Alarm and response system for inner-mesh network aggression detection

Abstract

The invention discloses a warning and responding system used for intranet network attack detection. The system comprises a management center, a detecting machine and a database. The management center is used for configuring and amending each parameter of the detecting machine, receiving and storing warning message sent by the detecting machine and inquiring the state of the detecting machine. Anomaly information detection is carried out on an intranet network by an anomaly detection algorithmic module of the detecting machine, the anomaly detection algorithmic module obtains anomaly detection information and confirms the reliability of the information. When the reliability of the anomaly detection information reaches a preset value, the warning message is sent. The isolation time and the isolation form of an IP address generating the anomaly detection information are confirmed according to the warning message, and the IP address is isolated. The IP address that the isolation time reaches the preset value is released from isolation. The method can detect and prevent the attack from an intranet mainframe to outer net or other intranet mainframes exactly and effectively in time.

Description

technical field [0001] The invention relates to the technical field of computer security protection, in particular to an alarm and response system and an implementation method for intranet network attack detection. Background technique [0002] Intranet security is currently neglected by many network security devices and systems. Existing methods usually collect traffic at the egress of the subnet to detect attacks, but the traffic between hosts inside the subnet cannot be collected, so it is impossible to detect attacks inside the subnet. abnormality, especially the abnormality of the traffic between ports under a single switch. At present, many network anomalies, especially worms, the initial stage of the outbreak is to scan the subnet and generate malicious traffic. If the traffic inside the subnet can be monitored and detected, it can effectively make up for the gaps in existing security measures and improve The security level of the network. [0003] At present, the m...

AI Technical Summary

Problems solved by technology

The problem with this invention is that an intrusion detection and firewall system needs to be installed on each monitored host, which greatly increases the deployment cost, especially when the network scale is relatively large, the deployment is very difficult

Images