Cloud computing environment intrusion detection system configuration and method thereof

Abstract

The present invention relates to a cloud computing environment intrusion detection system configuration and a method thereof. The system configuration comprises a cloud intrusion detection agent layer, a cloud intrusion detection domain control layer, a cloud intrusion detection domain control management layer and a cloud machine learning layer. An intrusion detection model is operated in the cloud intrusion detection agent layer, the conditions such as operation and network communication of a virtual machine can be monitored at the same cloud domain; the cloud intrusion detection agent layer in the same cloud domain performs information sharing to help other virtual machines perform prevention of intrusion threat; and the system configuration is a light-weight intrusion detection configuration so as to effectively improve the redundancy and the complexity of the intrusion detection configuration in a current cloud environment.

Description

technical field [0001] The invention belongs to the technical field of intrusion detection and cloud computing, and in particular relates to an architecture of a cloud computing environment intrusion detection system and a method thereof. Background technique [0002] Intrusion detection technology is an important network security protection technology that accompanies the development of network security technology. Depending on the environment used, by directly or indirectly collecting key information on computers and networks, monitoring host activities and network dynamics, auditing network traffic, unauthorized access, etc., tracking abnormal activities and other signs, intrusion detection The technology can identify whether there are abnormal situations or intrusions in the current environment; at the same time, the technology can respond in time according to the monitoring results to alert network administrators and users of related threat activities. From this point ...

AI Technical Summary

Problems solved by technology

[0005] (1) The redundancy and complexity of the intrusion detection system architecture in the current cloud computing environment are large;

[0006] (2) Using the current cloud computing environment intrusion detection system architecture to process large-scale data takes a lot of time;

[0007] (3) The detection performance of the intrusion detection system architecture in the current cloud computing environment is not high, and the real-time performance is low;

[0008] (4) In the face of abnormal situations in the dynamic and changeable cloud computing environment, traditional network intrusion technologies face bottlenecks in the face of large-scale intrusion data of known and unknown types, and there are security risks

[0009] To sum up, in view of the huge time overhead, low detection performance and low real-time performance of traditional network intrusion detection technology in the cloud computing environment when processing large-scale data, and the existence of intrusion detection system architecture in the current cloud computing environment Problems of redundancy and complexity, lack of effective solutions

Images