Collaborative detection method of network intrusion based on security cloud

Abstract

The invention discloses a network intrusion collaborative detection method based on a security cloud, and relates to the technical field of network security. ;Security Cloud generates the identification string of each intrusion detection node; the intrusion detection nodes transmit information in the main association mode after identifying the main association data; and the intrusion detection nodes switch the main association mode to the main association mode after identifying the standby association data. It transmits information in a correlated manner; NIDS retrieves the corresponding feature rule base from the security cloud according to the intrusion detection information for comprehensive detection. The invention has strong overall security performance, can realize flexible switching of the main and standby association modes, and ensure the normal operation of collaborative detection; when the intrusion detection node is expanded, the entire system does not need to be changed, the operation flexibility is strong, the transmission efficiency is high, and the security detection The timeliness of the initiation of emergency measures is strong.

Description

technical field [0001] The invention relates to the technical field of network security, and more particularly, to a network intrusion cooperative detection method based on a security cloud. Background technique [0002] Network intrusion detection system (NIDS) refers to the combination of software and hardware that detects behaviors that endanger the security of computer systems, such as collecting vulnerability information, denying access, and obtaining system control rights beyond the legal scope. Considered as the second security gate behind the firewall, NIDS improves network security by bypassing network traffic and providing real-time monitoring of internal attacks, external attacks and misoperations without affecting network performance sex. [0003] At present, NIDS generally works through a single-point detection method or a multi-level management method. Among them, the detection node of single-point detection is generally a single software and hardware system,...

AI Technical Summary

Problems solved by technology

[0004] However, for the multi-level management mode, when there is a fault in the transmission of information between each node, such as abnormal network instability, abnormality of the upper-level management node, and abnormality of the lower-level detection node, etc., the network intrusion detection within this range will not work normally. , the computer cannot be monitored safely during the maintenance process, and there are certain security loopholes

Images