The application provides a
network security defense device actively responding to
hacker intrusion, belonging to the technical field of
network security, comprising a collection platform, an analysis platform, a blocking platform and an alarm platform connected in sequence, the collection platform is provided with multiple
simulation probes, including multiple first, second and third
simulation probes, the analysis platform is connected with each of the first, second and third
simulation probes to obtain the traffic data collected by the simulation probes and store the collected data, when the
IP address in the traffic data does not match the
IP address in the white
list, the behavior of the
IP address in the traffic data is labeled and then output to the blocking platform, the blocking platform takes different blocking measures according to different objects attacked by the
attack IP address, and after the blocking is completed, the alarm platform sends alarm information to the
network security administrator. The application can discover the attacker in time, actively block and alarm, does not need manual participation, enhances the defense effect, improves the operation and maintenance efficiency and reduces the operation and maintenance pressure.