A method for detecting abnormal events of network hosts based on mobile agent

Abstract

The invention discloses a method for detecting abnormal events of a network host based on a mobile agent. According to the detection result of a monitoring system, a host data collection and analysis mobile agent is dispatched to a sensitive host to perform data collection and security analysis tasks. Firstly, the mobile agent collects host resource information including CPU utilization, hard disk IO, network traffic, system process, memory utilization and other host resource information in the target host. The black and white list method is used to judge whether there are illegal processes, the NetFlow model is used to extract traffic characteristics and compared with the normal mode to judge whether there is abnormal traffic, and the multi-source information fusion method is used to fuse and analyze host information to judge whether there is abnormality. According to the analysis results, a dynamic isolation control strategy is adopted for abnormal hosts to reduce their security threats to other network hosts. The host data collection and abnormal behavior detection method proposed in this patent is simple and efficient, the data collection and analysis tasks are small, and it can be applied online in real time.

Description

technical field [0001] The invention belongs to the technical field of Internet host system security, and more specifically relates to a mobile agent-based network host information collection and abnormal event detection method. Background technique [0002] With the development of Internet technology, network management problems are becoming more and more serious. The current local area network is facing many problems such as irrational system architecture, opaque management of intranet software and hardware resources, excessive pressure on intranet servers, and the spread of viruses and Trojan horses. These are also problems that need to be solved urgently in the process of network management. The security detection of the host system in the network is the first step to solve these problems. The current network host system security detection methods include host-based intrusion detection and behavior-based security detection. Host-based intrusion detection performs detect...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to solve the problem that the existing host data acquisition and analysis system has low efficiency and maintainability and cannot realize host management according to the detection results, and provides a new mobile agent-based host abnormal event detection method

Images