Network attack analysis system

Abstract

The invention discloses a network attack analysis system, which comprises an entropy module unit, a triple module unit, a hot event propagation display module unit and a comprehensive association analysis module unit, wherein the entropy module unit reads logs of an intrusion detection system, computes entropy distribution values of source addresses and destination addresses, judges whether a large-scale network security event exists or not and outputs a judging result to the comprehensive association analysis module unit; and the triple module unit reads the logs of the intrusion detection system, merges the logs of the intrusion detection system, and detects and reports abnormal addresses or hot events. According to the analysis system disclosed by the invention, through computing the entropy distribution values of the source addresses and the destination addresses of the logs of the intrusion detection system, the large-scale network security event capable of causing the abnormal address distribution, such as network scanning and distributed denial of service attacks, can be detected.

Description

technical field [0001] The invention relates to the field of information security, in particular to a network attack analysis system. Background technique [0002] The rapid development of the Internet has brought great convenience to the dissemination and utilization of information, but at the same time, human society is facing a huge challenge of information security. In order to alleviate the increasingly serious security problems, intrusion detection equipment (IDS: IntrusionDetectionSystem) has been deployed more and more widely. IDS is installed in the protected network segment, and its monitoring network card works in promiscuous mode, analyzes all data packets in the network segment, and performs real-time detection and response to network attack events. At present, IDS generally adopts the misuse detection technology. The detection method is as follows: first, code the identification specific intrusion behavior pattern, establish a misuse pattern library, and the...

AI Technical Summary

Problems solved by technology

Due to the large number of alarms and many irrelevant alarms, most of the energy of security management personnel is spent on processing useless information, and it is difficult to understand the security threat status of the system

[0005] 2. Most of the existing intrusion detection equipment detects based on a single data packet, which is reflected in the form of expression. The alarm information of the intrusion detection equipment is an isolated intrusion event

In this way, when large-scale network abnormal behavior occurs, it is difficult to intuitively obtain the characteristics of the abnormal behavior from the alarm information, and it is difficult to evaluate the current network attack situation as a whole

Images