Firewall based on intrusion detection system feedback in cloud environment and implementation method thereof

Abstract

The invention discloses a firewall based on intrusion detection system feedback in a cloud environment and an implementation method thereof. The firewall comprises a firewall part and an IDS part. Thefirewall part filters the network data for the first time according to a filtering rule; the IDS part further filters the data passing through the firewall and screens the data based on an IDS filtering rule; and a filtering strategy of the firewall part is updated through feedback information of the IDS part in the system. A firewall and an intrusion detection system (IDS) are combined, interlocking is implemented through the IDS and the firewall, attack defense is divided into two parts, and defense work is naturally divided into two parts. The firewall part is used for coarse-grained defense, the IDS part is used for fine-grained analysis of grouping information, double-layer defense is more effective and accurate, defense attacks are separated from a cloud service server, the qualityof cloud services is not affected, and the response delay of the cloud services is reduced; and an IDS-based feedback change rule is adopted, so that attacks can be flexibly detected.

Description

technical field [0001] The invention belongs to the technical field of cloud environment and firewall, and relates to a firewall based on feedback from an intrusion detection system in a cloud environment and an implementation method thereof. Background technique [0002] With the rapid development of cloud computing, more and more cloud computing companies have begun to pay attention to the importance of cloud security. As a part of cloud security, "how to defend against attacks from the Internet" is becoming a hot topic. While discussing this topic, we need to build a system that monitors network traffic through physical network cards, analyzes it, and classifies different types of network protocols. Based on the feedback from the IDS, the rules of the firewall are updated. With the help of IDS, the effectiveness of the firewall becomes better. The cloud system architecture consists of five parts: consumers, cloud service providers, cloud brokers, auditors and cloud ope...

AI Technical Summary

Problems solved by technology

NIDS leads the visibility of network-based intrusion detection systems and significantly reduces the ability to monitor internal host status or events and must gather all information from network traffic to and from the host

Limited visibility gives attackers more room to manipulate IDS monitoring. Attackers can also purposefully craft network traffic, making it difficult to infer or extrapolate its impact on hosts

Images