Linkable distributed network intrusion detection method based on behavior description

Abstract

The invention discloses a linkable distributed network intrusion detection method based on behavior description, which achieves the real-time detection of abnormal flow in a network and timely makes a response by applying methods of the network behavior description and the feature extraction in a distributed detection system and linking with a fire wall, particularly comprising the steps of (a), a detection unit operation process and (b), a master control platform operation process: applying a detection strategy based on the behavior description on distributed detection units to effectively organize the distributed detection units to be an efficient organic whole, thus avoiding the low efficiency and the dispersibility of the existing system scheme, wherein the aim is to solve the low efficiency of the abnormal flow detection on a large network in the practical application and improve the whole detection ability and the protection effect of the detection system for the network.

Description

technical field [0001] The present invention proposes a distributed network intrusion detection scheme based on behavior description that can be linked. By applying the method of network behavior description and feature abstraction to the distributed detection system and linkage with the firewall, real-time monitoring of abnormal traffic in the network is realized. Detecting and responding in a timely manner belongs to the field of computer security technology. Background technique [0002] With the continuous increase of network application types and the continuous increase of network scale, network security issues have become increasingly prominent, which has attracted people's attention. The main threats facing the current network include denial of service attacks, network intrusion, malicious code, etc. In order to effectively deal with these threats, it is necessary to take real-time detection and protection measures for the network, control security issues within a cer...

AI Technical Summary

Problems solved by technology

Although many architectures and schemes have emerged, more emphasis is still placed on the performance and detection methods of a single detection unit, without considering that the network environment and detection targets of these distributed detection units are different, and they are submitted to the central management control The data sources of the platform are also various and lack consistency, which brings inconvenience to the analysis and storage of the central manager

Images