Situation awareness virtual link defense method, device and system

Abstract

The invention provides a situation awareness virtual link defense method, device and system, and relates to the technical field of network security. The defense method comprises the following steps of: collecting log information of a network node, and sending the log information to a situation awareness system; when the network node is detected to be subjected to network attack, setting a virtual node for the network node; establishing a virtual link consisting of the network node, the virtual node and an associated network node of the network node; when the number of the virtual nodes or the associated network nodes is multiple, establishing a plurality of virtual links among the network node, the virtual nodes and the associated network nodes in a link shunting, link aggregation and / or link isolation mode; and storing the data information of the network node into the virtual node, and sending the data information to the situation awareness system for security analysis. According to the situation awareness virtual link defense method, device and system, the virtual links are established by using the virtual nodes, the communication path of the data information is changed, an attacker is prevented from stealing private data, and the data security is guaranteed.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to situation-aware virtual link defense. Background technique [0002] Network situational awareness aims to acquire, understand, display and predict the latest development trend of security elements that can cause changes in the network situation in a large-scale network environment, so as to make decisions and actions. [0003] The existing technology is very cunning to attack nodes. After breaking through a host, the attacker uses this host as a base to further attack other hosts. The attack methods are also various, such as using network monitoring methods to break through other host, or attack other hosts through IP spoofing and host trust relationships. [0004] The attack method of this type of network attack is mainly achieved by an attacker disguising an external computer as another legitimate machine. Its purpose is to trick other machines in the network into mi...

AI Technical Summary

Problems solved by technology

[0003] The existing technology is very cunning to attack nodes. After breaking through a host, the attacker uses this host as a base to further attack other hosts. The attack methods are also various, such as using network monitoring methods to break through other host, or through IP spoofing and host trust relationships to attack other hosts

Images