CN103891206A - 网络数据流检测状态的同步方法和设备 - Google Patents

网络数据流检测状态的同步方法和设备 Download PDF

Info

Publication number
CN103891206A
CN103891206A CN201280021599.6A CN201280021599A CN103891206A CN 103891206 A CN103891206 A CN 103891206A CN 201280021599 A CN201280021599 A CN 201280021599A CN 103891206 A CN103891206 A CN 103891206A
Authority
CN
China
Prior art keywords
table item
safety means
state
flow table
flow
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201280021599.6A
Other languages
English (en)
Other versions
CN103891206B (zh
Inventor
王雨晨
张大成
孟健
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of CN103891206A publication Critical patent/CN103891206A/zh
Application granted granted Critical
Publication of CN103891206B publication Critical patent/CN103891206B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明实施例提供一种网络数据流检测状态的同步方法和设备。该方法包括：接收第一安全设备节点发送的第一请求，第一请求携带第一安全设备节点当前检测的第一数据流的第一流表项，流表项用于唯一地标识数据流；确定对应于第一流表项的第一网络数据流检测状态；向第一安全设备节点发送第一响应，第一响应携带第一网络数据流检测状态，以便第一安全设备节点根据第一响应维护第一安全设备节点上存储的对应于第一流表项的第二网络数据流检测状态。本发明实施例中，安全设备节点向状态同步服务器请求数据流先前的网络数据流检测状态，实现网络数据流检测状态的同步，从而使得安全设备节点能够更准确地检测网络攻击，提高网络系统的安全性。

Description

PCT国内申请，说明书已公开。

Claims (1)

  1. PCT国内申请，权利要求书已公开。
CN201280021599.6A 2012-10-12 2012-10-12 网络数据流检测状态的同步方法和设备 Active CN103891206B (zh)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2012/082882 WO2014056200A1 (zh) 2012-10-12 2012-10-12 网络数据流检测状态的同步方法和设备

Publications (2)

Publication Number Publication Date
CN103891206A true CN103891206A (zh) 2014-06-25
CN103891206B CN103891206B (zh) 2017-02-15

Family

ID=50476904

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201280021599.6A Active CN103891206B (zh) 2012-10-12 2012-10-12 网络数据流检测状态的同步方法和设备

Country Status (4)

Country Link
US (1) US9729560B2 (zh)
EP (1) EP2811691B1 (zh)
CN (1) CN103891206B (zh)
WO (1) WO2014056200A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106649352A (zh) * 2015-10-30 2017-05-10 北京国双科技有限公司 数据处理方法及装置
CN117097674A (zh) * 2023-10-20 2023-11-21 南京邮电大学 一种采样时间不敏感频率维度可配置的网络特征提取方法

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TW201605198A (zh) 2014-07-31 2016-02-01 萬國商業機器公司 智慧網路管理裝置以及管理網路的方法
US9497207B2 (en) * 2014-08-15 2016-11-15 International Business Machines Corporation Securing of software defined network controllers
CN105743687B (zh) * 2014-12-12 2020-01-10 中兴通讯股份有限公司 节点故障的判断方法及装置
CN104994091B (zh) * 2015-06-30 2018-04-27 东软集团股份有限公司 异常流量的检测方法及装置、防御Web攻击的方法和装置
KR102153926B1 (ko) * 2017-08-10 2020-09-10 한국전자통신연구원 네트워크 보안 강화 장치 및 그 방법
US10867044B2 (en) * 2018-05-30 2020-12-15 AppOmni, Inc. Automatic computer system change monitoring and security gap detection system
US11442766B1 (en) 2020-02-03 2022-09-13 Architecture Technology Corporation Systems and methods for open threat hunt
CN114584490B (zh) * 2022-03-25 2024-04-09 阿里巴巴（中国）有限公司 数据传输检测方法以及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030120816A1 (en) * 2001-12-21 2003-06-26 International Business Machines Corporation Method of synchronizing firewalls in a communication system based upon a server farm
CN1725702A (zh) * 2004-07-20 2006-01-25 联想网御科技(北京)有限公司 一种网络安全设备及其组成的实现高可用性的系统及方法
US20090249438A1 (en) * 2008-03-27 2009-10-01 Moshe Litvin Moving security for virtual machines
CN102025535A (zh) * 2010-11-17 2011-04-20 福建星网锐捷网络有限公司 虚拟机管理方法、装置及网络设备
CN102684944A (zh) * 2012-04-20 2012-09-19 北京启明星辰信息技术股份有限公司 入侵检测方法和装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101572691B (zh) * 2008-04-30 2013-10-02 华为技术有限公司 一种入侵检测方法、系统和装置
CN101616034B (zh) * 2008-06-25 2012-06-20 华为技术有限公司 终端安全状态的监控和更新方法及系统
CN101605132B (zh) * 2009-07-13 2012-07-04 深圳市深信服电子科技有限公司 一种网络数据流识别方法
US8549650B2 (en) * 2010-05-06 2013-10-01 Tenable Network Security, Inc. System and method for three-dimensional visualization of vulnerability and asset data
CN102739645B (zh) * 2012-04-23 2016-03-16 杭州华三通信技术有限公司 虚拟机安全策略的迁移方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030120816A1 (en) * 2001-12-21 2003-06-26 International Business Machines Corporation Method of synchronizing firewalls in a communication system based upon a server farm
CN1725702A (zh) * 2004-07-20 2006-01-25 联想网御科技(北京)有限公司 一种网络安全设备及其组成的实现高可用性的系统及方法
US20090249438A1 (en) * 2008-03-27 2009-10-01 Moshe Litvin Moving security for virtual machines
CN102025535A (zh) * 2010-11-17 2011-04-20 福建星网锐捷网络有限公司 虚拟机管理方法、装置及网络设备
CN102684944A (zh) * 2012-04-20 2012-09-19 北京启明星辰信息技术股份有限公司 入侵检测方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106649352A (zh) * 2015-10-30 2017-05-10 北京国双科技有限公司 数据处理方法及装置
CN106649352B (zh) * 2015-10-30 2020-03-03 北京国双科技有限公司 数据处理方法及装置
CN117097674A (zh) * 2023-10-20 2023-11-21 南京邮电大学 一种采样时间不敏感频率维度可配置的网络特征提取方法

Also Published As

Publication number Publication date
EP2811691B1 (en) 2016-09-14
EP2811691A4 (en) 2015-02-25
EP2811691A1 (en) 2014-12-10
US9729560B2 (en) 2017-08-08
WO2014056200A1 (zh) 2014-04-17
CN103891206B (zh) 2017-02-15
US20140380415A1 (en) 2014-12-25

Similar Documents

Publication Publication Date Title
CN103891206A (zh) 网络数据流检测状态的同步方法和设备
US11902120B2 (en) Synthetic data for determining health of a network security system
US10972388B2 (en) Federated microburst detection
CN107667505B (zh) 用于监控和管理数据中心的系统及方法
US8909758B2 (en) Physical server discovery and correlation
US10097572B1 (en) Security for network computing environment based on power consumption of network devices
US20180034847A1 (en) Regeneration and generational mutation for security and fidelity in software defined networks
CN103607399A (zh) 基于暗网的专用ip网络安全监测系统及方法
US8797876B2 (en) Identification of underutilized network devices
CN105634998A (zh) 针对多租户环境下物理机与虚拟机统一监控的方法及系统
WO2017114363A1 (zh) 报文处理方法、bng及bng集群系统
CN112929200B (zh) 一种面向sdn多控制器的异常检测方法
CN104506548A (zh) 一种数据包重定向装置、虚拟机安全保护方法及系统
Chaudhary et al. A comprehensive survey on software‐defined networking for smart communities
EP3905595B1 (en) Industrial control system monitoring method, device and system, and computer-readable medium
Lin et al. Security function virtualization based moving target defense of SDN-enabled smart grid
CN108833333B (zh) 一种基于dcs分布式控制的蜜罐系统
CN111585813B (zh) 一种物联网环境下网络节点的管理方法及系统
JP7228712B2 (ja) 異常ホストのモニタニング
RU2693903C1 (ru) Способ, устройство и система обработки для расширенного порта
JP5716107B1 (ja) ノード検出システム及び方法及び仮想ノードの機能制御装置及び方法
CN116582424B (zh) 交换机配置方法、装置、存储介质及电子设备
Chen et al. A Blockchain-Based Performance Monitoring Scheme for Network Function Virtualization in Space-Aerial-Terrestrial Integrated Networks
Fan et al. A Cyber Attack Situation Evaluating Method Based on Multi-Dimensional Features Analysis in SDNs
CN116938605A (zh) 网络攻击防护方法、装置、电子设备及可读存储介质

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant