Disclosure of Invention
The present invention is directed to a computer network security system based on virtualization technology, which analyzes external operation information to isolate and process dangerous information before entering into virtualization, so as to solve the problems set forth in the background art.
In order to achieve the above purpose, the present invention provides the following technical solutions: a computer network security system based on a virtualization technology comprises a computer system, wherein the computer system comprises a virtual machine and a host, and also comprises a virtual security system for protecting the computer system;
the virtual security system includes: the system comprises a communication layer, an identification layer, a defense layer, an isolation layer, a transfer layer, a virtual layer and an AI layer;
the communication layer is connected with an external terminal needing to access computer system resources;
the identification layer is connected with the communication layer and used for identifying external terminal information and data information sent by the external terminal information;
the defense layer is connected with the identification layer, plays a role in isolation, and prevents harmful data information from entering the computer system;
the isolation layer is connected with the defense layer and used for blocking and isolating the data information which passes through the defense layer;
the transfer layer is connected with the isolation layer and transfers the data information in the isolation layer to the virtual layer for processing;
the AI layer is respectively connected with the identification layer, the defense layer, the isolation layer and the transfer layer;
the host is connected with the transfer layer through a virtual machine.
Preferably, the AI layer includes a deep learning convolution layer, a model library, and a connection module, where the deep learning convolution layer is connected to the model library and the connection module, and the connection module is connected to the identification layer, the defense layer, the isolation layer, and the transfer layer.
Preferably, an identification model, a defense model, an isolation model and a transfer model are arranged in the model library.
Preferably, the identification model comprises a terminal characteristic acquisition module, a terminal characteristic identification module, a data information characteristic scanning module and a data information characteristic processing module, wherein the terminal characteristic module is connected with the terminal characteristic identification module, and the terminal characteristic identification module and the data information characteristic scanning module are connected with the data information characteristic processing module.
Preferably, the defending model comprises an identification module, a blocking module and a packaging processing module, wherein the identification module and the blocking module are respectively connected with the packaging processing module.
Preferably, the isolation model comprises a second identification module, an isolation module, a classification module, a secondary packaging module and an independent output module, wherein the second identification module is connected with the isolation module, and the independent output module is connected with the classification module.
Preferably, the transfer model comprises a third identification module, a second blocking module and a transfer module, and the third identification module is connected with the second blocking module and the transfer module respectively.
Preferably, the deep learning convolution layer trains the recognition model, the defense model, the isolation model and the transfer model through a preset algorithm.
Compared with the prior art, the invention has the beneficial effects that:
1. according to the invention, the identification layer, the defense layer, the isolation layer and the transfer layer are arranged to process and block the dangerous data for many times, so that the dangerous data can be effectively prevented from entering the virtual machine, and the virtual machine is damaged;
2. the invention is provided with the AI layer at the same time, trains the model through the deep learning convolution layer, makes the model more accurate and perfect, and simultaneously can avoid the damage to the model by independently arranging the model in the AI layer instead of respectively storing the model in the corresponding identification layer, the defense layer, the isolation layer and the transfer layer, and can not effectively defend and process the model.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
In the description of the present invention, it should be noted that, unless explicitly specified and limited otherwise, the terms "mounted," "configured to," "engaged with," "connected to," and the like are to be construed broadly, and may be either fixedly connected, detachably connected, or integrally connected, for example; can be mechanically or electrically connected; can be directly connected or indirectly connected through an intermediate medium, and can be communication between two elements. The specific meaning of the above terms in the present invention will be understood in specific cases by those of ordinary skill in the art.
Referring to fig. 1-2, the present invention provides a technical solution: a computer network security system based on a virtualization technology comprises a virtual machine 2 and a host 3, and also comprises a virtual security system 1 for protecting the virtual machine 2 and the host 3;
the virtual security system 1 includes: communication layer 11, identification layer 12, defense layer 13, isolation layer 14, transfer layer 15, virtual layer 16 and AI layer 17;
the communication layer 11 is connected with an external terminal needing to access computer system resources;
an identification layer 12 connected to the communication layer 11 for identifying external terminal information and data information transmitted by the external terminal information;
the defending layer 13 is connected with the identification layer 12 and plays a role in isolation, so that harmful data information is prevented from entering the computer system;
an isolation layer 14 connected to the defense layer 13 for blocking and isolating data information having passed through the defense layer 13;
a transfer layer 15 connected to the isolation layer 14 for transferring the data information in the isolation layer 14 to the virtual layer 16 for processing;
an AI layer 17 connected to the identification layer 12, the defense layer 13, the isolation layer 14, and the transfer layer 15, respectively;
the host 3 is connected to the transfer layer 15 via the virtual machine 2.
The AI layer 17 includes a deep learning convolution layer 171, a model library 172, and a connection module 173, the deep learning convolution layer 171 being connected to the model library 172 and the connection module 173, respectively, the connection module 173 being connected to the identification layer 12, the defense layer 13, the isolation layer 14, and the transfer layer 15.
An identification model 1721, a defense model 1722, an isolation model 1723, and a transfer model 1724 are provided in the model library 172.
The identification model 1721 includes a terminal feature acquisition module 17211, a terminal feature identification module 17212, a data information feature scanning module 17213, and a data information feature processing module 17214, where the terminal feature acquisition module 17211 is connected to the terminal feature identification module 17212, the terminal feature identification module 17212 and the data information feature scanning module 17213 are connected to the data information feature processing module 17214, the terminal feature acquisition module 17211 acquires external terminal information, the terminal feature identification module 17212 identifies the type of the acquired terminal, the data information feature scanning module 17213 scans the data information feature, and the data information feature processing module 17214 analyzes the feature of the data information and simultaneously performs a marking process on information such as the terminal and operation data of the access system.
The defense model 1722 includes an identification module 17221, a blocking module 17222, and a packaging process module 17223, and the identification module 17221 and the blocking module 17222 are respectively connected to the packaging process module 17223.
Isolation model 1723 includes a second identification module 17231, an isolation module 17232, a classification module 17233, a secondary packaging module 17234, and an independent output module 17235, where second identification module 17231 is connected to classification module 17233, secondary packaging module 17234, and isolation module 17232, and independent output module 17235 is connected to classification module 17233.
The transfer model 1724 includes a third identification module 17241, a second blocking module 17242, and a transfer module 17243, where the third identification module 17241 is connected to the second blocking module 17242 and the transfer module 17243, respectively.
The deep learning convolution layer 171 trains the recognition model 1721, the defense model 1722, the isolation model 1723, and the transfer model 1724 by a preset algorithm.
Working principle: the access data of the external terminal input through the communication layer 11 invokes the recognition model 1721 in the AI layer 17 through the connection module 173, recognizes the basic information and the access instruction information of the access terminal, judges whether the access terminal and the access instruction information are safe or not, and if the information has a safety risk or is attack information, transmits the information to the defense layer 13 for processing; the defense layer 13 calls the defense model 1722 to identify the information entering from the identification layer 12, and if the information is attack information, the start blocking module 17222 blocks the information of the identification layer 12 from entering into the defense layer 13, and meanwhile encapsulates the entering harmful information; the isolation layer 14 identifies the information input from the defense layer 13 by calling the isolation model 172, if the information is unsafe, the information is identified by the identification module II 17231, meanwhile, dangerous data and safe data are isolated by the isolation module 17232, so that the dangerous data cannot be transmitted to the next layer, the packaged dangerous data and the unpackaged dangerous data are identified by the classification module 17233, the unpackaged dangerous data which enter the isolation layer 14 are secondarily packaged by the secondary packaging module 17234, and the unpackaged dangerous data are input to the transfer layer 15 by the independent output module 17235; the transfer layer 15 calls the transfer model 1724 to process the data input from the isolation layer 14, recognizes whether the data is dangerous information through the recognition module III 17241, starts the blocking module II 17242 to block the dangerous information from penetrating into the virtual machine 2 if the data is dangerous information, transfers the packaged information into the virtual layer 16 through the transfer module 17243 to perform killing processing, feeds back warning information and counterattack information to the communication layer 11, and the communication layer 11 transmits the information to a terminal for attack to warn the terminal and paralysis; by arranging the identification layer 12, the defense layer 13, the isolation layer 14 and the transfer layer 15, the data are processed and blocked for many times, so that dangerous data can be effectively prevented from entering the virtual machine 2, and the virtual machine 2 is damaged.
It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus.
Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made therein without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.