CN105429987A - Security system for computer network - Google Patents

Security system for computer network Download PDF

Info

Publication number
CN105429987A
CN105429987A CN201510863182.XA CN201510863182A CN105429987A CN 105429987 A CN105429987 A CN 105429987A CN 201510863182 A CN201510863182 A CN 201510863182A CN 105429987 A CN105429987 A CN 105429987A
Authority
CN
China
Prior art keywords
module
network
data
main frame
security system
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201510863182.XA
Other languages
Chinese (zh)
Inventor
冯健
史丹丹
南天柱
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Xian University of Science and Technology
Original Assignee
Xian University of Science and Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Xian University of Science and Technology filed Critical Xian University of Science and Technology
Priority to CN201510863182.XA priority Critical patent/CN105429987A/en
Publication of CN105429987A publication Critical patent/CN105429987A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic

Abstract

The invention discloses a security system for a computer network. The security system comprises a host, a virtual switch, a core physical switch and a bypass firewall, wherein encryption modules are respectively arranged in the host and the virtual switch; an identity verification module is also arranged in the virtual switch; a key of each encryption module is updated once at each access; the security system further comprises a virus characteristic matching module, a port audit module, a traffic statistics module, a network anomaly assessment module, a virus isolation module, an emergency channel module, a restoration module and a data isolation uploading module, According to the security system, the network traffic is monitored and audited, so that the network is maintained in good condition; through analysis and memory of an unknown invasion behavior, the network immunocompetence is improved; the key is updated once at each access, so that the security of the network is further improved, and meanwhile, the system has data protection capability, so that a condition that a user is away from a computer to cause information loss is also avoided.

Description

A kind of safety system of computer network
Technical field
The present invention relates to computer network field, be specifically related to a kind of safety system of computer network.
Background technology
Along with the fast development of computer technology and network, computer is made to have become people's indispensable instrument in work, studying and living.Equally, the development of computer network, also bring the potential safety hazard of subscriber computer information, the network information is stolen, information attack, virus are propagated etc. exists all the time and occurs.
Network security is the key issue always studied in computer network and application thereof, but traditional network security theory and technology also exist following three defects that cannot overcome.First, central controlled method seems unable to do what one wishes for current distributed network environment; Secondly, network has homoorganicity, cannot stop suspected intruder and virus wide-scale distribution rapidly; Again, current network threatens makes rapid progress, and the nature static of legacy network safety theory and technology and passivity cannot adapt to badly changeable network environment.
Summary of the invention
For solving the problem, the invention provides a kind of safety system of computer network, carry out monitoring to network traffics and audit, maintaining network kilter, by to the analysis of unknown intrusion behavior and memory, improve network immunocompetence, effectively can control damaging range after invasion, guarantee a network connections and normally providing of serving, this system possesses independently repairs reducing power, the operation of maintaining network is stablized, and often accesses simultaneously and once namely upgrades a secondary key, further increase the safety of network.
For achieving the above object, the technical scheme that the present invention takes is:
A kind of Computer Network Security System, comprise main frame, virtual switch, core physical switches and bypass fire compartment wall, main frame is connected with virtual switch by Microsoft Loopback Adapter, virtual switch is connected with core physical switches by trunk passage, an output of core physical switches is connected with server by optical fiber, the other end is connected with the trust interface of bypass fire compartment wall by trunk passage, the untrust interface of described bypass fire compartment wall is crossed optical fiber and is connected with server, it is characterized in that, an encrypting module is respectively provided with in main frame and virtual switch, an authentication module is also provided with in virtual switch, after often once accessing, namely the key updating of an encrypting module is carried out,
Also comprise
Virus characteristic matching module, calculates the virus characteristic fingerprint of monitored main-machine communication packet, records comparison with in virus characteristic storehouse;
Port Audit Module, the key element choosing communication connection neutralization service relevant is comprehensively analyzed, for maintenance and research provide full and accurate report;
Traffic statistics module, raw data packets header information is utilized to carry out traffic statistics, traffic statistics are carried out in units of each connection that main frame is external, by extracting communicating pair IP and the computing of port numbers characteristic information participation hash function, hash-collision is solved with the algorithm of step-length multiplication, and the integrated flow connected belonging to upgrading with the message length field value in packet header;
Network Abnormal evaluation module, sets up polymorphic response to network anomaly assessment model, choosing tool characteristic parameter when network attack occurs and carries out quantification investigation, providing different response and treatment advice to threatening in various degree;
Virus isolation module, utilizes analog service and the main-machine communication producing abnormal flow, extracting attack fingerprint characteristic, enriches virus characteristic storehouse;
Escape truck module, being captured the user of main frame for pointing out, operational environment being adjourned to escape truck and works on, need not interruption of work process safety problem;
Recovery module, when leaving computer for finishing the work until user, sent to the designated mobile phone of user by short message editor module, thus prompting user there is potential safety hazard and provide the accurate recovery time suggestion, and help user select that computer is returned to invasion before safe condition;
Data, for the assessment result drawn according to Network Abnormal evaluation module, are carried out packing and are uploaded by transmission module in data isolation, and the data in dump.
Wherein, the step of described encrypting module encryption comprises:
The parameter that S1, initialization run in developing, utilize self feed back mapping function to carry out initialization to population in evolution, stochastic generation contains the initial population of some individualities;
S2, to calculate in current population for checking the frequency adaptive value of each individual frequency and for checking the sequence adaptive value of each individual sequence;
S3, contrast the adaptive value of each individuality and its place other individualities of population, calculate the order of each individuality in current population;
S4, according to rank value, descending is carried out to the individuality in population after, carry out random sampling, and divided by the system number of key, obtain quotient and remainder;
S5, will calculate obtain quotient as current be-encrypted data, and continue perform step S1, until calculate obtain quotient be zero;
Extraction operation rule in S6, use key selects a specific plaintext section;
S7, using calculate at every turn acquisition remainder arrangement and specific plaintext section as encrypted sequence of data.
Wherein, describedly also comprising a virus characteristic storehouse, for storing the special data of various virus, being connected with a update module, upgrade the data in virus characteristic storehouse for timing.
Wherein, described viral isolation module comprises
Virtual responder module, by providing virtual response and providing corresponding Virtual Service, makes opponent continue to attack to obtain attack traffic;
Analog service module, by performing analog service script, the main frame being redirected to immune isolation unit with flow carries out alternately, the reciprocal process of simulation normal service, makes threat main frame continue to attack;
Attack is put on record module, and record security isolation module and having threatens the communication information between main frame and write into Databasce, and the described communication information comprises call duration time, the IP of communicating pair and port information and assailant's operation system fingerprint information;
Data-mining module, when to arrive the flow of immune isolation unit if assert be dangerous flow, system intelligence extracting attack fingerprint characteristic by described feature stored in immune characteristic storehouse.
The present invention has following beneficial effect:
Carry out monitoring to network traffics and audit; maintaining network kilter; by to the analysis of unknown intrusion behavior and memory; improve network immunocompetence; effectively damaging range can be controlled after invasion; guarantee a network connections and normally providing of serving; this system possesses independently repairs reducing power; the operation of maintaining network is stablized; often access simultaneously and once namely upgrade a secondary key; further increase the safety of network, possess data protection ability simultaneously, it also avoid the generation of the situation not causing information dropout due to user before computer.
Accompanying drawing explanation
Fig. 1 is the structural representation of the safety system of a kind of computer network of the embodiment of the present invention.
Embodiment
In order to make objects and advantages of the present invention clearly understand, below in conjunction with embodiment, the present invention is further elaborated.Should be appreciated that specific embodiment described herein only in order to explain the present invention, be not intended to limit the present invention.
As shown in Figure 1, embodiments provide a kind of Computer Network Security System, comprise main frame, virtual switch, core physical switches and bypass fire compartment wall, main frame is connected with virtual switch by Microsoft Loopback Adapter, virtual switch is connected with core physical switches by trunk passage, an output of core physical switches is connected with server by optical fiber, the other end is connected with the trust interface of bypass fire compartment wall by trunk passage, the untrust interface of described bypass fire compartment wall is crossed optical fiber and is connected with server, an encrypting module is respectively provided with in main frame and virtual switch, an authentication module is also provided with in virtual switch, after often once accessing, namely the key updating of an encrypting module is carried out,
Also comprise
Virus characteristic matching module, calculates the virus characteristic fingerprint of monitored main-machine communication packet, records comparison with in virus characteristic storehouse;
Port Audit Module, the key element choosing communication connection neutralization service relevant is comprehensively analyzed, for maintenance and research provide full and accurate report;
Traffic statistics module, raw data packets header information is utilized to carry out traffic statistics, traffic statistics are carried out in units of each connection that main frame is external, by extracting communicating pair IP and the computing of port numbers characteristic information participation hash function, hash-collision is solved with the algorithm of step-length multiplication, and the integrated flow connected belonging to upgrading with the message length field value in packet header;
Network Abnormal evaluation module, sets up polymorphic response to network anomaly assessment model, choosing tool characteristic parameter when network attack occurs and carries out quantification investigation, providing different response and treatment advice to threatening in various degree;
Virus isolation module, utilizes analog service and the main-machine communication producing abnormal flow, extracting attack fingerprint characteristic, enriches virus characteristic storehouse;
Escape truck module, being captured the user of main frame for pointing out, operational environment being adjourned to escape truck and works on, need not interruption of work process safety problem;
Recovery module, when leaving computer for finishing the work until user, sent to the designated mobile phone of user by short message editor module, thus prompting user there is potential safety hazard and provide the accurate recovery time suggestion, and help user select that computer is returned to invasion before safe condition;
Data, for the assessment result drawn according to Network Abnormal evaluation module, are carried out packing and are uploaded by transmission module in data isolation, and the data in dump.
The step of described encrypting module encryption comprises:
The parameter that S1, initialization run in developing, utilize self feed back mapping function to carry out initialization to population in evolution, stochastic generation contains the initial population of some individualities;
S2, to calculate in current population for checking the frequency adaptive value of each individual frequency and for checking the sequence adaptive value of each individual sequence;
S3, contrast the adaptive value of each individuality and its place other individualities of population, calculate the order of each individuality in current population;
S4, according to rank value, descending is carried out to the individuality in population after, carry out random sampling, and divided by the system number of key, obtain quotient and remainder;
S5, will calculate obtain quotient as current be-encrypted data, and continue perform step S1, until calculate obtain quotient be zero;
Extraction operation rule in S6, use key selects a specific plaintext section;
S7, using calculate at every turn acquisition remainder arrangement and specific plaintext section as encrypted sequence of data.
Describedly also comprising a virus characteristic storehouse, for storing the special data of various virus, being connected with a update module, upgrade the data in virus characteristic storehouse for timing.
Described viral isolation module comprises
Virtual responder module, by providing virtual response and providing corresponding Virtual Service, makes opponent continue to attack to obtain attack traffic;
Analog service module, by performing analog service script, the main frame being redirected to immune isolation unit with flow carries out alternately, the reciprocal process of simulation normal service, makes threat main frame continue to attack;
Attack is put on record module, and record security isolation module and having threatens the communication information between main frame and write into Databasce, and the described communication information comprises call duration time, the IP of communicating pair and port information and assailant's operation system fingerprint information;
Data-mining module, when to arrive the flow of immune isolation unit if assert be dangerous flow, system intelligence extracting attack fingerprint characteristic by described feature stored in immune characteristic storehouse.
The trust interface of described bypass fire compartment wall and untrust interface divide vlan sub-interface by 802.1Q agreement, be divided into the VLAN passage of each self-isolation, Visitor Logs adopts data link table form to store, when without memory space, the Visitor Logs that preferential deletion is old, before access, first virtual switch is retrieved the Visitor Logs stored, according to historical record determination access privileges, access privileges is that the priority of high access is higher than few visit capacity.
The above is only the preferred embodiment of the present invention; it should be pointed out that for those skilled in the art, under the premise without departing from the principles of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.

Claims (4)

1. a Computer Network Security System, comprise main frame, virtual switch, core physical switches and bypass fire compartment wall, main frame is connected with virtual switch by Microsoft Loopback Adapter, virtual switch is connected with core physical switches by trunk passage, an output of core physical switches is connected with server by optical fiber, the other end is connected with the trust interface of bypass fire compartment wall by trunk passage, the untrust interface of described bypass fire compartment wall is crossed optical fiber and is connected with server, it is characterized in that, an encrypting module is respectively provided with in main frame and virtual switch, an authentication module is also provided with in virtual switch, after often once accessing, namely the key updating of an encrypting module is carried out,
Also comprise
Virus characteristic matching module, calculates the virus characteristic fingerprint of monitored main-machine communication packet, records comparison with in virus characteristic storehouse;
Port Audit Module, the key element choosing communication connection neutralization service relevant is comprehensively analyzed, for maintenance and research provide full and accurate report;
Traffic statistics module, raw data packets header information is utilized to carry out traffic statistics, traffic statistics are carried out in units of each connection that main frame is external, by extracting communicating pair IP and the computing of port numbers characteristic information participation hash function, hash-collision is solved with the algorithm of step-length multiplication, and the integrated flow connected belonging to upgrading with the message length field value in packet header;
Network Abnormal evaluation module, sets up polymorphic response to network anomaly assessment model, choosing tool characteristic parameter when network attack occurs and carries out quantification investigation, providing different response and treatment advice to threatening in various degree;
Virus isolation module, utilizes analog service and the main-machine communication producing abnormal flow, extracting attack fingerprint characteristic, enriches virus characteristic storehouse;
Escape truck module, being captured the user of main frame for pointing out, operational environment being adjourned to escape truck and works on, need not interruption of work process safety problem;
Recovery module, when leaving computer for finishing the work until user, sent to the designated mobile phone of user by short message editor module, thus prompting user there is potential safety hazard and provide the accurate recovery time suggestion, and help user select that computer is returned to invasion before safe condition;
Data, for the assessment result drawn according to Network Abnormal evaluation module, are carried out packing and are uploaded by transmission module in data isolation, and the data in dump.
2. a kind of Computer Network Security System according to claim 1, is characterized in that, the step of described encrypting module encryption comprises:
The parameter that S1, initialization run in developing, utilize self feed back mapping function to carry out initialization to population in evolution, stochastic generation contains the initial population of some individualities;
S2, to calculate in current population for checking the frequency adaptive value of each individual frequency and for checking the sequence adaptive value of each individual sequence;
S3, contrast the adaptive value of each individuality and its place other individualities of population, calculate the order of each individuality in current population;
S4, according to rank value, descending is carried out to the individuality in population after, carry out random sampling, and divided by the system number of key, obtain quotient and remainder;
S5, will calculate obtain quotient as current be-encrypted data, and continue perform step S1, until calculate obtain quotient be zero;
Extraction operation rule in S6, use key selects a specific plaintext section;
S7, using calculate at every turn acquisition remainder arrangement and specific plaintext section as encrypted sequence of data.
3. a kind of Computer Network Security System according to claim 1, is characterized in that, describedly also comprises a virus characteristic storehouse, for storing the special data of various virus, is connected with a update module, upgrades the data in virus characteristic storehouse for timing.
4. a kind of Computer Network Security System according to claim 1, is characterized in that, described viral isolation module comprises
Virtual responder module, by providing virtual response and providing corresponding Virtual Service, makes opponent continue to attack to obtain attack traffic;
Analog service module, by performing analog service script, the main frame being redirected to immune isolation unit with flow carries out alternately, the reciprocal process of simulation normal service, makes threat main frame continue to attack;
Attack is put on record module, and record security isolation module and having threatens the communication information between main frame and write into Databasce, and the described communication information comprises call duration time, the IP of communicating pair and port information and assailant's operation system fingerprint information;
Data-mining module, when to arrive the flow of immune isolation unit if assert be dangerous flow, system intelligence extracting attack fingerprint characteristic by described feature stored in immune characteristic storehouse.
CN201510863182.XA 2015-11-25 2015-11-25 Security system for computer network Pending CN105429987A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201510863182.XA CN105429987A (en) 2015-11-25 2015-11-25 Security system for computer network

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201510863182.XA CN105429987A (en) 2015-11-25 2015-11-25 Security system for computer network

Publications (1)

Publication Number Publication Date
CN105429987A true CN105429987A (en) 2016-03-23

Family

ID=55507929

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201510863182.XA Pending CN105429987A (en) 2015-11-25 2015-11-25 Security system for computer network

Country Status (1)

Country Link
CN (1) CN105429987A (en)

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105847296A (en) * 2016-05-19 2016-08-10 拖洪华 Network security isolation device
CN105847291A (en) * 2016-05-13 2016-08-10 内蒙古工业大学 Computer network defense decision system
CN105930264A (en) * 2016-04-03 2016-09-07 郑州升达经贸管理学院 Computer software performance test method
CN105956428A (en) * 2016-04-14 2016-09-21 广东轻工职业技术学院 Computer auxiliary detection system
CN106022039A (en) * 2016-05-14 2016-10-12 东北电力大学 Secure storage system and storage method of electronic information
CN106027495A (en) * 2016-04-24 2016-10-12 蚌埠学院 Multi-network selection type computer network monitor
CN106503524A (en) * 2016-10-31 2017-03-15 辽东学院 A kind of computer network security guard system
CN106850593A (en) * 2017-01-14 2017-06-13 河南工程学院 A kind of computer network security guard system
CN106936829A (en) * 2017-03-04 2017-07-07 平顶山学院 A kind of security system of computer network
CN107493300A (en) * 2017-09-20 2017-12-19 河北师范大学 Network security protection system
CN109450892A (en) * 2018-11-05 2019-03-08 日照职业技术学院 A kind of computer network detection method
CN109492397A (en) * 2018-11-15 2019-03-19 平顶山工业职业技术学院(平顶山煤矿技工学校) A kind of computer information safe system
CN109743282A (en) * 2018-11-21 2019-05-10 北京奇安信科技有限公司 A kind of high-risk security risk recognition methods and device based on industry control agreement
CN109962881A (en) * 2017-12-22 2019-07-02 北京安天网络安全技术有限公司 Intrusion detection method, device and system based on industrial control system
CN110990900A (en) * 2019-12-24 2020-04-10 南通理工学院 Computer network intelligent monitoring system
CN111966458A (en) * 2020-08-10 2020-11-20 国网四川省电力公司信息通信公司 Safety management method of virtual cloud desktop
CN113038035A (en) * 2020-10-29 2021-06-25 中国农业银行股份有限公司福建省分行 AI video point counting method for live pig breeding
CN114465963A (en) * 2021-12-24 2022-05-10 北京环宇博亚科技有限公司 Switch abnormity detection method and device, electronic equipment and computer readable medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6973577B1 (en) * 2000-05-26 2005-12-06 Mcafee, Inc. System and method for dynamically detecting computer viruses through associative behavioral analysis of runtime state
CN103227798A (en) * 2013-04-23 2013-07-31 西安电子科技大学 Immunological network system
CN103888250A (en) * 2014-03-24 2014-06-25 华南农业大学 Secret key sequence generating method based on self-feedback evolution sequence
CN104113527A (en) * 2014-06-19 2014-10-22 上海地面通信息网络有限公司 Waf firewall configuration applied to cloud computing network
CN104580087A (en) * 2013-10-21 2015-04-29 宁夏新航信息科技有限公司 Immune network system

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6973577B1 (en) * 2000-05-26 2005-12-06 Mcafee, Inc. System and method for dynamically detecting computer viruses through associative behavioral analysis of runtime state
CN103227798A (en) * 2013-04-23 2013-07-31 西安电子科技大学 Immunological network system
CN104580087A (en) * 2013-10-21 2015-04-29 宁夏新航信息科技有限公司 Immune network system
CN103888250A (en) * 2014-03-24 2014-06-25 华南农业大学 Secret key sequence generating method based on self-feedback evolution sequence
CN104113527A (en) * 2014-06-19 2014-10-22 上海地面通信息网络有限公司 Waf firewall configuration applied to cloud computing network

Cited By (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105930264A (en) * 2016-04-03 2016-09-07 郑州升达经贸管理学院 Computer software performance test method
CN105956428A (en) * 2016-04-14 2016-09-21 广东轻工职业技术学院 Computer auxiliary detection system
CN106027495A (en) * 2016-04-24 2016-10-12 蚌埠学院 Multi-network selection type computer network monitor
CN105847291A (en) * 2016-05-13 2016-08-10 内蒙古工业大学 Computer network defense decision system
CN106022039A (en) * 2016-05-14 2016-10-12 东北电力大学 Secure storage system and storage method of electronic information
CN105847296A (en) * 2016-05-19 2016-08-10 拖洪华 Network security isolation device
CN106503524A (en) * 2016-10-31 2017-03-15 辽东学院 A kind of computer network security guard system
CN106503524B (en) * 2016-10-31 2019-03-15 辽东学院 A kind of computer network security guard system
CN106850593A (en) * 2017-01-14 2017-06-13 河南工程学院 A kind of computer network security guard system
CN106936829A (en) * 2017-03-04 2017-07-07 平顶山学院 A kind of security system of computer network
CN107493300A (en) * 2017-09-20 2017-12-19 河北师范大学 Network security protection system
CN109962881A (en) * 2017-12-22 2019-07-02 北京安天网络安全技术有限公司 Intrusion detection method, device and system based on industrial control system
CN109450892A (en) * 2018-11-05 2019-03-08 日照职业技术学院 A kind of computer network detection method
CN109492397A (en) * 2018-11-15 2019-03-19 平顶山工业职业技术学院(平顶山煤矿技工学校) A kind of computer information safe system
CN109743282A (en) * 2018-11-21 2019-05-10 北京奇安信科技有限公司 A kind of high-risk security risk recognition methods and device based on industry control agreement
CN109743282B (en) * 2018-11-21 2022-04-26 奇安信科技集团股份有限公司 Industrial control protocol-based high-risk safety risk identification method and device
CN110990900A (en) * 2019-12-24 2020-04-10 南通理工学院 Computer network intelligent monitoring system
CN111966458A (en) * 2020-08-10 2020-11-20 国网四川省电力公司信息通信公司 Safety management method of virtual cloud desktop
CN113038035A (en) * 2020-10-29 2021-06-25 中国农业银行股份有限公司福建省分行 AI video point counting method for live pig breeding
CN113038035B (en) * 2020-10-29 2022-05-17 中国农业银行股份有限公司福建省分行 AI video point counting method for live pig breeding
CN114465963A (en) * 2021-12-24 2022-05-10 北京环宇博亚科技有限公司 Switch abnormity detection method and device, electronic equipment and computer readable medium

Similar Documents

Publication Publication Date Title
CN105429987A (en) Security system for computer network
US20210168175A1 (en) Ai-driven defensive cybersecurity strategy analysis and recommendation system
US11568042B2 (en) System and methods for sandboxed malware analysis and automated patch development, deployment and validation
US20220078210A1 (en) System and method for collaborative cybersecurity defensive strategy analysis utilizing virtual network spaces
US10609079B2 (en) Application of advanced cybersecurity threat mitigation to rogue devices, privilege escalation, and risk-based vulnerability and patch management
US10735456B2 (en) Advanced cybersecurity threat mitigation using behavioral and deep analytics
US11032323B2 (en) Parametric analysis of integrated operational technology systems and information technology systems
CN107659543B (en) Protection method for APT (android packet) attack of cloud platform
CN106375331B (en) Attack organization mining method and device
CN105471875A (en) Computer network monitoring system
CN107637041A (en) The overview of the acquistion of malice refined net flow identification
CN108959966A (en) Cloud platform auditing system based on big data administrative analysis
CN107347047A (en) Attack guarding method and device
KR102202473B1 (en) Systems and methods for dynamic data storage
CN111786950A (en) Situation awareness-based network security monitoring method, device, equipment and medium
CN105743880A (en) Data analysis system
CN108293044A (en) System and method for detecting malware infection via domain name service flow analysis
CN111200575B (en) Machine learning-based identification method for malicious behaviors of information system
WO2021216163A2 (en) Ai-driven defensive cybersecurity strategy analysis and recommendation system
CN110493207A (en) A kind of data processing method, device, electronic equipment and storage medium
CN106027495A (en) Multi-network selection type computer network monitor
CN110519052A (en) Data interactive method and device based on Internet of Things operating system
Khan et al. Towards an applicability of current network forensics for cloud networks: A SWOT analysis
CN114584359B (en) Security trapping method, device and computer equipment
CN113518042A (en) Data processing method, device, equipment and storage medium

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20160323

RJ01 Rejection of invention patent application after publication