Network intrusion cooperative detection method based on security cloud

Abstract

The invention discloses a network intrusion cooperative detection method based on security cloud, which relates to the technical field of network security, and is characterized by comprising the following steps: establishing a network system topological structure in multistage distribution; the NIDS transmitting the topological structure of the network system to the security cloud for registration authorization; the security cloud generating an identification character string of each intrusion detection node; information being transmitted between the intrusion detection nodes in a main association mode after main association data is identified; after identifying the standby association data, the intrusion detection nodes transmitting information by switching the main association mode into the standby association mode; and the NIDS calling a corresponding feature rule base from the security cloud for comprehensive detection according to the intrusion detection information. The overall safety performance is high, flexible switching of main and standby association modes can be achieved, and normal operation of cooperative detection is guaranteed; when the intrusion detection node is expanded, the whole system does not need to be changed, the operation flexibility is high, the transmission efficiency is high, and the timeliness of safety detection and emergency measure starting is high.

Description

technical field [0001] The invention relates to the technical field of network security, more specifically, it relates to a network intrusion collaborative detection method based on a security cloud. Background technique [0002] A network intrusion detection system (NIDS) refers to a combination of software and hardware that detects behaviors that endanger computer system security, such as collecting vulnerability information, denying access, and obtaining system control beyond the legal scope. Considered as the second security gate behind the firewall, NIDS provides real-time monitoring of internal attacks, external attacks and misoperations without affecting network performance by bypassing network traffic, thereby improving network security sex. [0003] At present, NIDS generally work through a single-point detection method or a multi-level management method. Among them, the detection node of single-point detection is generally a single software and hardware system, a...

AI Technical Summary

Problems solved by technology

[0004] However, for the multi-level management mode, when there is a fault in the transmission of information between each node, such as abnormal network instability, abnormality of the upper-level management node, and abnormality of the lower-level detection node, etc., the network intrusion detection within this range will not work normally. , the computer cannot be monitored safely during the maintenance process, and there are certain security loopholes

Images