Active defense system and method based on biological immune

Abstract

The invention discloses an active defense system and method based on biological immune. The system comprises a terminal, wherein the terminal is equipped with a known behavior library which is trainedthrough utilization of a cloud and is used for carrying out local detection and real-time monitoring on behaviors through utilization of a quasi-biological immune mechanism, wherein the behaviors aregenerated based on internal and external data, and the terminal is also used for carrying out first-level active defense, and sending unidentified unknown behaviors to the cloud; and the cloud, wherein the cloud is equipped with the known behavior library which is trained through utilization of the cloud, and the cloud is used for collecting the unknown behaviors sent by the terminal, importing deep learning, carrying out cloud detection and behavior early warning, pushing new behaviors to the terminal in real time and carrying out second level-defense. According to the system and the method,on the basis of the quasi-biological immune mechanism and an improved NAS negative selection algorithm, unsecure computer behaviors can be actively identified, prevented, traced and checked, and integrated defense and active defense of a cloud-terminal cooperative computing environment is realized.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a biological immunity-based active defense system method and method for a cloud-end collaborative computing environment. Background technique [0002] In the early stage of computer development, when stand-alone computer viruses appeared, it was generally adopted to install stand-alone anti-virus software to solve security problems. With the popularization of the network, security problems such as worms and Trojan horses that can spread in the network have appeared, and network security software with cloud scanning and killing can be installed to partially solve the security problem. At present, with the emergence of new network computing models such as the Internet, cloud computing, Internet of Things, fog computing, and edge computing, network applications are becoming more and more extensive, user needs are changing, environments are heterogeneous, networks are comple...

AI Technical Summary

Problems solved by technology

[0003] The current methods to solve network security problems have the following problems: ①It can only prevent existing security problems. If new system vulnerabilities or security problems appear, it is necessary to wait until the security software and equipment manufacturers release solutions and upgrade the software or equipment to solve them. ; ②It can only stop the security behaviors that have already occurred, and cannot warn and solve the security risks lurking in the terminal in advance; ③The security problems of the terminal are mostly solved by the security software installed by itself, and there is no integration of cloud and terminal Collaborative defense function

[0004] In the prior art, the author is Ren Xianghua, and Harbin University of Science and Technology published a master's degree thesis "Research and Implementation of an Intrusion Detection System Based on Biological Immunity" in May 2006, which proposed an intrusion detection system based on biological immunity. Composed of detection subsets distributed in different nodes, combined with normal detection and misuse detection methods, expert rules are used as innate detectors to detect some known intrusions, but it cannot solve the problem of actively detecting unknown viruses and intrusions; by "University of Electronic Science and Technology of China "Published in 2012, the author is Tao Xu "Research on Intrusion Detection Method Based on Biological Immunity", referring to the mechanism of memory cells, designing an information detection method based on biological immunity, and designing common antibodies and effective antibodies on the basis of conventional intrusion detection The three detectors, memory antibody and memory antibody, can detect some abnormalities, but have a certain false detection rate

Images