Network area boundary intrusion prevention system and method thereof

Abstract

The invention discloses a network area boundary intrusion prevention system and method, and relates to the technical field of network intrusion prevention, and the technical scheme is that the network area boundary intrusion prevention system comprises a central processor which is used for guaranteeing the calculation and operation of the system; the intrusion detection module is used for detecting whether the network area boundary has intrusion conditions or not, and comprises a network flow detection module, a network port scanning module, a virus intrusion detection module, a file data detection module, a system log detection module and a process service detection module; the system has the beneficial effects that the intrusion detection module is designed, so that flow information, port information, virus intrusion information, file data information, system log information and process service information of a network can be acquired, comprehensive acquisition of network data can be realized, and the network flow detection module is used for detecting whether abnormal changes exist in the network flow. Therefore, whether the network is invaded or attacked can be timely and effectively perceived, and the invasion prevention effect is better.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion prevention, and in particular to a network area boundary intrusion prevention system and method thereof. Background Art

[0002] The network area boundary intrusion prevention system is a technical system used to protect network security, which aims to detect, prevent or limit the intruder's attack on the network;

[0003] The existing network area boundary intrusion prevention system is found to be incomplete in the collection of network data during use. Therefore, it is not possible to detect whether the network is attacked in a timely and effective manner during use, and the intrusion prevention effect is poor. Therefore, it needs to be improved.

[0004] Therefore, it is necessary to invent a network area boundary intrusion prevention system and method thereof. Summary of the invention

[0005] To this end, the present invention provides a network area boundary intrusion prevention system and method thereof to solve the problems in the background technology.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a network area boundary intrusion prevention system, comprising:

[0007] The central processing unit is used to ensure the calculation and operation of the system;

[0008] An intrusion detection module, which is used to detect whether there is an intrusion at the boundary of the network area. The intrusion detection module includes a network flow detection module, a network port scanning module, a virus intrusion detection module, a file data detection module, a system log detection module and a process service detection module. The network flow detection module is used to detect whether there is an abnormal change in network flow, the network port scanning module is used to detect whether there is an abnormal closure and opening of the network port, the virus intrusion detection module is used to detect whether there is a virus intrusion in the network, the file data detection module is used to detect whether important network files are tampered with, deleted, encrypted or copied, the system log detection module is used to detect whether a large number of error messages, warnings or login records from unknown sources appear in the network system log, and the process service detection module is used to detect whether there are unfamiliar processes or services running in the network system;

[0009] The detection data transmission module is used to transmit the detection result of the intrusion detection module, and the detection data transmission module is connected to the output end of the intrusion detection module.

[0010] A data preprocessing and analysis module, which is used to preprocess and analyze the data results detected by the intrusion detection module, so as to identify possible intrusion behaviors, and the data preprocessing and analysis module is connected to the output end of the detection data transmission module;

[0011] A rule feature extraction module, which is used to extract the rules and features of the intrusion attack network from the analysis results of the data preprocessing analysis module, and the rule feature extraction module is connected to the output end of the data preprocessing analysis module;

[0012] A rule feature repository, which is used to store known attack rules, features, and response strategies;

[0013] A comparison and extraction module is used to compare the rules and features of the intrusion attack network extracted by the rule feature extraction module with the known attack rules and features stored in the rule feature storage library, so as to determine whether the intrusion attack means are recorded. If they are recorded, the corresponding response strategy can be extracted. The comparison and extraction module is connected to the rule feature extraction module and the output end of the rule feature storage library;

[0014] A protection strategy formulation module, which is used to formulate corresponding response strategies according to the means of intrusion when the means of intrusion attack are not recorded, and the protection strategy formulation module is connected to the output end of the comparison and extraction module;

[0015] A protection strategy transmission module, which is used to transmit the response strategy extracted by the comparison and extraction module and the response strategy formulated by the protection strategy formulation module, the protection strategy transmission module is connected to the output end of the comparison and extraction module and the protection strategy formulation module, and the protection strategy transmission module is connected to the input end of the central processing unit;

[0016] An intrusion blocking module, which is used to block the intrusion behavior of the network according to the protection strategy, so as to achieve intrusion prevention, and the intrusion blocking module is connected to the output end of the central processing unit;

[0017] The blocking result notification and display module is used to notify and display the blocking result of the intrusion blocking module. The blocking result notification and display module is connected to the output end of the intrusion blocking module.

[0018] Preferably, the detection data transmission module is connected to the output end of the intrusion detection module, the data preprocessing analysis module is connected to the output end of the detection data transmission module, and the rule feature extraction module is connected to the output end of the data preprocessing analysis module.

[0019] Preferably, the comparison and extraction module is connected to the output end of the rule feature extraction module and the rule feature storage library, the protection strategy formulation module is connected to the output end of the comparison and extraction module, the protection strategy transmission module is connected to the output end of the comparison and extraction module and the protection strategy formulation module, and the protection strategy transmission module is connected to the input end of the central processing unit.

[0020] Preferably, the intrusion blocking module is connected to the output end of the central processing unit, and the blocking result notification and display module is connected to the output end of the intrusion blocking module.

[0021] Preferably, the blocking result notification display module includes a display screen, a connecting block is fixedly connected to the rear side of the display screen, a rotating shaft 1 is embedded in the connecting block, both ends of the rotating shaft 1 are fixedly connected to connecting rods, a substrate is provided on the rear side of the display screen, two connecting rods are respectively fixedly connected to the two sides of the substrate, a rotating shaft 2 is embedded in the substrate, both ends of the rotating shaft 2 are fixedly connected to a box body 1, pistons are slidably provided in the two box bodies 1, through grooves are opened on the front sides of the two box bodies 1, moving rods are slidably provided in the two through grooves, and the rear ends of the two moving rods are respectively fixedly connected to the two pistons 1.

[0022] Preferably, two U-shaped frames are fixedly connected to the rear side of the display screen, and the two U-shaped frames are fixedly connected to a rotating shaft three inside, and the front ends of the two moving rods are respectively sleeved on the outside of the two rotating shafts three, and the rear side of the substrate is fixedly connected to a box body two, and a piston two is slidably provided inside the box body two, and an electric push rod is fixedly connected to the top of the piston two, and the electric push rod is fixedly connected to the rear side of the substrate, and hoses are fixedly embedded on both sides of the box body two, and one end of the two hoses is respectively fixedly embedded in the rear side of the two box bodies one.

[0023] Preferably, a mounting frame is fixedly connected to the top of the substrate, and a plurality of mounting holes are formed on the mounting frame.

[0024] Preferably, the first rotating shaft is connected to the connecting block via a bearing, the second rotating shaft is connected to the base plate via a bearing, and the third rotating shaft is connected to the moving rod via a bearing.

[0025] The present invention also provides a network area boundary intrusion prevention method, the specific steps are as follows:

[0026] S1. When the network area boundary is intruded, the intrusion detection module can detect whether there is intrusion at the network area boundary. At the same time, the detection data transmission module can transmit the data results detected by the intrusion detection module. Then the data preprocessing and analysis module can preprocess and analyze the data results detected by the intrusion detection module, so as to identify possible intrusion behaviors.

[0027] S2. After the intrusion behavior is analyzed, the rule feature extraction module extracts the rules and features of the intrusion attack network from the analysis results of the data preprocessing analysis module. Since the rule feature storage library stores known attack rules, features and response strategies, the comparison extraction module can compare the rules and features of the intrusion attack network extracted by the rule feature extraction module with the known attack rules and features stored in the rule feature storage library to determine whether the intrusion attack means are recorded. If they are recorded, the corresponding response strategy can be extracted. If they are not recorded, the protection strategy formulation module can formulate corresponding response strategies according to the intrusion means;

[0028] S3. Then the protection strategy transmission module can transmit the response strategy, and then the central processor receives the response strategy. Then the intrusion blocking module can block the intrusion behavior of the network according to the protection strategy, thereby realizing intrusion prevention.

[0029] The beneficial effects of the present invention are:

[0030] 1. The present invention designs an intrusion detection module composed of a network flow detection module, a network port scanning module, a virus intrusion detection module, a file data detection module, a system log detection module and a process service detection module, so that the network flow information, port information, virus intrusion information, file data information, system log information and process service information can be collected, and the comprehensive collection of network data can be realized, so that whether the network is attacked by intrusion can be detected in time and effectively, and the intrusion prevention effect is better;

[0031] 2. The present invention uses a protection strategy formulation module to formulate corresponding response strategies based on the means of intrusion when the means of intrusion attack have not been recorded in the rule feature storage library, thereby avoiding the occurrence of intrusion behavior and further expansion of losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings described below are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0033] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0034] Figure 1 A schematic diagram of the overall system provided by the present invention;

[0035] Figure 2 A schematic diagram of an intrusion detection module system provided by the present invention;

[0036] Figure 3 A schematic diagram of the structure of the blocking result notification display module provided by the present invention

[0037] Figure 4 The present invention provides Figure 3 Side view Figure 1 ;

[0038] Figure 5 The present invention provides Figure 3 Side view Figure 2 ;

[0039] Figure 6 The present invention provides Figure 5 Enlarged view of part A in the middle;

[0040] Figure 7 The present invention provides Figure 3 Rear view stereogram;

[0041] In the figure: 1. CPU; 2. Intrusion detection module; 3. Network traffic detection module; 4. Network port scanning module; 5. Virus intrusion detection module; 6. File data detection module; 7. System log detection module; 8. Process service detection module; 9. Detection data transmission module; 10. Data preprocessing and analysis module; 11. Rule feature extraction module; 12. Rule feature storage library; 13. Comparison and extraction module; 14. Protection strategy formulation module; 15. Protection strategy transmission module; 16. Intrusion blocking module; 17. Blocking result notification display module; 18. Display screen; 19. Connecting block; 20. Shaft 1; 21. Connecting rod; 22. Base plate; 23. Shaft 2; 24. Box 1; 25. Piston 1; 26. Moving rod; 27. U-shaped frame; 28. Shaft 3; 29. ​​Box 2; 30. Piston 2; 31. Electric push rod; 32. Hose; 33. Mounting frame; 34. Mounting hole. DETAILED DESCRIPTION

[0042] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0043] Refer to the attached Figure 1 -Attached Figure 7 The present invention provides a network area boundary intrusion prevention system, comprising:

[0044] Central processing unit 1, which is used to ensure the calculation and operation of the system;

[0045] An intrusion detection module 2 is used to detect whether there is an intrusion at the boundary of a network area. The intrusion detection module 2 includes a network flow detection module 3, a network port scanning module 4, a virus intrusion detection module 5, a file data detection module 6, a system log detection module 7 and a process service detection module 8. The network flow detection module 3 is used to detect whether there is an abnormal change in network flow, the network port scanning module 4 is used to detect whether there is an abnormal closure and opening of a network port, the virus intrusion detection module 5 is used to detect whether there is a virus intrusion in the network, the file data detection module 6 is used to detect whether important network files are tampered with, deleted, encrypted or copied, the system log detection module 7 is used to detect whether a large number of error messages, warnings or login records from unknown sources appear in the network system log, and the process service detection module 8 is used to detect whether there are unfamiliar processes or services running in the network system;

[0046] The detection data transmission module 9 is used to transmit the detection result of the intrusion detection module 2 . The detection data transmission module 9 is connected to the output end of the intrusion detection module 2 .

[0047] The data preprocessing and analysis module 10 is used to preprocess and analyze the data results detected by the intrusion detection module 2, so as to identify possible intrusion behaviors. The data preprocessing and analysis module 10 is connected to the output end of the detection data transmission module 9;

[0048] A rule feature extraction module 11 is used to extract rules and features of intrusion attack networks from the analysis results of the data preprocessing analysis module 10. The rule feature extraction module 11 is connected to the output end of the data preprocessing analysis module 10;

[0049] A rule feature repository 12, which is used to store known attack rules, features and response strategies;

[0050] The comparison and extraction module 13 is used to compare the rules and features of the intrusion attack network extracted by the rule feature extraction module 11 with the known attack rules and features stored in the rule feature storage library 12, so as to determine whether the intrusion attack means are recorded. If they are recorded, the corresponding response strategy can be extracted. The comparison and extraction module 13 is connected to the output end of the rule feature extraction module 11 and the rule feature storage library 12;

[0051] A protection strategy formulation module 14, which is used to formulate a corresponding response strategy according to the intrusion means when the intrusion attack means are not recorded. The protection strategy formulation module 14 is connected to the output end of the comparison and extraction module 13;

[0052] A protection strategy transmission module 15, which is used to transmit the response strategy extracted by the comparison and extraction module 13 and the response strategy formulated by the protection strategy formulation module 14, the protection strategy transmission module 15 is connected to the output end of the comparison and extraction module 13 and the protection strategy formulation module 14, and the protection strategy transmission module 15 is connected to the input end of the central processor 1;

[0053] An intrusion blocking module 16, which is used to block the intrusion behavior of the network according to the protection strategy, so as to achieve intrusion prevention. The intrusion blocking module 16 is connected to the output end of the central processor 1;

[0054] A blocking result notification and display module 17, which is used to notify and display the blocking result of the intrusion blocking module 16, and the blocking result notification and display module 17 is connected to the output end of the intrusion blocking module 16;

[0055] In this embodiment, an intrusion detection module 2 is designed, which is composed of a network flow detection module 3, a network port scanning module 4, a virus intrusion detection module 5, a file data detection module 6, a system log detection module 7 and a process service detection module 8. In this way, network flow information, port information, virus intrusion information, file data information, system log information and process service information can be collected, and comprehensive collection of network data can be achieved, so that it can be timely and effectively detected whether the network is attacked by intrusion, and the intrusion prevention effect is better;

[0056] Among them, in order to achieve the purpose of ensuring the normal operation of the system, the present device is implemented by the following technical solutions: the detection data transmission module 9 is connected to the output end of the intrusion detection module 2, the data preprocessing analysis module 10 is connected to the output end of the detection data transmission module 9, the rule feature extraction module 11 is connected to the output end of the data preprocessing analysis module 10, the comparison and extraction module 13 is connected to the output end of the rule feature extraction module 11 and the rule feature storage library 12, the protection strategy formulation module 14 is connected to the output end of the comparison and extraction module 13, the protection strategy transmission module 15 is connected to the output end of the comparison and extraction module 13 and the protection strategy formulation module 14, the protection strategy transmission module 15 is connected to the input end of the central processing unit 1, the intrusion blocking module 16 is connected to the output end of the central processing unit 1, and the blocking result notification display module 17 is connected to the output end of the intrusion blocking module 16. The electrical connection between each module can ensure the normal operation of the system;

[0057] Among them, in order to achieve the purpose of adjusting the pitch angle of the display screen 18, the present device adopts the following technical solutions: the blocking result notification display module 17 includes a display screen 18, a connecting block 19 is fixedly connected to the rear side of the display screen 18, a rotating shaft 20 is embedded in the connecting block 19, and connecting rods 21 are fixedly connected to both ends of the rotating shaft 20, a base plate 22 is provided on the rear side of the display screen 18, two connecting rods 21 are respectively fixedly connected to the two sides of the base plate 22, a rotating shaft 23 is embedded in the base plate 22, and both ends of the rotating shaft 23 are fixedly connected to a box body 24, and pistons 25 are slidably provided inside the two box bodies 24, through grooves are opened on the front sides of the two box bodies 24, and moving rods 26 are slidably provided inside the two through grooves, and the rear ends of the two moving rods 26 are respectively fixedly connected to the two pistons 25, and two U-shaped frames 27 are fixedly connected to the rear side of the display screen 18, and the two U-shaped frames 27 are fixed inside. A rotating shaft 3 28 is fixedly connected, and the front ends of the two moving rods 26 are respectively sleeved on the outside of the two rotating shafts 3 28. A box body 29 is fixedly connected to the rear side of the base plate 22. A piston 2 30 is slidably arranged inside the box body 29. An electric push rod 31 is fixedly connected to the top of the piston 20. The electric push rod 31 is fixedly connected to the rear side of the base plate 22. Both sides of the box body 29 are fixedly embedded with hoses 32. One end of the two hoses 32 is fixedly embedded in the rear sides of the two box bodies 1 24. The electric push rod 31 is controlled to work, so that the piston 2 30 can be moved downward, and then the two box bodies 1 24 can be inflated under the action of the two hoses 32, so that the two pistons 1 25 move forward, and then the two moving rods 26 are pushed forward, so that the display screen 18 can be pushed to rotate with the rotating shaft 1 20 as the rotation axis, so that the pitch angle of the display screen 18 can be adjusted;

[0058] In order to achieve the purpose of installation, the device is implemented by the following technical solution: a mounting frame 33 is fixedly connected to the top of the substrate 22, and a plurality of mounting holes 34 are opened on the mounting frame 33. The design of the mounting frame 33 and the mounting holes 34 can be used to install the display screen 18 with bolts;

[0059] Among them, in order to achieve the purpose of reducing wear, the present device adopts the following technical solution: the rotating shaft 20 is connected to the connecting block 19 through a bearing, the rotating shaft 23 is connected to the base plate 22 through a bearing, and the rotating shaft 3 28 is connected to the moving rod 26 through a bearing. The bearing connection can reduce wear.

[0060] The use process of the present invention is as follows: when the network area boundary is intruded and prevented, the intrusion detection module 2 can detect whether there is intrusion at the network area boundary; when detecting, the network flow detection module 3 can detect whether there is abnormal change in network flow; the network port scanning module 4 can detect whether the network port is abnormally closed and opened; the virus intrusion detection module 5 can detect whether there is virus intrusion in the network; the file data detection module 6 can detect whether important network files are tampered with, deleted, encrypted or copied; the system log detection module 7 can detect whether a large number of error messages, warnings or login records from unknown sources appear in the network system log; at the same time, the detection data transmission module 9 can transmit the data results detected by the intrusion detection module 2; then the data preprocessing and analysis module 10 can preprocess and analyze the data results detected by the intrusion detection module 2, so as to identify possible intrusion behaviors;

[0061] After the intrusion behavior is analyzed, the rule feature extraction module 11 extracts the rules and features of the intrusion attack network from the analysis results of the data preprocessing analysis module 10. Since the rule feature storage library 12 stores known attack rules, features and response strategies, the comparison extraction module 13 can compare the rules and features of the intrusion attack network extracted by the rule feature extraction module 11 with the known attack rules and features stored in the rule feature storage library 12, so as to determine whether the intrusion attack means are recorded. If they are recorded, the corresponding response strategy can be extracted. If they are not recorded, the protection strategy formulation module 14 can formulate corresponding response strategies according to the means of intrusion, and then the protection strategy transmission module 15 can transmit the response strategy. Then the central processor 1 receives the response strategy, and then the intrusion blocking module 16 can be controlled to work, and then the intrusion behavior of the network can be blocked according to the protection strategy, thereby realizing intrusion prevention;

[0062] Finally, the blocking result notification and display module 17 can notify and display the blocking result of the intrusion blocking module 16;

[0063] The blocking result notifies the display module 17 that when the pitch angle of the display screen 18 needs to be adjusted during use, the electric push rod 31 is controlled to work, so that the piston 2 30 can move downward, and then the two hoses 32 can inflate the two boxes 1 24, so that the two pistons 1 25 move forward, and then push the two moving rods 26 to move forward. Since the rotating shaft 23 is connected to the base plate 22 through a bearing, the box 1 24 and the base plate 22 can rotate relative to each other, and the moving rod 26 is connected to the rotating shaft 3 28 through a bearing, and the moving rod 26 and the display screen 18 can rotate relative to each other. When the two moving rods 26 move forward, they can push the display screen 18 to rotate with the rotating shaft 1 20 as the rotation axis, so that the pitch angle of the display screen 18 can be adjusted. When in use, the pitch angle can be appropriately adjusted according to the on-site conditions, thereby facilitating the use of the display screen 18.

[0064] The above are only preferred embodiments of the present invention. Any person skilled in the art may modify the present invention by using the above technical solutions or modify it into an equivalent technical solution. Therefore, any simple modification or equivalent replacement made according to the technical solution of the present invention belongs to the scope of protection claimed by the present invention.

Claims

1. A network area boundary intrusion prevention system, characterized in that: include: A central processing unit (1), which is used to ensure the calculation and operation of the system; An intrusion detection module (2) is used to detect whether there is an intrusion at the boundary of a network area. The intrusion detection module (2) comprises a network flow detection module (3), a network port scanning module (4), a virus intrusion detection module (5), a file data detection module (6), a system log detection module (7) and a process service detection module (8). The network flow detection module (3) is used to detect whether there is an abnormal change in network flow. The network port scanning module (4) is used to detect whether a network port is abnormally closed or opened. The virus intrusion detection module (5) is used to detect whether there is a virus intrusion in the network. The file data detection module (6) is used to detect whether important network files are tampered with, deleted, encrypted or copied. The system log detection module (7) is used to detect whether a large number of error messages, warnings or login records of unknown sources appear in the network system log. The process service detection module (8) is used to detect whether an unfamiliar process or service is running in the network system. A detection data transmission module (9) is used to transmit the detection result of the intrusion detection module (2); the detection data transmission module (9) is connected to the output end of the intrusion detection module (2).

2. A network area boundary intrusion prevention system according to claim 1, characterized in that: Also includes: A data preprocessing and analysis module (10) is used to preprocess and analyze the data results detected by the intrusion detection module (2), so as to identify possible intrusion behaviors, and the data preprocessing and analysis module (10) is connected to the output end of the detection data transmission module (9); A rule feature extraction module (11) is used to extract rules and features of intrusion attack networks from the analysis results of the data preprocessing analysis module (10), and the rule feature extraction module (11) is connected to the output end of the data preprocessing analysis module (10); A rule feature repository (12), which is used to store known attack rules, features and response strategies; A comparison and extraction module (13) is used to compare the rules and features of the intrusion attack network extracted by the rule feature extraction module (11) with the known attack rules and features stored in the rule feature storage library (12), so as to determine whether the intrusion attack means are recorded. If they are recorded, the corresponding response strategy can be extracted. The comparison and extraction module (13) is connected to the output end of the rule feature extraction module (11) and the rule feature storage library (12); A protection strategy formulation module (14), which is used to formulate a corresponding response strategy according to the means of invasion when the means of invasion attack is not recorded, and the protection strategy formulation module (14) is connected to the output end of the comparison and extraction module (13); A protection strategy transmission module (15) is used to transmit the response strategy extracted by the comparison and extraction module (13) and the response strategy formulated by the protection strategy formulation module (14), wherein the protection strategy transmission module (15) is connected to the output ends of the comparison and extraction module (13) and the protection strategy formulation module (14), and the protection strategy transmission module (15) is connected to the input end of the central processing unit (1); An intrusion blocking module (16) is used to block intrusion behavior of the network according to a protection strategy, thereby realizing intrusion prevention, and the intrusion blocking module (16) is connected to the output end of the central processing unit (1); A blocking result notification and display module (17) is used to notify and display the blocking result of the intrusion blocking module (16); the blocking result notification and display module (17) is connected to the output end of the intrusion blocking module (16).

3. A network area boundary intrusion prevention system according to claim 2, characterized in that: The detection data transmission module (9) is connected to the output end of the intrusion detection module (2), the data preprocessing analysis module (10) is connected to the output end of the detection data transmission module (9), and the rule feature extraction module (11) is connected to the output end of the data preprocessing analysis module (10).

4. A network area boundary intrusion prevention system according to claim 2, characterized in that: The comparison and extraction module (13) is connected to the output end of the rule feature extraction module (11) and the rule feature storage library (12), the protection strategy formulation module (14) is connected to the output end of the comparison and extraction module (13), the protection strategy transmission module (15) is connected to the output end of the comparison and extraction module (13) and the protection strategy formulation module (14), and the protection strategy transmission module (15) is connected to the input end of the central processing unit (1).

5. A network area boundary intrusion prevention system according to claim 2, characterized in that: The intrusion blocking module (16) is connected to the output end of the central processing unit (1), and the blocking result notification and display module (17) is connected to the output end of the intrusion blocking module (16).

6. A network area boundary intrusion prevention system according to claim 1, characterized in that: The blocking result notification display module (17) comprises a display screen (18), a connecting block (19) is fixedly connected to the rear side of the display screen (18), a rotating shaft (20) is embedded inside the connecting block (19), both ends of the rotating shaft (20) are fixedly connected to connecting rods (21), a base plate (22) is provided on the rear side of the display screen (18), two connecting rods (21) are respectively fixedly connected to the two sides of the base plate (22), a rotating shaft (23) is embedded inside the base plate (22), both ends of the rotating shaft (23) are fixedly connected to a box body (24), pistons (25) are slidably provided inside the two box bodies (24), through grooves are opened on the front sides of the two box bodies (24), moving rods (26) are slidably provided inside the two through grooves, and the rear ends of the two moving rods (26) are respectively fixedly connected to the two pistons (25).

7. A network area boundary intrusion prevention system according to claim 6, characterized in that: The display screen (18) is fixedly connected to two U-shaped frames (27) at the rear side, and the two U-shaped frames (27) are fixedly connected to the interior of the two rotating shafts (28). The front ends of the two moving rods (26) are respectively sleeved on the outside of the two rotating shafts (28). The base plate (22) is fixedly connected to a box body (29) at the rear side, and a piston (30) is slidably provided inside the box body (29). The top of the piston (30) is fixedly connected to an electric push rod (31), and the electric push rod (31) is fixedly connected to the rear side of the base plate (22). Both sides of the box body (29) are fixedly embedded with hoses (32), and one end of the two hoses (32) is respectively fixedly embedded in the rear sides of the two box bodies (24).

8. A network area boundary intrusion prevention system according to claim 7, characterized in that: A mounting frame (33) is fixedly connected to the top of the base plate (22), and a plurality of mounting holes (34) are provided on the mounting frame (33).

9. A network area boundary intrusion prevention system according to claim 8, characterized in that: The first rotating shaft (20) is connected to the connecting block (19) via a bearing, the second rotating shaft (23) is connected to the base plate (22) via a bearing, and the third rotating shaft (28) is connected to the moving rod (26) via a bearing.

10. A network area boundary intrusion prevention method, applicable to the intrusion prevention system according to any one of claims 1 to 9, characterized in that: The specific steps are as follows: S1. When preventing intrusion at the network area boundary, the intrusion detection module (2) can detect whether there is intrusion at the network area boundary, and at the same time, the detection data transmission module (9) can transmit the data results detected by the intrusion detection module (2), and then the data preprocessing and analysis module (10) can preprocess and analyze the data results detected by the intrusion detection module (2), so as to identify possible intrusion behaviors; S2. After the intrusion behavior is analyzed, the rule feature extraction module (11) extracts the rules and features of the intrusion attack network from the analysis results of the data preprocessing analysis module (10). Since the rule feature storage library (12) stores known attack rules, features and response strategies, the comparison extraction module (13) can compare the rules and features of the intrusion attack network extracted by the rule feature extraction module (11) with the known attack rules and features stored in the rule feature storage library (12), thereby determining whether the intrusion attack means are recorded. If they are recorded, the corresponding response strategy can be extracted. If they are not recorded, the protection strategy formulation module (14) can formulate a corresponding response strategy according to the intrusion means. S3, then the protection strategy transmission module (15) can transmit the response strategy, and then the central processor (1) receives the response strategy, and then the intrusion blocking module (16) can block the intrusion behavior of the network according to the protection strategy, thereby realizing intrusion prevention.

Images