An Internet threat monitoring and defense method based on dynamic joint defense

Abstract

The present invention relates to an Internet threat monitoring and defense method based on dynamic joint defense, which includes the following content: the automatic blocking module is connected to the Internet border blocking device through an application layer interface to realize data transmission; wherein, the automatic blocking module is configured In order to conduct real-time monitoring of various functional events processed by the functional layer, and send events that reach the set threat level in the monitoring results to the Internet border blocking device. The Internet boundary blocking device adopts the ADS blacklist protection strategy to filter the IP address, MAC address and terminal name in the threat event, as long as the source IP address of the data packet matches an address in the blacklist, the ADS device It will be blocked, and no other detection will be performed. The ADS device receives the black IP information, completes the blocking action and returns to the blocking state. The Internet threat monitoring and defense method based on dynamic joint defense of the present invention can replace manual operation by adding an automatic defense mechanism, avoid manual operation omissions, protect power network equipment and software, and effectively prevent threat attacks.

Description

technical field [0001] The invention relates to network security, in particular to an Internet threat monitoring and defense method based on dynamic joint defense. Background technique [0002] In recent years, the network security situation of my country's critical information infrastructure has become increasingly severe. Among them, power companies, as an important key information infrastructure unit in the country, are responsible for the management and operation of many important external applications, and are often targeted by hackers. At present, the number of cyber attacks against the power industry is also increasing. In order to ensure the security of the power network environment and block various attacks from the Internet, the long-term practice of the network security department is basically to invest a lot of manpower and material resources to carry out daily monitoring and inspection. Work. In order to report the security of Internet exits, the information ce...

AI Technical Summary

Problems solved by technology

[0003] However, the effect is not ideal. There are still a large number of network attacks that cannot be effectively intercepted in the first place, resulting in attacks on the internal system of the network, which in turn affects the safety of electricity consumption in various industries in society.

At present, the information center has to invest a lot of manual work to carry out monitoring and disposal work every day, which is costly. According to the existing mechanism, relevant personnel conduct inspections every 2 hours, and the defense mechanism will generate budget during normal working hours on weekdays. The incident response time is 2 hours, and the response time during non-working hours such as evenings and weekends can reach up to 48 hours. It is difficult to improve the timeliness of security protection

And if a lot of work is done manually, mistakes will inevitably occur and affect the quality of protection

[0004] Therefore, the power network security has problems such as an unsound automatic defense system for Internet threats; threat protection methods and technical tools are too traditional; heavy workload, labor-intensive, long event response time, and the risk of misoperation

Images