A computer information security defense system

Abstract

The invention discloses a computer information security defense system, which includes an initialization module, an intelligent acquisition module, a log analysis module connected between the initialization module and the intelligent acquisition module, a server analysis module, a customer analysis module, an online analysis module, and a high-speed Retrieval module, attack analysis engine module. According to the present invention, various factors such as the current network environment, the service type provided by the server, the type of access objects, the attacks suffered, and the access time period are used as initial values, and the best rule deployment scheme is determined through a period of learning, and can be based on The common attacks and potential threats of the entire network are dynamically deployed, and the templates of security defense rules are set through the learning and dynamic observation of various factors to ensure network security, which improves the defense pertinence of network security.

Description

technical field [0001] The invention belongs to the technical field of network computer security, and relates to a computer information security defense system. Background technique [0002] The traditional deployment of security rules is to add all or some rules to the system artificially according to the needs. Since the network environment targeted by security products is not unique, many security rules are not necessary for specific network environments, but which rules are Necessary, this requires diagnostics and intelligent learning. It is unscientific to configure security rules blindly. Configuring too many redundant rules will have a great impact on the resource waste of security products and the speed of the entire network. If inaccurate rules are configured, that is, the rules that should be configured for the environment are not matched, it will affect the defense effect of the security product, thus releasing loopholes to the protected server. The configurati...

AI Technical Summary

Problems solved by technology

But it is static, while network security is dynamic and holistic, hackers have countless attack methods, firewalls are not omnipotent, and it is impossible to completely prevent these intentional or unintentional attacks