Cooperative intrusion detection based large-scale network security defense system

Abstract

This invention discloses a large scale network safety protection system based on cooperative intrusion detection, in which, a parallel fire wall system is formed by applying an advanced parallel technology and a model based on trust to protect against DDOS attack effectively, the parallel IDS sub-system applies a technology combing parallel technology and the state detection technology. The flow detection subsystem has high identifying ability to un-rule data based on the artificial nerve network model to detect the known attack and discover new attack behavior. The subsystems of the parallel fire wall, IDS, flow detection and co-related analysis and alarm are independent and complete to each other in function to exchange detection information and transfer detection and protection rules by an information driven system. The control station manages the subsystems.

Description

technical field [0001] The invention belongs to the field of computer security, and in particular relates to a large-scale network security defense system based on cooperative intrusion detection. Background technique [0002] The security of computer network is an international issue, and the economic loss caused by the security of computer network in the world reaches tens of billions of dollars every year. According to statistics: hacker attacks have increased at a rate of 250% in the past 5 years, and 99% of large companies have experienced large intrusions. World-renowned commercial websites such as Yahoo, Buy, EBay, Amazon, and CNN have all been hacked, causing huge economic losses. Even RSA, which specializes in network security, has also been attacked by hackers. With the rapid development of informatization, the network security problem that our country is facing is becoming increasingly serious. In 2003, among the countries most frequently attacked by hackers, Ch...

AI Technical Summary

Problems solved by technology

[0004] 1) The attack lasts for a long time, and a single attack behavior is not obvious;

[0005] 2) The attack source is widely distributed and the attack is very harmful;

However, the current security products and solutions that use collaboration generally have the following deficiencies: First, the scale of collaboration is small, generally using the mode of firewall plus intrusion detection system; second, the degree of collaboration is low, and each security product is completely independent of each other , it cannot achieve real coordinated defense and intelligent interaction, at best it is a mutual superposition of functions

The third is that the scalability is not good, and there are performance bottlenecks, which cannot meet the requirements of complex analysis of massive data when detecting and defending large-scale coordinated intrusions

However, because the three levels of the system are not compatible with existing security products and technical solutions, to adopt this structure, security products must be redesigned according to the three levels of the system, which is obviously impossible to achieve, and each Security vendors will not want their products to be completely subject to any kind of platform and architecture

Images