SDN-based (software defined network based) online intrusion prevention method and system

Abstract

The invention discloses an SDN-based (software defined network based) online intrusion prevention method and system; the method comprises: S1, monitoring a main unit to acquire initial detection alarm data, and transmitting the data to a detection server; S2, acquiring characteristic information sets corresponding to the detection alarm data according to the received detection alarm data; S3, acquiring a corresponding security situation estimated value for each characteristic information set according to all characteristic information sets within a preset period; S4, making corresponding intercept stream entries according to the security situation estimated values, and issuing the intercept stream entries. The SDN-based online intrusion prevention method and system have the advantages that distributed alarm information is processed centrally and analyzed comprehensively, comprehensive, timely and reliable detection is guaranteed, and diverse active response strategies can be taken in time for real-time security states of different devices.

Description

technical field [0001] The present application relates to the field of network information security, in particular to an SDN-based online intrusion prevention method and system. Background technique [0002] SDN (Software Defined Network) is an emerging software-based network architecture and technology. Its biggest feature is that it separates logic and data forwarding: the underlying network equipment is only responsible for data forwarding, while the network control function is passed through Software-based controller implementation. The SDN architecture proposed by ONF (Open NetWorking Foundation) is divided into three layers, which are application layer, control layer and data forwarding layer from top to bottom. Logical centralized control, flexible programming interface and other characteristics enable SDN to have stronger network automation management and control functions than traditional networks, and provide a new optional way to solve traditional network problem...

AI Technical Summary

Problems solved by technology

However, these methods also have their own shortcomings. For example, analyzing abnormal traffic by collecting data requires a large enough amount of data and obvious data characteristics, which will cause a relatively lagging security response; a single data analysis method can only analyze certain types of attacks. The effect is good, and it is impossible to analyze all possible types of attacks; a large amount of data traffic gathers the central server, and in a large network architecture, it will consume a lot of bandwidth and increase the burden on the controller or the central server

Images