Method, device and system for IPS (Intrusion Prevention System) to actively recognize and close misrecognition feature item

Abstract

The invention provides a method, a device and a system for an IPS (Intrusion Prevention System) to actively recognize and close a misrecognition feature item. The method comprises the following steps of the intrusion prevention system utilizes two global arrays to monitor an intrusion event alternatively, and the time for each global array to monitor the intrusion event is a preset time bucket; and when the intrusion prevention system utilizes one in the two global arrays to monitor the intrusion event, the intrusion prevention system utilizes data obtained by monitoring of the other one in the two global arrays to recognize whether the intrusion event is the misrecognition feature item and closes a detection switch of the recognized misrecognition feature item. According to the method, the device and the system, when the misrecognition feature item occurs, the misrecognition feature item can be effectively recognized and the misrecognition feature item is closed.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method, device and system for automatically identifying and closing misidentified feature items in an intrusion prevention system. Background technique [0002] Intrusion Prevention System (IPS for short) is the main tool to ensure the security environment of the network, and it is a supplement to the antivirus software and firewall. It can effectively intercept a large amount of attack traffic hidden in the network environment. [0003] However, due to the limited ability of the intrusion prevention system to identify attacks and the limited number of signature databases of the intrusion prevention system, there will be a certain probability of misidentification in the intrusion prevention system. Once misidentification occurs, its impact will be very large. It may intercept some normal and healthy traffic in the network environment, which seriously reduces the learning and ...

AI Technical Summary

Problems solved by technology

[0003] However, due to the limited ability of the intrusion prevention system to identify attacks and the limited number of signature databases of the intrusion prevention system, there will be a certain probability of misidentification in the intrusion prevention system. Once misidentification occurs, its impact will be very large. It may intercept some normal and healthy traffic in the network environment, which seriously reduces the learning and work efficiency of normal network users, and even causes economic losses to enterprises

[0004] The existing technology only reduces the occurrence of misidentification by continuously maintaining and improving the identification quality of the intrusion prevention system and continuously enriching the feature library of the intrusion prevention system. There is no effective solution to identify and close the misidentification in a timely and effective manner when it occurs

Images