8 results about "Distributed intrusion detection" patented technology

The invention discloses a network security linkage response system based on distributed intrusion detection, which belongs to the technical field of network security, aims to improve the comprehensiveness of network threat detection and the timeliness of response, and comprises a distributed lightweight probe, an edge preprocessing and initial judgment module, a central depth analysis module, an intelligent linkage response module and a unified management visualization module. The distributed lightweight probe module collects network security data of each network node; the edge preprocessing and initial judgment module processes the network security data and reports the network security data after initial abnormal detection; the central deep analysis module fuses and associates the reported preprocessed data, and obtains a threat analysis result in combination with AI model analysis, external threat intelligence comparison and attack chain reduction; the intelligent linkage response module matches a preset strategy execution scheme based on the threat analysis result and feeds back an effect; and the unified management visualization module is responsible for configuration management, result display and alarm. According to the invention, accurate identification and rapid linkage response of network threats are realized, and the network security is effectively guaranteed.

The invention discloses an automobile distributed intrusion detection and defense system and a working method thereof, and relates to the technical field of data security, the system comprises a plurality of distributed detection nodes and a central control unit, the distributed detection nodes are used for monitoring and collecting vehicle network security related data in real time, and the central control unit is used for sending the vehicle network security related data to the distributed detection nodes; the central control unit is used for receiving and analyzing the vehicle network security related data collected by each distributed detection node to judge whether the vehicle is subjected to a network security attack, and determining a new intrusion detection and defense rule based on the type of the network security attack when the vehicle is subjected to the network security attack; and issuing the new intrusion detection and defense rule to each distributed detection node. According to the method and the device, each distributed detection node can timely and accurately obtain and execute the latest intrusion detection and defense rule, dynamic updating of the rule is realized, the problem of static rule inventory is solved, and efficient and real-time security protection requirements can be met.

The application belongs to the technical field of control systems, and particularly relates to a comprehensive renewable energy system based on distributed intelligent network security and a control architecture thereof, and aims to solve the problems of poor security and control limitations of the existing comprehensive renewable energy system, and the inability to meet the requirements of safe and reliable adaptive control and the like. The application comprises: a distributed adaptive access control module which distributes control tasks on each node in the network, acquires data on each node, and dynamically adjusts the control access strategy; a distributed intrusion detection and response module which distributes intrusion monitoring sensors on each node in the network, acquires network traffic data, mines abnormal behaviors and security threats, and generates a corresponding response strategy; and a control strategy conflict monitoring module for automatically discovering and solving conflicts. The application improves the efficiency, accuracy and scalability of network security control, reduces the risk of single-point failure, and reduces the work burden of network security management personnel.

The present invention provides an air-space-ground-spatial network intrusion detection method based on multimodal conditional adversarial domain adaptation. It relates to the distributed field of air-space-ground-spatial network, and is invented to solve the drawbacks of the current adversarial domain adaptation method due to the balance problem of adversarial learning. The technical method provided by the present invention includes: a multimodal conditional adversarial domain adaptation method based on feature fusion is the core of the distributed intrusion detection architecture of the air-space-ground-spatial network, and the domain adaptive training of the model is used to provide the best detection model suitable for the domain environment for each network domain. The adversarial domain adaptation method inherits the advantages of the generative adversarial network, does not need to assume that the data obeys a certain distribution, and then uses the maximum likelihood to estimate the distribution of the data, and does not rely on any prior assumptions. At the same time, the model training is simpler and more diversified. This method can be applied in the study of air-space-ground-spatial network intrusion detection.

The invention relates to a distributed intrusion detection system based on parallel chains and a federated learning framework, and belongs to the technical field of block chains. The intrusion detection system comprises a relay chain, a data chain, a contribution chain, a client and an interstellar file system. The data chain and the contribution chain are two parallel chains; the relay chain is respectively in communication connection with the data chain and the contribution chain, the client is in communication connection with the data chain, and the interstellar file system is respectively in communication connection with the client, the data chain and the contribution chain. The relay chain is mainly composed of verifier nodes, the data chain is mainly composed of data chain collector nodes, and the contribution chain is mainly composed of contribution chain collector nodes. The method has the advantages that reward and punishment are fair, upgrading or connection with other block chain systems in the future is more convenient, and data tampering and hostile attacks can be effectively prevented.

This invention discloses a distributed intrusion detection method and system based on flexible, secure, and trusted federated learning, belonging to the field of network data security and sharing. The method includes: dividing nodes into training nodes and aggregation nodes; training nodes collecting network traffic, training a local network traffic classification model, and sending it to an edge network device; the edge network device detecting the uploaded local model and updating the list of trusted and malicious nodes; aggregation nodes aggregating qualified local models and returning the generated global model to the edge device; the edge device receiving the global model, verifying it, and broadcasting it; all training nodes receiving and using the latest global model to obtain the final intrusion detection model, and using the final intrusion detection model to detect intrusions. This invention effectively improves the system's security and robustness while ensuring data privacy and the trustworthiness of sharing.

A distributed intrusion detection system (IDS) is provided. The IDS includes, but is not limited to: a plurality of IDS sensors distributed in internet of things (IoT) devices; and a server, coupled to the plurality of IDS sensors through a network, where the plurality of IDS sensors is configured to collect event data from the IoT devices, and the server is configured to: receive the collected event data from the plurality of IDS sensors; determine if an intrusion event occurs by correlating and analyzing the collected event data; and generate an alert in an instance in which the intrusion event occurs.