Intelligent NIPS framework based on dynamic cloud/fire wall linkage

Abstract

An NIPS (Network Intrusion Prevention System) adopts the structure that an NIPS framework in linkage with a cloud / fire wall is connected to a cloud security. The cloud security technology, the artificial intelligence technology and the network invasion prevention technology are combined together by adopting a novel design concept and manner. The novel technical characteristics of the cloud security are utilized to combine with the advantages of real-time extraction, interactive coordination and linkage and abnormal information identification of the dynamic cloud / fire wall technology, so that the detection and identification accuracies, the dynamic interactive coordination and linkage performance and the intelligent blocking decision-making performance are improved, false alarm and high alarm loss rate are avoided, and both the key technology and the core problems in integral dynamic defense and detection of the computer network security are well solved, accordingly, the safe reliability and integral dynamic linkage defense capability of the computer network are improved.

Description

Smart NIPS Architecture Based on Dynamic Cloud Firewall Linkage technical field The invention relates to the technical field of computer network information security, in particular to an intelligent NIPS framework based on dynamic cloud and firewall linkage. The present invention is mainly applied to the key technology of computer network firewall and network security defense system NIPS, which can effectively solve the problems of network security missed detection, high false alarm rate, poor dynamic real-time interactive linkage, etc., and further improve the overall dynamic intelligent real-time defense capability of the network And the accuracy of detection, identification and blocking decision-making. Background technique The traditional firewall generally used today is a passive static access control system, which only detects external network information (not internal network detection) according to the security policy, so that it can only protect the internal netwo...

AI Technical Summary

Problems solved by technology

The focus is on network monitoring and auditing and tracking. When abnormalities are found, only reporting cannot prevent them, and can only be protected by linkage with security devices such as firewalls

At present, there are serious defects: first, poor dynamic linkage and poor intelligence; second, network defects. Using switches instead of HUBs that can share monitoring will cause trouble for IDS network monitoring, and carefully constructing and sending data packets under complex networks is also difficult. It can bypass the monitoring of IDS; the third is that there are a large number of false positives and false negatives, and the alarms are constantly

The existing traditional firewall is a passive static access control system, which only detects external network information (not internal network detection) according to the security policy, so that it can only protect the internal network from illegal access and attacks from the outside world

However, the network-based intrusion prevention system NIPS (NetworkIntrusionPreventionSystem) has the characteristics of being difficult to intelligently and actively block suspicious data packets, limited monitoring, single detection and analysis method, poor real-time performance, poor linkage and coordination, high false alarm rate, and difficult interoperability of heterogeneous systems. The system structure can not meet the requirements of distribution and openness, etc., which leads to the continuous increase of hidden dangers and threats of computer network security, the reduction of the efficiency of network resource utilization and shared services, and also increases the manual auxiliary processing and management decision-making of network administrators and network security personnel. load

Seriously affect the accuracy of key technologies of computer network security defense and detection, security efficiency, intelligence, real-time dynamic and real-time linkage and the overall performance of security defense

Images