Security defensive system and defensive method based on software-defined network

Abstract

The invention relates to the technical field of computer security, and in particular to a security defensive system and a defensive method based on a software-defined network. The security defensive system comprises a network control module, an attack analysis module, a progress detection module and a network flow detection module, wherein the network control module is used for intercepting a network data packet between virtual machines and used for forwarding acquired flow information to the attack analysis module; the attack analysis module is used for receiving flow information from the virtual machines of the network control module, used for scheduling the progress detection module to detect whether the progress is questionable, and used for scheduling the network flow detection module to execute deep detection on questionable flow if necessary. Aiming at expansion of virtual switches for flow forwarding among virtual machines in a conventional virtual machine server, the invention discloses a deep defensive system which is capable of intercepting, detecting and reorienting the flow, and the purposes of preventing and stopping attack behaviors of virtual machines of a network cluster are achieved.

Description

[0001] technical field [0002] The present invention relates to a defense system in the field of computer security, in particular to a security defense system and defense method based on a software-defined network. Background technique [0003] There are many technologies that focus on detecting infected virtual machines and protecting other virtual machines in the cloud from them, such as firewalls and intrusion detection systems (Intrusion Detection System, IDS). At the network layer, traditional network firewalls and network-based intrusion detection systems (Network-based Intrusion Detection System, NIDS) are built in the "monitored network - outside the firewall" mode. This mode is not suitable for the situation where the infected virtual machine and the attack target are in the same cloud host, because the information collected by the network firewall and NIDS must be the information entering and leaving the monitored network. At the host level, personal firewalls, H...

AI Technical Summary

Problems solved by technology

Therefore, these traditional network security technologies cannot well solve the problem that this paper focuses on: detecting harmful virtual machines in time, and blocking them when they try to connect with other virtual machines, preventing attacks from happening

However, due to the use of the results of user-level programs, misjudgments may be caused by tampering with the results

Images