Computer network security early-warning apparatus

Abstract

The present invention relates to the technical field of computer network security. Disclosed is a computer network security early-warning apparatus. The early-warning apparatus comprises a plurality of computer network data collection apparatuses arranged in a distributed manner, a plurality of detection centers, and a plurality of network security early-warning centers, wherein the computer network data collection apparatuses perform data collection on a computer network and transmit collected data to the detection centers for processing; the detection centers process received network data, perform corresponding determination on an attack object of the network, and upload detected information to the network security early-warning centers; and the network security early-warning centers predict, by means of corresponding processing, threats present in the network, and then feed back the specific conditions of intrusions to a system administrator and give an early warning. The early-warning apparatus can discover abnormal data and behaviors in a computer network in a timely manner and give an early warning regarding same, thereby improving the security and stability of the computer network.

Description

Computer network security early warning device Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to a computer network security early warning device capable of effectively improving the security and stability of a computer network system. Background Art

[0002] With the increasing popularity of the internet, maintaining the healthy and stable operation of the online world is becoming increasingly important. In real-world computer networks, computer systems are often subject to unexpected threats from various sources, making it increasingly difficult to maintain network security and the normal operation of network systems. To effectively prevent network information leakage and computer network failures, and to improve computer network security early warning capabilities, it is necessary to design a computer network security early warning system based on network behavior.

[0003] Summary of the Invention

[0004] The technical problem to be solved by the present invention is how to provide a security warning device that can timely detect abnormal data and behavior in a computer network, issue an early warning thereto, and improve the security and stability of the computer network.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: a computer network security early warning device, including several distributed computer network data acquisition devices, several detection centers and several network security early warning centers, wherein several computer network data acquisition devices are connected to the data input end of a detection center as a group, and several detection centers are connected to the signal input end of one of the network security early warning centers as a group; the computer network data acquisition device collects data from the computer network and transmits the collected data to the detection center for processing, the detection center processes the received network data, makes corresponding judgments on the attack objects of the network, and uploads the detected information to the network security early warning center, the network security early warning center predicts the threats existing in the network through corresponding processing, and then feeds back the specific situation of the intrusion to the system administrator for early warning.

[0006] A further technical solution is that the data acquisition device is used to realize the collection and filtering of network data. In the process of collecting network data, system tools are relied on to intercept data packets in the computing network system to prevent data packets from being lost due to hacker intrusion. When acquiring data, different systems adopt different means to intercept data packets. For Linux operations, Libpcap function is used to capture data packets accordingly; for Windows operating system, WinPcap function is used to capture data packets accordingly.

[0007] A further technical solution is that the data acquisition device filters the data packets during the preprocessing of network data, stores the filtered data packets in the buffer zone of the memory, and can upload them to the application layer for use when needed. The main function of the data preprocessing module is to process the extracted data so that it can be mined by the data mining algorithm.

[0008] A further technical solution is that: the detection center includes an intrusion detection module, which is used to perform system rule matching through collected data packets, detect various different intrusion behaviors, and timely discover threats and weaknesses in the network by continuously scanning various important parts in the network system; rule matching is the core technical point of the intrusion detection module, and corresponding rule files need to be loaded in the corresponding rule matching. At the same time, the rule files serve as a knowledge base based on network attacks, and the technical means used for network intrusion can be identified through corresponding rules; by parsing the rule files in the knowledge base, a data rule tree with certain rules can be established to perform corresponding rule matching.

[0009] A further technical solution is that the network security early warning center includes a network early warning module, which is used to record the detailed process of network intrusion and the severity of network damage, and to find objects in the network that use illegal means to steal network information or use unreasonable means to attack the network security protection system; according to the abnormal situation occurring in the network, the corresponding alarm algorithm is adopted in accordance with the pre-agreed rules, and at the same time, according to the algorithm rules designed at the beginning, the corresponding warning level is given and fed back to the system administrator in an intuitive way.

[0010] The beneficial effects of adopting the above technical solution are as follows: the device described in this application includes a distributed computer network data acquisition device, a detection center, and a network security early warning center. The distributed network security early warning center divides the network into several different areas. The regional network security early warning center uses corresponding data association technology to accurately find the connection between intrusion data, reduce the complexity of the data, and effectively reduce the occurrence of false positives and false negatives. The fusion alarm technology can be used as an effective means to discover network attacks that cannot be discovered in the system protection system. It can timely discover abnormal data and behavior in the computer network, issue early warnings, and improve the security and stability of the computer network. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0012] FIG1 is a principle block diagram of the device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0013] As shown in Figure 1, an embodiment of the present invention discloses a computer network security early warning device, including several distributed computer network data acquisition devices, several detection centers and several network security early warning centers; wherein, several computer network data acquisition devices are connected as a group to the data input end of a detection center, and several detection centers are connected as a group to the signal input end of the network security early warning center; the computer network data acquisition device collects data from the computer network and transmits the collected data to the detection center for processing, the detection center processes the received network data, makes corresponding judgments on the attack objects of the network, and uploads the detected information to the network security early warning center, the network security early warning center predicts the threats existing in the network through corresponding processing, and then feeds back the specific situation of the intrusion to the system administrator for early warning.

[0014] Furthermore, the data acquisition device is used to realize the collection and filtering of network data. In the process of collecting network data, system tools are relied on to intercept data packets in the computing network system to prevent data packets from being lost due to hacker intrusion. When acquiring data, different systems use different means to intercept data packets. For Linux operations, the Libpcap function is used to capture data packets accordingly; for Windows operating systems, the WinPcap function is used to capture data packets accordingly.

[0015] After data is collected, it is stored in an in-memory database via the corresponding device. Data packet structure filtering is performed within the system kernel, and the filtered data packets are stored in the system's buffer. When needed, they can be uploaded to the corresponding application layer for use. This eliminates a necessary step in data transmission: the system no longer needs to read each packet from memory, saving a significant amount of time. The data transmission process involves three key steps: first, a start signal is sent. After receiving the start signal, the system prepares to send data. Next, the data information is sent. Finally, after the system has sent the information, it sends a corresponding response signal, closing the signal channel for the information transmission and halting the system's information transmission. During the information transmission process, the system cannot transmit information arbitrarily. Therefore, a protocol is required to guide the transmission of information. This requires the user to establish a protocol relationship so that the system can transmit information normally.

[0016] In statistical information, it is important to group identical or similar information into linked records, then read the corresponding information modules according to the TCP / IP protocol to form a complete daily information record to facilitate analysis. Before data mining, the data must be organized into a form that can be recognized by the data mining algorithm, so that the system can mine according to the corresponding algorithm.

[0017] The primary task of data association is to identify correlations between data, enabling the early warning device to quickly locate relevant data and reduce the size of the data. Establishing a comprehensive data standard is crucial in this process, so minimum credibility and minimum support are used as the most basic metrics. Finding correlations involves identifying data that simultaneously meets these two basic requirements. The data association algorithm can be summarized into the following steps:

[0018] 1) Find all system subsets related to the early warning device and frequently appearing, mainly finding the system user data set whose support meets the minimum support;

[0019] 2) Generate rules related to the early warning device in the frequent subset, and these rules can meet the minimum support and minimum confidence of the system.

[0020] The detection center includes an intrusion detection module, which is used to perform system rule matching through collected data packets, detect various different intrusion behaviors, and timely discover threats and weaknesses in the network by continuously scanning various important parts in the network system; rule matching is the core technical point of the intrusion detection module, and corresponding rule files need to be loaded in the corresponding rule matching. At the same time, the rule files serve as a knowledge base based on network attacks, and the technical means used for network intrusion can be identified through corresponding rules; by parsing the rule files in the knowledge base, a data rule tree with certain rules can be established to perform corresponding rule matching.

[0021] Data Rule Library: Intrusion detection requires a known system intrusion pattern, so it requires a method that can specifically describe the intrusion behavior. This application uses the compatible Snort rule description language, which has good extensibility and is very powerful. Each rule can be composed of two parts: the rule header and the rule options.

[0022] Parsing and matching rule base: This early warning device can work well mainly because it runs the following two specific steps: the first is a very standardized system parsing process, which includes reading the corresponding system rules according to the corresponding rule files; the second is to perform corresponding rule matching through these rules.

[0023] The network security early warning center includes a network early warning module, which is used to record the detailed process of network intrusion and the severity of network damage, and to find objects in the network that use illegal means to steal network information or use unreasonable means to attack the network security protection system; according to the abnormal situation occurring in the network, the corresponding alarm algorithm is adopted in accordance with the pre-agreed rules, and at the same time, the corresponding warning level is given according to the algorithm rules designed at the beginning, and the feedback is given to the system administrator in an intuitive way.

[0024] Depending on the severity of the network attack, the alarm level can be divided into three main levels: high, medium, and low. Different colors represent the alarm level type, and the corresponding specific address, port content, and corresponding data protocol type are also provided. Because different network attack modes have different degrees of impact on the network, the alarm system needs to set different alarm levels to control the network domain's response accordingly.

Claims

1. A computer network security early warning device, characterized by: The system comprises a number of distributed computer network data acquisition devices, a number of detection centers and a number of network security early warning centers, wherein the number of computer network data acquisition devices are connected as a group to the data input end of a detection center, and the number of detection centers are connected as a group to the signal input end of the network security early warning center; the computer network data acquisition devices collect data from the computer network and transmit the collected data to the detection center for processing; the detection center processes the received network data, makes corresponding judgments on the attack objects of the network, and uploads the detected information to the network security early warning center; the network security early warning center predicts the threats existing in the network through corresponding processing, and then feeds back the specific situation of the intrusion to the system administrator for early warning.

2. The computer network security early warning device according to claim 1, characterized in that: The data acquisition device is used to collect and filter network data. During the process of collecting network data, system tools are used to intercept data packets in the network system to prevent data packets from being lost due to hacker intrusion. When acquiring data, different systems use different methods to intercept data packets. For Linux operations, the Libpcap function is used to capture data packets accordingly; for Windows operating systems, the WinPcap function is used to capture data packets accordingly.

3. The computer network security early warning device according to claim 2, characterized in that: The data acquisition device filters the data packets during the preprocessing of network data, stores the filtered data packets in the buffer of the memory, and uploads them to the application layer for use when needed. The main function of the data preprocessing module is to process the extracted data so that it can be mined by the data mining algorithm.

4. The computer network security early warning device according to claim 1, wherein: The detection center includes an intrusion detection module, which is used to perform system rule matching through collected data packets, detect various different intrusion behaviors, and timely discover threats and weaknesses in the network by continuously scanning various important parts in the network system; rule matching is the core technical point of the intrusion detection module, and corresponding rule files need to be loaded in the corresponding rule matching. At the same time, the rule files serve as a knowledge base based on network attacks, and the corresponding rules can identify the technical means used for network intrusion; by parsing the rule files in the knowledge base, a data rule tree with certain rules is established to perform corresponding rule matching.

5. The computer network security early warning device according to claim 1, wherein: The network security early warning center includes a network early warning module, which is used to record the detailed process of network intrusion and the severity of network damage, and to find objects in the network that use illegal means to steal network information or use unreasonable means to attack the network security protection system; according to the abnormal situation occurring in the network, the corresponding alarm algorithm is adopted in accordance with the pre-agreed rules, and at the same time, the corresponding warning level is given according to the preset algorithm rules, and the feedback is given to the system administrator in an intuitive way.

Images