If there is log available data that meets the intrusion log standard, it is determined that there is a separate intrusion behavior, the current computer network is marked as an intrusion state, the log available data is marked as intrusion data, and a corresponding detection result is generated. The detection result includes the intrusion state and the intrusion data. If there is no log available data that meets the intrusion log standard, no operation is performed on it.

[0008] Furthermore, the process in which the intrusion detection module performs behavior analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generates a corresponding detection result includes: Obtain available data of user behavior and activity data in the detection data, mark it as available behavior data, and perform feature extraction on the obtained available behavior data to obtain corresponding feature information, wherein the feature information includes the number of failed logins, file access patterns, and abnormal network behavior; A machine learning algorithm is used to obtain an intrusion behavior standard based on user behavior and activity data in the intrusion data, and the standard is continuously updated. The obtained behavior available data is compared with the intrusion behavior standard. If there is behavior available data that meets the intrusion behavior standard, it is determined that there is a separate intrusion behavior, and the current computer network is marked as an intrusion state, the behavior available data is marked as intrusion data, and a corresponding detection result is generated. The detection result includes the intrusion state and the intrusion data. If there is no behavior available data that meets the intrusion behavior standard, no operation is performed on it.

[0009] Furthermore, the process in which the intrusion detection module performs traffic analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generates a corresponding detection result includes: Obtain available data of network traffic data in the detection data, mark it as available traffic data, perform feature extraction on the obtained available traffic data to obtain corresponding feature information, wherein the feature information includes source address, destination address, protocol type, port number, transmission rate, and data packet size; A machine learning algorithm is used to obtain an intrusion traffic standard based on the network traffic data in the intrusion data, and the intrusion traffic standard is continuously updated. The obtained traffic available data is compared with the intrusion traffic standard. If there is traffic available data that meets the intrusion traffic standard, it is determined that there is a separate intrusion behavior, the current computer network is marked as an intrusion state, the traffic available data is marked as intrusion data, and a corresponding detection result is generated. The detection result includes the intrusion state and the intrusion data. If there is no traffic available data that meets the intrusion traffic standard, no operation is performed on it.

[0010] Furthermore, the collaborative analysis module sets a matching degree and a collaborative weight for the detection results of the log analysis, behavior analysis, and traffic analysis to obtain an intrusion coefficient, determines whether there is a collaborative intrusion behavior according to the intrusion coefficient, and generates a corresponding alarm information, including: Setting an analysis cycle and an analysis unit, obtaining the number of individual intrusion behaviors in the detection results of log analysis, behavior analysis, and traffic analysis in the previous analysis cycle through the analysis unit, and marking them as the number of log intrusions, the number of behavior intrusions, and the number of traffic intrusions, respectively; The total number of intrusions into the computer network in the previous analysis cycle is obtained, and the matching degree is set for the number of log intrusions, the number of behavioral intrusions, and the number of traffic intrusions according to the numerical difference between the total number of intrusions and the number of log intrusions, the number of behavioral intrusions, and the number of traffic intrusions, and different coordination weights are set for different matching degrees; The number of log intrusions, behavioral intrusions, and traffic intrusions in the current analysis period are counted to obtain the intrusion coefficient, set the intrusion threshold, compare the intrusion coefficient with the intrusion threshold, obtain the coordinated intrusion behavior based on the comparison results, and generate corresponding alarm information.

[0011] Furthermore, the process of the information feedback module feeding back the obtained detection results and alarm information includes: A feedback unit is provided, through which the obtained detection results and alarm information are fed back to the staff, and the staff further processes the computer network according to the obtained detection results and alarm information.

[0012] Compared with the prior art, the present invention has the following beneficial effects: 1. By performing log analysis, behavior analysis, and traffic analysis on the computer network to obtain the corresponding detection results, by setting the matching degree and collaborative weight for each detection result to obtain the corresponding intrusion coefficient, and judging whether there is intrusion behavior according to the intrusion coefficient, the collaborative analysis method adopted by the present invention can significantly improve the accuracy of intrusion detection and effectively reduce the occurrence of false alarms in single intrusion detection; 2. By collecting historical intrusion data and obtaining corresponding intrusion log standards, intrusion behavior standards, and intrusion traffic standards based on the historical intrusion data, and by continuously obtaining intrusion data and continuously updating various intrusion standards, it is helpful to make accurate judgments on whether there is intrusion behavior in the computer network. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a schematic diagram of the present invention. DETAILED DESCRIPTION

[0014] like Figure 1 As shown, a network security defense system based on collaborative intrusion detection includes a main control center, and the main control center is communicatively connected with a data acquisition module, a data processing module, an intrusion detection module, a collaborative analysis module, and an information feedback module; The data acquisition module is used to collect and store detection data and intrusion data of the computer network; The data processing module is used to process the acquired detection data to obtain corresponding usable data; The intrusion detection module is used to perform log analysis, behavior analysis, and traffic analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generate corresponding detection results; The collaborative analysis module is used to set the matching degree and collaborative weight for the detection results of log analysis, behavior analysis, and traffic analysis to obtain an intrusion coefficient, determine whether there is collaborative intrusion behavior based on the intrusion coefficient, and generate corresponding alarm information; The information feedback module is used to provide feedback on the obtained detection results and alarm information.

[0015] It should be further explained that, in the specific implementation process, the process of the data acquisition module collecting and storing the detection data and intrusion data of the computer network includes: A database and a data collection unit are set up, and the detection data and intrusion data of the computer network are collected through the data collection unit. The detection data includes user behavior and activity data, network traffic data, host logs, security device logs, threat intelligence, assets and configuration information. The intrusion data refers to the detection data when the computer network is invaded. The main control center reviews the obtained detection data and intrusion data, and uploads the reviewed detection data and intrusion data to the database for storage; The network traffic data includes IP addresses, ports and transport protocol information, source and destination of data packets, size and timestamp of data packets, flags and characteristics of data packets; the host logs include system logs, authentication logs, and application logs; the security device logs include firewall logs, intrusion prevention system logs, and security information and event management system logs; the asset and configuration information includes configuration information, update and patch information of hosts and network devices; the threat intelligence includes known threat intelligence, vulnerabilities and public security threat information from security vendors, open source communities, and industry organizations; the user behavior and activity data includes user login and logout information, file and directory access logs, and events of privilege escalation and user privilege changes.

[0016] It should be further explained that, in a specific implementation process, the process in which the data processing module processes the acquired detection data to obtain corresponding usable data includes: Taking the network traffic data in the detection data as an example, the obtained network traffic data is numbered and recorded as i, where i=1, 2, ... n, and the obtained network traffic data is marked as W i , where W i =(W1, W2, ... W n ); Setting a data processing unit, processing the network flow data by the data processing unit, wherein the processing process of the network flow data by the data processing unit includes: outlier processing, missing value processing and normalization processing; The outlier processing is used to clean up abnormal network traffic data. The outlier processing adopts an absolute median difference outlier processing method to obtain the absolute deviation median M of the network traffic data; ; Wherein, the median function is used to calculate the median; Based on the absolute deviation median M, outliers in the network traffic data are determined, and the abnormal network traffic data at the outliers is cleaned up; If |W i -median(W i )|>3M, the network traffic data is marked as an outlier; If |W i -median(W i )|≤3M, no operation will be performed on it; The missing value processing is used to fill in the missing network traffic data, and the missing value processing adopts a statistical filling method to obtain the completeness Q of the network traffic data; ; Among them, W 众 is the mode of network traffic data; If Q < 95%, the network traffic data is marked as missing network traffic data; If Q ≥ 95%, no operation will be performed on it; Fill the missing network traffic data according to the distribution of network traffic data. If the network traffic data approximately conforms to the normal distribution, the mean is used for filling. If the network traffic data has a skewed distribution, the median is used for filling. The normalization process is used to unify the network traffic data format, and the normalization process adopts the Z-Score standardization method to transform the network traffic data format; ; Among them, W 新 Represents normalized network traffic data; The processed network traffic data is marked as the corresponding available data, and the available data is renumbered and recorded as j, where j = 1, 2, ..., m, and the available data is marked as W Kj , where W Kj =(W K1 , W K2 , ...W Km ), and so on, the same method is used to process other data in the detection data to obtain corresponding available data.

[0017] It should be further explained that, in the specific implementation process, the intrusion detection module performs log analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior, and generates a corresponding detection result, including: Obtain available data of host logs and security device logs in the detection data, mark them as log available data, perform feature extraction on the obtained log available data to obtain corresponding feature information, wherein the feature information includes the number of login failures, illegal file access, and abnormal network connection; A machine learning algorithm is used to obtain an intrusion log standard based on the host log and the security device log in the intrusion data, and the intrusion log standard is continuously updated. The obtained log available data is compared with the intrusion log standard. If there is log available data that meets the intrusion log standard, it is determined that there is a separate intrusion behavior, the current computer network is marked as an intrusion state, the log available data is marked as intrusion data, and a corresponding detection result is generated. The detection result includes the intrusion state and the intrusion data. If there is no log available data that meets the intrusion log standard, no operation is performed on it.

[0018] It should be further explained that, in the specific implementation process, the intrusion detection module performs behavioral analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior, and generates a corresponding detection result, including: Obtain available data of user behavior and activity data in the detection data, mark it as available behavior data, and perform feature extraction on the obtained available behavior data to obtain corresponding feature information, wherein the feature information includes the number of login failures, file access mode, and abnormal network behavior; A machine learning algorithm is used to obtain an intrusion behavior standard based on user behavior and activity data in the intrusion data, and the standard is continuously updated. The obtained behavior available data is compared with the intrusion behavior standard. If there is behavior available data that meets the intrusion behavior standard, it is determined that there is a separate intrusion behavior, and the current computer network is marked as an intrusion state, the behavior available data is marked as intrusion data, and a corresponding detection result is generated. The detection result includes the intrusion state and the intrusion data. If there is no behavior available data that meets the intrusion behavior standard, no operation is performed on it.

[0019] It should be further explained that, in the specific implementation process, the intrusion detection module performs traffic analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior, and generates a corresponding detection result, including: Obtain available data of network traffic data in the detection data, mark it as available traffic data, perform feature extraction on the obtained available traffic data to obtain corresponding feature information, wherein the feature information includes source address, destination address, protocol type, port number, transmission rate, and data packet size; A machine learning algorithm is used to obtain an intrusion traffic standard based on the network traffic data in the intrusion data, and the intrusion traffic standard is continuously updated. The obtained traffic available data is compared with the intrusion traffic standard. If there is traffic available data that meets the intrusion traffic standard, it is determined that there is a separate intrusion behavior, the current computer network is marked as an intrusion state, the traffic available data is marked as intrusion data, and a corresponding detection result is generated. The detection result includes the intrusion state and the intrusion data. If there is no traffic available data that meets the intrusion traffic standard, no operation is performed on it.

[0020] It should be further explained that, in the specific implementation process, the collaborative analysis module sets the matching degree and collaborative weight for the detection results of log analysis, behavior analysis, and traffic analysis to obtain an intrusion coefficient, and determines whether there is a collaborative intrusion behavior based on the intrusion coefficient, and generates corresponding alarm information. The process includes: Setting an analysis cycle and an analysis unit, obtaining the number of individual intrusion behaviors in the detection results of log analysis, behavior analysis, and traffic analysis in the previous analysis cycle through the analysis unit, and marking them as the number of log intrusions, the number of behavior intrusions, and the number of traffic intrusions, respectively; Obtain the total number of intrusions into the computer network in the previous analysis cycle, set matching degrees for the log intrusion number, behavior intrusion number, and traffic intrusion number according to the numerical differences between the total number of intrusions and the log intrusion number, behavior intrusion number, and traffic intrusion number, respectively, mark the intrusion number with the smallest difference from the total number of intrusions as the first matching degree, mark the intrusion number with the largest difference from the total number of intrusions as the third matching degree, and mark the intrusion number with a medium difference from the total number of intrusions as the second matching degree; Different collaborative weights are set for different matching degrees, wherein a first collaborative weight Q1 is set for the first matching degree, a second collaborative weight Q2 is set for the second matching degree, and a third collaborative weight Q3 is set for the third matching degree. Each collaborative weight is a score greater than 0 and less than 1, and the sum of each collaborative weight is equal to 1; The number of log intrusions, the number of behavior intrusions, and the number of traffic intrusions in the current analysis period are counted and marked as R1, R2, and R3, respectively. In the embodiment of the present invention, the number of log intrusions is the first matching degree, the number of behavior intrusions is the second matching degree, and the number of traffic intrusions is the third matching degree. The corresponding intrusion coefficient is obtained and marked as S. ; Set the intrusion threshold S0; When S≥S0, it is judged that there is a collaborative intrusion behavior and the corresponding alarm information is generated; When S<S0, no operation is performed on it.

[0021] It should be further explained that, in the specific implementation process, the process of the information feedback module feeding back the obtained detection results and alarm information includes: A feedback unit is provided, through which the obtained detection results and alarm information are fed back to the staff, and the staff further processes the computer network according to the obtained detection results and alarm information.

[0022] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A network security defense system based on collaborative intrusion detection, comprising a main control center, characterized in that: The main control center is communicatively connected with a data acquisition module, a data processing module, an intrusion detection module, a collaborative analysis module, and an information feedback module; The data acquisition module is used to collect and store detection data and intrusion data of the computer network; The data processing module is used to process the acquired detection data to obtain corresponding usable data; The intrusion detection module is used to perform log analysis, behavior analysis, and traffic analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generate corresponding detection results; The collaborative analysis module is used to set the matching degree and collaborative weight for the detection results of log analysis, behavior analysis, and traffic analysis to obtain an intrusion coefficient, determine whether there is collaborative intrusion behavior based on the intrusion coefficient, and generate corresponding alarm information; The information feedback module is used to provide feedback on the obtained detection results and alarm information.

2. A network security defense system based on collaborative intrusion detection according to claim 1, characterized in that: The process of the data acquisition module collecting and storing the detection data and intrusion data of the computer network includes: A database and a data collection unit are set up, and detection data and intrusion data of the computer network are collected through the data collection unit, and the obtained detection data and intrusion data are uploaded to the database for storage; The detection data includes user behavior and activity data, network traffic data, host logs, security device logs, threat intelligence, assets and configuration information, and the intrusion data refers to the detection data when a computer network is invaded.

3. A network security defense system based on collaborative intrusion detection according to claim 2, characterized in that: The process of the data processing module processing the acquired detection data to obtain corresponding usable data includes: A data processing unit is set up to process the detection data. The data processing unit processes the detection data, and the processing process of the detection data by the data processing unit includes: outlier processing, missing value processing and normalization processing, and the detection data obtained after processing is marked as corresponding available data.

4. A network security defense system based on collaborative intrusion detection according to claim 3, characterized in that: The process in which the intrusion detection module performs log analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generates a corresponding detection result includes: Obtain log available data of host logs and security device logs in the detection data, obtain intrusion log standards based on the host logs and security device logs in the intrusion data, compare the obtained log available data with the intrusion log standards, obtain individual intrusion behaviors based on the comparison results, and generate detection results.

5. A network security defense system based on collaborative intrusion detection according to claim 4, characterized in that: The process in which the intrusion detection module performs behavior analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generates a corresponding detection result includes: Obtain behavior-usable data of user behavior and activity data in the detection data, obtain intrusion behavior standards based on the user behavior and activity data in the intrusion data, compare the obtained behavior-usable data with the intrusion behavior standards, obtain individual intrusion behaviors based on the comparison results, and generate detection results.

6. A network security defense system based on collaborative intrusion detection according to claim 5, characterized in that: The process in which the intrusion detection module performs traffic analysis on the computer network based on the available data obtained to determine whether there is a separate intrusion behavior and generates a corresponding detection result includes: Obtain traffic availability data of the network traffic data in the detection data, obtain an intrusion traffic standard based on the network traffic data in the intrusion data, compare the obtained traffic availability data with the intrusion traffic standard, obtain a separate intrusion behavior based on the comparison result, and generate a detection result.

7. A network security defense system based on collaborative intrusion detection according to claim 6, characterized in that: The collaborative analysis module sets the matching degree and collaborative weight for the detection results of log analysis, behavior analysis, and traffic analysis to obtain an intrusion coefficient, determines whether there is collaborative intrusion behavior based on the intrusion coefficient, and generates corresponding alarm information, including: Setting an analysis cycle and an analysis unit, obtaining the number of log intrusions, the number of behavior intrusions, the number of traffic intrusions, and the total number of intrusions in the previous analysis cycle through the analysis unit, and setting a matching degree for each number of intrusions; Different collaborative weights are set for different matching degrees. The number of log intrusions, behavioral intrusions, and traffic intrusions in the current analysis period are counted to obtain the intrusion coefficient, set the intrusion threshold, compare the intrusion coefficient and the intrusion threshold, obtain the collaborative intrusion behavior based on the comparison results, and generate alarm information.

8. A network security defense system based on collaborative intrusion detection according to claim 7, characterized in that: The process of the information feedback module feeding back the obtained detection results and alarm information includes: A feedback unit is provided, through which the obtained detection results and alarm information are fed back to the staff.

Images