WO2018095098A1 - 网络安全防护方法和装置 - Google Patents

网络安全防护方法和装置 Download PDF

Info

Publication number
WO2018095098A1
WO2018095098A1 PCT/CN2017/099868 CN2017099868W WO2018095098A1 WO 2018095098 A1 WO2018095098 A1 WO 2018095098A1 CN 2017099868 W CN2017099868 W CN 2017099868W WO 2018095098 A1 WO2018095098 A1 WO 2018095098A1
Authority
WO
WIPO (PCT)
Prior art keywords
defense
node controller
detection
rules
management control
Prior art date
Application number
PCT/CN2017/099868
Other languages
English (en)
French (fr)
Inventor
高毅
杨松
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018095098A1 publication Critical patent/WO2018095098A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • the embodiments of the present invention relate to the Internet technology, and in particular, to a network security protection method and apparatus.
  • FIG 1 is a schematic diagram of a conventional network security protection system.
  • IDS International: Intrusion Detection Systems
  • IPS Intrusion Prevention System
  • WAF Web Application Firewall
  • HIPS Host-based Intrusion Prevention System
  • the single defense of each defense system cannot effectively communicate with the upper layer or the adjacent defense system, and the detection feature cannot be updated in time to perform the defense interception action.
  • the defense pressure of the other defense system is greatly increased, and the infinite amplification of the attack traffic is likely to cause multiple single-node defense systems to fail, and the tenant faces a great security threat.
  • the present invention provides a network security protection method and device for solving a single defense of each defense system, which cannot effectively communicate with an upper layer or an adjacent defense system, and cannot timely update the detection feature to perform a defense interception action, and the network attack breaks through a single point.
  • the defense pressure of the other defense system is greatly increased, and the infinite amplification of the attack traffic is likely to cause multiple single-node defense systems to fail, and the tenant faces a large security threat.
  • the first aspect of the present application provides a network security protection method, which is applied to a first node controller, where the first node controller is connected to multiple defense systems; and the method includes:
  • At least one second defense system Sending detection and defense rules to at least one second defense system, so that at least one second defense system detects and intercepts network attacks according to detection and defense rules; wherein the second defense system is a defense system connected to the first node controller .
  • the network security protection method provided by the foregoing solution sets the node controller to connect multiple defense systems, and each defense system can send the characteristic data of the detected attack to the node controller, and the node controller generates detection and defense rules and separately sends the same to the node controller.
  • the node controller manages multiple defense systems to implement detection and defense of multiple defense systems at the same time, improve intrusion detection and defense capabilities, effectively reduce the defense pressure of a single defense system, and avoid a single defense system. Limitations, and data sharing between defense systems, can build a comprehensive secure data center.
  • the at least one second defense system is at least one defense system that performs detection defense before the first defense system.
  • At least one second defense system includes a first defense system.
  • the at least one second defense system is at least one defense system that performs detection defense after the first defense system.
  • new detection and defense rules are established based on the feature data, including:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception strategy corresponding to the attack feature is customized, and detection and defense rules are obtained.
  • the method further includes:
  • the management control system determines the network attack feature according to the feature data, and establishes new detection and defense rules according to the network attack feature, and sends the detection and defense rules to the management control system management.
  • the management control system determines the network attack feature according to the feature data, and establishes new detection and defense rules according to the network attack feature, and sends the detection and defense rules to the management control system management.
  • the management control system determines the network attack feature according to the feature data, and establishes new detection and defense rules according to the network attack feature, and sends the detection and defense rules to the management control system management.
  • the management control system determines the network attack feature according to the feature data, and establishes new detection and defense rules according to the network attack feature, and sends the detection and defense rules to the management control system management.
  • the management control system includes at least one node controller of the first node controller.
  • the method further includes:
  • the detection and defense rules are sent to the management control system such that the management control system sends the detection and defense rules to at least one node controller managed by the management control system in addition to the first node controller.
  • the second aspect of the present application provides a network security protection method, which is applied to a first node controller, where the first node controller is connected to multiple defense systems; and the method includes:
  • the detection and defense rules are sent by the management control system to at least one node controller managed by the management control system such that at least one node controller updates the rules of the corresponding defense system to detection and defense rules.
  • the at least one node control includes one or more node controllers that are unexpected except for the first node controller.
  • the node controller is connected to multiple defense systems, and each management control system can control and manage multiple node controllers, and each defense system can send the characteristic data of the detected attacks to the node controller, and the node controller generates Detect and defend rules and send them to the management control system, or the node controller sends the received feature data directly to the management control system, and sends the detection and defense rules to other node controllers through the management controller to make other node controllers
  • the detection and defense rules of the connected defense system are updated to achieve data sharing between defense systems, greatly improving our intrusion detection and defense capabilities, and building the industry's most competitive defense system. It is also possible to build a comprehensive secure data center.
  • new detection and defense rules are established based on the feature data, including:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception strategy corresponding to the attack feature is customized, and detection and defense rules are obtained.
  • the detection and defense rules are sent to the at least one second defense system, so that the at least one second defense system detects and intercepts the network attack according to the detection and defense rules; wherein the second defense system is the first node Control The defense system connected to the device.
  • the at least one second defense system is at least one defense system that performs detection defense before the first defense system.
  • At least one second defense system includes a first defense system.
  • the at least one second defense system is at least one defense system that performs detection defense after the first defense system.
  • the feature data of the network attack is sent to the management control system, so that the management control system determines the network attack feature according to the feature data, and establishes new detection and defense rules according to the network attack feature, and detects and defends the rule.
  • the at least one node controller may include a first node controller.
  • the third aspect of the present application provides a network security protection method, which is applied to a management control system, where the management control system is used to manage multiple node controllers; the method includes:
  • the detection and defense rules are rules established by the first node controller according to the detected characteristic data of the new network attack, and the first node controller is managed by the management control system a node controller;
  • the detection and defense rules are sent to at least one node controller such that at least one node controller updates the rules of the corresponding defense system to detection and defense rules.
  • the at least one node controller includes one or more node controllers other than the first node controller.
  • the method further includes:
  • the feature data of the network attack sent by the first node controller is received and stored.
  • the method further includes:
  • New detection and defense rules are established based on the feature data, and new detection and defense rules are sent to at least one node controller, so that at least one node controller updates the rules of the corresponding defense system to detection and defense rules.
  • at least one node controller that sends a new detection and defense rule established by the management control system according to the data feature may include the first node controller.
  • At least one of the node controllers may include a first node controller, and may also include other controllers than the first node controller.
  • the fourth aspect of the present application provides a network security protection method, which is applied to a management control system, where the management control system is used to manage multiple node controllers; the method includes:
  • the detection and defense rules are sent to at least one node controller such that at least one node controller updates the rules of the corresponding defense system to detection and defense rules.
  • the at least one node controller includes a first node controller.
  • new detection and defense rules are established based on the feature data, including:
  • the method further includes:
  • the detection and defense rules are rules established by the first node controller according to the detected characteristic data of the new network attack, and the first node controller is managed by the management control system a node controller;
  • the detection and defense rules are sent to at least one node controller such that at least one node controller updates the rules of the corresponding defense system to detection and defense rules.
  • the at least one node controller that the management control system sends the detection and defense rules received from the first node controller may not include the first node controller, that is, one or more than the first node controller. Node controller.
  • the fifth aspect of the present application provides a network security protection method, which is applied to a second node controller, where the second node controller is connected to multiple defense systems, and the method includes:
  • the detection and defense rules are sent to the corresponding defense system for the update of the rules.
  • a sixth aspect of the present application provides a node controller, where the node controller is connected to multiple defense systems; the node controller includes:
  • a receiving module configured to receive feature data of a network attack sent by the first defense system, where the first defense system is any defense system connected to the node controller;
  • a processing module configured to establish a new detection and defense rule according to the feature data
  • a sending module configured to send the detection and defense rules to the at least one second defense system, so that the at least one second defense system detects and intercepts the network attack according to the detection and defense rules; wherein, the second The defense system is a defense system that is connected to the node controller.
  • the at least one second defense system that sends the detection and defense rules by the sending module is at least one defense system that performs detection defense before the first defense system.
  • At least one second defense system includes a first defense system.
  • the at least one second defense system is at least one defense system that performs detection defense after the first defense system.
  • the processing module is specifically configured to:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception policy corresponding to the attack feature is customized, and the detection and defense rules are obtained.
  • the sending module is further configured to:
  • the management control system determines a network attack feature according to the feature data, and establishes new detection and defense rules according to the network attack feature, and
  • the detection and defense rules are sent to at least one node controller including the first node controller managed by the management control system.
  • the sending module is further configured to:
  • a seventh aspect of the present application provides a node controller, where the node controller is connected to multiple defense systems;
  • the controller includes:
  • a receiving module configured to receive feature data of a network attack sent by the first defense system, where the first defense system is any one of the defense systems connected to the first node controller;
  • a processing module configured to establish a new detection and defense rule according to the feature data of the network attack
  • a sending module configured to send, by using the management control system, the detection and defense rules to at least one node controller managed by the management control system, so that the at least one node controller updates a rule of a corresponding defense system For the detection and defense rules.
  • the processing module is specifically configured to:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception strategy corresponding to the attack feature is customized, and detection and defense rules are obtained.
  • the sending module is further configured to send the detection and defense rules to the at least one second defense system, so that the at least one second defense system detects and intercepts the network attack according to the detection and defense rules; wherein, the second The defense system is a defense system that is connected to the first node controller.
  • the at least one second defense system is at least one defense system that performs detection defense before the first defense system.
  • At least one second defense system includes a first defense system.
  • the at least one second defense system is at least one defense system that performs detection defense after the first defense system.
  • the sending module is further configured to send the feature data of the network attack to the management control system, so that the management control system determines the network attack feature according to the feature data, and establishes a new detection and defense rule according to the network attack feature. And sending detection and defense rules to at least one node controller managed by the management control system.
  • the eighth aspect of the present application provides a network security protection device, where the network security protection device is configured to manage multiple node controllers;
  • a receiving module configured to receive a detection and defense rule sent by the first node controller, where the detection and defense rule is a rule that is established by the first node controller according to the feature data of the detected new network attack, where a node controller is any node controller managed by the network security device;
  • a sending module configured to send the detection and defense rules to the at least one node controller, so that the at least one node controller updates the rules of the corresponding defense system to the detection and defense rules.
  • the receiving module is further configured to receive and store feature data of a network attack sent by the first node controller.
  • the apparatus further includes: a processing module configured to establish new detection and defense rules according to the feature data, and send the new detection and defense rules to the at least one node controller to enable the at least one node controller Update the rules of the corresponding defense system to detection and defense rules.
  • At least one of the node controllers may include a first node controller, and may also include other controllers than the first node controller.
  • the ninth aspect of the present application provides a network security protection device, where the network security protection device is configured to manage multiple node controllers;
  • a receiving module configured to receive feature data of a network attack sent by the first node controller, where the first node controller Any node controller managed for the management control system;
  • a processing module configured to establish a new detection and defense rule according to the feature data
  • a sending module configured to send the detection and defense rules to the at least one node controller, so that the at least one node controller updates the rules of the corresponding defense system to the detection and defense rules.
  • the processing module is specifically configured to:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception strategy corresponding to the attack feature is customized, and detection and defense rules are obtained.
  • the receiving module is further configured to receive a detection and defense rule sent by the first node controller, and the detection and defense rules are rules established by the first node controller according to the detected characteristic data of the new network attack.
  • the first node controller is any node controller managed by the management control system;
  • the sending module is further configured to send the detection and defense rules to the at least one node controller, so that the at least one node controller updates the rules of the corresponding defense system to the detection and defense rules.
  • a tenth aspect of the present application provides a node controller, where the node controller is connected to multiple defense systems, and the node controller includes:
  • the receiving module receives the detection and defense rules sent by the management control system
  • a sending module configured to send the detection and defense rules to a corresponding defense system for updating the rules.
  • An eleventh aspect of the present application provides a node controller including at least one processor, a memory, and a communication interface.
  • the at least one processor, the memory, and the communication interface are each connected by a bus;
  • the memory stores a computer to execute instructions;
  • the at least one processor executes the computer-executed instructions stored by the memory such that the node controller Performing data interaction with the defense system or the management control system through the communication interface to perform the various possible designs of the first aspect or the first aspect or the network security protection method provided by the second aspect or the various possible designs of the second aspect .
  • a twelfth aspect of the present application provides a network security protection device including at least one processor, a memory, and a communication interface.
  • the at least one processor, the memory, and the communication interface are each connected by a bus; the memory storage computer executes instructions; the at least one processor executes the computer-executed instructions stored by the memory to cause the network security protection
  • the device performs data interaction with the node controller through the communication interface to perform various possible designs of the third aspect or the third aspect or the network security protection method provided by various possible designs of the fourth aspect or the fourth aspect.
  • a thirteenth aspect of the present application provides a computer readable storage medium, where computer executable instructions are stored, and when at least one processor of a node controller executes the computer to execute an instruction, the node controller executes the first Aspects or various possible designs of the first aspect or the network security protection methods provided by the second aspect or the various possible designs of the second aspect.
  • a fourteenth aspect of the present application provides a computer readable storage medium, where computer executable instructions are stored, and when at least one processor of the network security device executes the computer to execute an instruction, the network security protection device performs the above The network security protection method provided by the third aspect or the various possible designs of the third aspect or the various possible designs of the fourth aspect or the fourth aspect.
  • a fifteenth aspect of the present application provides a computer program product comprising computer executed instructions stored in a computer readable storage medium. At least one processor of the node controller can be calculated from The machine readable storage medium reads the computer to execute instructions, and the at least one processor executes the computer to execute the instructions such that the node controller implements the first aspect or the various possible designs of the first aspect or the second aspect or the second aspect
  • the network security protection method that may be designed.
  • a sixteenth aspect of the present application provides a computer program product comprising computer executed instructions stored in a computer readable storage medium.
  • At least one processor of the network security device can read the computer executable instructions from the computer readable storage medium, and the at least one processor executes the computer to execute the instructions such that the network security device implements the various aspects of the third aspect or the third aspect described above It is possible to design a network security protection method provided by various possible designs of the fourth aspect or the fourth aspect.
  • the node controller receives the feature data of the network attack sent by any one of the defense systems controlled by the connection, establishes a new detection and defense rule according to the feature data, and sends the detection and defense rules to at least one The defense system, so that the defense system that receives the new detection and defense rules detects and intercepts the network attack, or sends it to other node controllers through the management control system, and then sends it to other node controllers for control.
  • Defense system Realize linkage between multiple defense systems or linkage between different node controllers, realize multiple defense systems to detect and defend the attack at the same time, improve intrusion detection and defense capabilities, and effectively reduce the defense pressure of a single defense system. Avoid the limitations of a single defense system, share data across defense systems, and build powerful and comprehensive security data centers to provide powerful repair capabilities.
  • FIG. 1 is a schematic diagram of a conventional network security protection system
  • FIG. 2 is a schematic structural diagram of a network security protection system provided by the present invention.
  • FIG. 3 is a schematic diagram of functional modules of each node device of the network security protection system provided by the present invention.
  • Embodiment 4 is a flowchart of Embodiment 1 of a network security protection method according to the present invention.
  • FIG. 5 is a flowchart of Embodiment 2 of a network security protection method according to the present invention.
  • FIG. 6 is a flowchart of Embodiment 3 of a network security protection method according to the present invention.
  • Embodiment 7 is a schematic structural diagram of Embodiment 1 of a node controller according to the present invention.
  • Embodiment 8 is a schematic structural diagram of Embodiment 1 of a network security protection device according to the present invention.
  • Embodiment 9 is a schematic structural diagram of Embodiment 3 of a node controller according to the present invention.
  • Embodiment 4 of a node controller according to the present invention.
  • FIG. 11 is a schematic structural diagram of Embodiment 3 of a network security protection device according to the present invention.
  • the defense flow of the single-point defense system is greatly increased by the hacker.
  • the detection characteristics of a single node defense system are thin, and the new network attack methods cannot be effectively identified.
  • a certain node's defense system discovers a new type of attack method, it cannot effectively notify another defense node or delays for a long time to manually notify the operation and maintenance personnel to update the rule.
  • the individual operations of each defense system cannot effectively communicate with the upper layer or the adjacent defense system, and the detection features cannot be updated in time to perform the defense interception action.
  • the network security protection system provided by the solution adds a node controller (also called a node control center) and a management control system (also called a management center), and each node controller is respectively associated with multiple lower layers. Defense system connections are equivalent to the "supervisors" of these defense systems. Node controller and management control system can be implemented The direct linkage of nodes can also link the defense service systems of a single defense node to achieve common defense.
  • 2 is a schematic diagram of a network security protection system architecture provided by the present invention. As shown in FIG. 2, a specific network security protection system is provided.
  • the management control system manages a first node controller and a second node controller, and the first node controls And the second node controller respectively connect the anti-ddos attack (English: Anti Distributed Denial of Service, referred to as: Anti-Ddos), the intrusion prevention system (English: Intrusion Prevention System, IPS for short), firewall (English: firewall, referred to as :FW), Intrusion Detection Systems (English: Intrusion Detection Systems, IDS), Web Application Firewall (English: Web Application Firewall, WAF), Host-based Intrusion Prevention (English: Host-based Intrusion Prevention) System, referred to as HIPS), Host-based Intrusion Detection Systems (HIDS) and other defense systems, and then the lower layer of the defense system is connected to the virtual machine (English: virtual machine, VM for short). Security.
  • Anti-Ddos the intrusion prevention system
  • IPS Intrusion Prevention System
  • firewall English: firewall, referred to as :FW
  • the node controller may receive the feature data of the network attack or the hacker attack discovered by each defense system, establish a new detection and defense rule according to the feature data, and then notify the updated detection and defense rule to the Other corresponding defense systems detect and intercept these hacker attacks by the corresponding function defense system; realize linkage between services under the same defense node; and the node controller reports the new network attack characteristics to the management control system, and the management control
  • the system updates the detection and defense rules in the system and notifies these updates to all node controllers in real time, and then the node controllers schedule the assignment tasks to the corresponding defense system.
  • the node controller sends the detection and defense rules re-established according to the feature data directly to the other node controllers through the management control system, so that other node controllers can also update the detection and defense rules, thus implementing the nodes.
  • FIG. 3 is a schematic diagram of functional modules of each node device of the network security protection system provided by the present invention.
  • the connection relationship between the node controller (node control center) and the defense system and the management control system is shown in FIG. 3, and the following is specific to each device. Introduction.
  • the node controller is introduced.
  • the node controller is deployed with a data storage center, an association analysis system, a rule system, and a communication scheduling system.
  • a data storage center is configured to store data reported by the defense system at the node and characteristic data of the attack in the system.
  • the association analysis system is used to analyze the attack characteristics by analyzing the data reported by each defense system to the data storage center, and analyzing the attack characteristics through the established data model; for example, when the IDS system finds the abnormal scan behavior of the network traffic port
  • the abnormal network traffic data is reported to the data storage center of the node controller; at this time, the HIDS reports the network port information accessed by the process in the host to the data storage center of the node, and performs the behavior of the process and the data of the network port.
  • Correlation analysis restore the intrusion feature of the hacker attack, and conclude that the feature may be an APT attack.
  • the association analysis system associates the network traffic reported by the IDS with the network port information data accessed by the process reported by the HIDS, and obtains the network attack. Feature data.
  • Defense rules for packages and process behavior also known as interception strategies).
  • the communication scheduling system is configured to notify each of the defense systems under the node to update the detection and defense rules, and deliver the detection and defense rules to each defense system; and report the policies to the management control system; and also receive the management control
  • the detection and defense rules issued by the system are used to receive the feature data reported by the defense system below.
  • the management control system includes a data storage center, a data analysis center, a rule policy system, and a node management system.
  • a data storage center is configured to store data reported by each node controller (including feature data of a network attack or detection and defense rules sent by a node controller).
  • the data analysis center is used to analyze the data of the storage center and build a model.
  • the rule policy system is configured to perform rule and policy formulation and update and synchronize to the communication scheduling system according to the feature data of the attack analyzed by the data; the same as the rule system function of the node controller above.
  • a node management system for managing the health of each node controller, the health of each node controller, and heartbeat information.
  • the communication scheduling system is configured to receive the data of the data reported by each node controller and the attack characteristic data, and send the monitoring and defense rules to the node controllers.
  • the network security protection method provided by the present invention is introduced in several specific embodiments.
  • FIG. 4 is a flowchart of Embodiment 1 of a network security protection method according to the present invention. As shown in FIG. 4, the specific steps of the network security protection method provided by the solution are as follows:
  • S101 Receive feature data of a network attack sent by the first defense system.
  • the first node controller (not specifically refers to a node controller, which may be any node controller in the system), and the defense system discovers abnormal network characteristics or abnormal process access features, and acquires the feature data. And reported to the node controller, the node controller receives characteristic data (also called attack feature) of the network attack sent by any one of the defense systems of the lower layer.
  • characteristic data also called attack feature
  • the node controller acquires the attack feature of the network attack according to the feature data analysis; adds a detection alarm for monitoring the attack feature in the current traffic monitoring rule, and customizes an interception strategy corresponding to the attack feature, The detection and defense rules are obtained.
  • the IDS system detects the abnormal traffic behavior of the network traffic port
  • the abnormal network traffic data is reported.
  • the HIDS reports the network port information accessed by the process in the host to the node controller, and the behavior of the process and the network port.
  • the data is correlated and analyzed to restore the intrusion characteristics of the hacker attack.
  • the feature may be an APT attack, that is, an attack feature obtained by correlating the network traffic reported by the IDS with the network port information data accessed by the process reported by the HIDS.
  • the corresponding detection and defense rules are then updated based on the results of the association analysis.
  • the traffic detection rule of the IDS is updated, and the detection alarms for such network characteristic data packets are added in the rules; the detection characteristics of the behavior of the process in the HIDS host are also updated, and the defense rules of such network attack packets and process behaviors are formulated. Get new detection and defense rules.
  • S103 Send the detection and defense rules to at least one second defense system.
  • the detection and defense rule needs to be notified to one or more defense systems, and the rule is updated to the network. Attack to defend.
  • At least one second defense system in the solution may include a first defense system, and may also include an upper defense system that first detects and defends with the first defense system, and may also include detection and defense after the first defense system.
  • the underlying defense system does not impose restrictions on this solution.
  • the at least one second defense system is at least one defense system that detects defense before the first defense system.
  • the at least one second defense system comprises a first defense system.
  • the at least one second defense system includes at least one defense for detecting defense after the first defense system system.
  • S104 The at least one second defense system detects and intercepts the network attack according to the detection and defense rules.
  • the second defense system that receives the new detection and defense rules updates the local policy, and detects and intercepts the foregoing network attack.
  • the node controller is configured to connect multiple defense systems, and each defense system may send the feature data of the detected attack to the node controller, and the node controller generates detection and defense rules and respectively sends the same.
  • the multiple defense systems managed by the node controller enable multiple defense systems to detect and defend the attack at the same time, improve the intrusion detection and defense capabilities, effectively reduce the defense pressure of the single defense system, and avoid the limitations of the single defense system. Sex.
  • the first node controller may further send the feature data of the network attack to the management control system, so that the management control system determines the network attack feature according to the feature data, and Establishing new detection and defense rules according to the network attack feature, and transmitting the detection and defense rules to at least one node controller managed by the management control system, the at least one node controller may be part or all of the node controllers managed by the management control system .
  • the essence of the solution is to report the characteristic data of the network attack to the management control system, and the management control system analyzes and processes the feature data to obtain new detection and defense rules, and then notifies the at least one node controller (including the first control node) ), the node controller then notifies each defense system to perform detection and defense rule updates.
  • the first node controller may further send the detection and defense rules to the management control system, so that the management control system sends the detection and defense rules to the management control.
  • a first node controller is any one of the node controllers managed by the management control system; transmitting the detection and defense rules to at least one node controller other than the first control node, so that the at least one node controller Update the rules of the corresponding defense system to the detection and defense rules.
  • the solution is a solution in parallel with the embodiment.
  • the essence of the solution is that the detection and defense rules obtained by the node controller analysis and processing are directly reported to the management control system, and the management control system forwards the new detection and defense rules to the multiple node controllers. The node controller then notifies each defense system to perform detection and defense rule updates.
  • FIG. 5 is a flowchart of Embodiment 2 of a network security protection method according to the present invention. As shown in FIG. 5, the specific implementation steps of the solution are as follows:
  • S201 Receive feature data of a network attack sent by the first defense system.
  • the first node controller receives the feature data of the network attack, and the specific implementation of the detection and defense rules according to the feature data is similar to that of the first embodiment, and details are not described herein again.
  • S203 Send the detection and defense rules to the at least one node controller managed by the management control system by using a management control system.
  • the first node controller sends new detection and defense rules to the management control system, and the management control system sends new detection and defense rules to at least one node controller other than the first control node (eg, as described in FIG. 2) Second node controller).
  • a first node controller is any one of the node controllers managed by the management control system; transmitting the detection and defense rules to at least one node controller other than the first control node (eg, the second one described in FIG. 2) a node controller) to cause the at least one node controller to update rules of the corresponding defense system to the detection and defense rules.
  • the detection and defense rules sent by the management control system are received, and the detection and defense rules are sent to the corresponding defense system to update the rules.
  • the detection and defense rules can be implemented as S204 and S205.
  • S204 Send the detection and defense rules to at least one defense system.
  • the other node controllers after receiving the detection and defense rules sent by the management control system, send the detection and defense rules to one or more defense systems connected to the lower layer, and the at least one defense system may be
  • the defense system corresponding to the detection and defense rules may also be an upper defense system of the defense system corresponding to the detection and defense rules, or may be a lower defense system of the defense system corresponding to the detection and defense rules.
  • the program does not impose restrictions.
  • the defense systems After receiving the new detection and defense rules, the defense systems update the local policies to detect and intercept the aforementioned network attacks.
  • each defense system may send the feature data of the detected attack to the node controller, and the node controller generates the detection and defense rules and sends the detection and defense rules to the management control system to enable other node controllers.
  • the detection and defense rules of the connected defense system are updated to achieve data sharing between defense systems, greatly improving our intrusion detection and defense capabilities, and building the industry's most competitive defense system. It is also possible to build a comprehensive secure data center.
  • the first node controller may directly send the feature data to the management control system, and the management control system establishes a new detection and defense rule according to the feature data. That is, the management control system receives the feature data of the network attack sent by the first node controller, and establishes a new detection and defense rule according to the feature data, and then the management control system sends the established detection and defense rules to at least one node. a controller to cause the at least one node controller to update rules of the corresponding defense system to the detection and defense rules.
  • the node controllers receive the detection and defense rules sent by the management control system; and send the detection and defense rules to the corresponding defense system to update the rules.
  • the defense system of the same node controller realizes common governance, and the management control system can also notify other node controllers to detect and defend the corresponding defense system, prevent the problem from occurring, and realize Data sharing greatly enhances intrusion detection and defense capabilities, avoids the limitations of a single defense system, and alleviates the pressure on the defense system. At the same time, it can provide powerful repair capabilities to ensure the effective operation of the single point defense system.
  • the first embodiment or the second embodiment is based on the scheme description of the system architecture of FIG. 2.
  • the network security protection method is described below based on the specific functional modules of each node device shown in FIG.
  • FIG. 6 is a flowchart of Embodiment 3 of a network security protection method according to the present invention. As shown in FIG. 6, a specific implementation step of the network security protection method is:
  • the multiple defense systems discover abnormal network characteristics and abnormal process access characteristics, and then report the characteristic data of these network attacks to the node controller 1.
  • the communication scheduling system of the node controller 1 transmits the data reported by the defense system to the data storage center.
  • the association analysis system performs association analysis through the data reported by each defense system, such as restoring the network behavior of a process, and comparing the accessed ports, the accessed file information, the modified file information, the time, the authority, and the like with multi-dimensional data, and correlates and analyzes .
  • the correlation analysis system correlation analysis results in such network attack characteristics and malicious process characteristics, and is notified to the rule policy system; the rule policy system interprets the results of the association analysis, and then updates the detection and interception rules of such attacks.
  • the rule policy system of the node controller 1 synchronizes the updated detection and interception rules to the communication scheduling system; the communication scheduling system is responsible for issuing the update rules to the respective defense systems.
  • the communication scheduling system of the node controller 1 sends the updated detection and defense rules to the corresponding defense system below, and the defense system that receives the new detection and defense rules may be the Anti-Ddos itself, or may be the upper layer or Other defense systems on the lower layer can also be all defense systems under the node controller.
  • the communication scheduling system of the first node controller 1 can also report the characteristic data of the discovered new network attack to the management control system.
  • the management control system analyzes the characteristic data of the network attack reported by the node controller 1, and, like the association analysis of the node controller 1, associates the data according to the network, the port, the modified file, the time, the authority, and the like, and restores the attack behavior.
  • the management control system interprets the results of the association analysis and then updates the detection and interception rules of such attacks; (or directly uses the new detection and defense rules of the node controller, and does not need to manage the control system to perform correlation analysis to derive these new
  • the detection and defense rules are then issued to the remaining node controllers (eg node controller 2).
  • the communication scheduling system is responsible for delivering the new detection and defense rules to the corresponding defense system under the node controller for rule update.
  • the network security protection method provided by the present invention reports data of multiple defense systems to a node controller, and the node controller establishes and updates detection and defense rules according to data and attack characteristics; and then sends the established new detection and defense rules to The other defense system under the same node realizes the common enemy; in addition, the current node can report the newly discovered network attack feature to the management control system, and the management control system notifies the defense system under the remaining nodes to timely update the detection and defense rules. In the first place, it greatly improves the intrusion detection and defense capabilities, builds a more secure defense system, avoids the limitations of a single defense system, and reduces the defense pressure of a single defense system.
  • FIG. 7 is a schematic structural diagram of Embodiment 1 of a node controller according to the present invention. As shown in FIG. 7, the node controller 10 includes:
  • the receiving module 11 is configured to receive feature data of a network attack sent by the first defense system, where the first defense system is any defense system connected to the node controller;
  • the processing module 12 is configured to establish a new detection and defense rule according to the feature data
  • the sending module 13 is configured to send the detection and defense rules to the at least one second defense system, so that the at least one second defense system detects and intercepts the network attack according to the detection and defense rules;
  • the second defense system is a defense system that is connected to the node controller.
  • the at least one second defense system that sends the detection and defense rules by the sending module 13 is at least one defense system that performs detection defense before the first defense system.
  • processing module 12 is specifically configured to:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception policy corresponding to the attack feature is customized, and the detection and defense rules are obtained.
  • the sending module 13 is further configured to:
  • the management control system determines a network attack feature according to the feature data, and establishes new detection and defense rules according to the network attack feature, and
  • the detection and defense rules are sent to at least one node controller including the first node controller managed by the management control system.
  • the sending module 13 is further configured to:
  • the at least one second defense system that sends the detection and defense rules by the sending module 13 is at least one defense system that performs detection defense before the first defense system.
  • the at least one second defense system that sends the detection and defense rules by the sending module 13 includes a first defense system.
  • the sending module 13 sends the at least one second defense system that detects and defends the rule to be at least one defense system that performs detection defense after the first defense system.
  • the node controller provided by the foregoing embodiment is used to implement the technical solution of the node controller in any of the foregoing methods, and the implementation principle and technical effects are similar, and details are not described herein again.
  • the receiving module 11 is configured to receive feature data of a network attack sent by the first defense system, where the first defense system is any defense system connected to the first node controller;
  • the processing module 12 is configured to establish a new detection and defense rule according to the feature data of the network attack
  • the sending module 13 is configured to send, by using the management control system, the detection and defense rules to at least one node controller managed by the management control system, so that the at least one node controller will use a rule of the corresponding defense system Updated to the detection and defense rules.
  • processing module 12 is specifically configured to:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception strategy corresponding to the attack feature is customized, and detection and defense rules are obtained.
  • the sending module 13 is further configured to send the detection and defense rules to the at least one second defense system, so that the at least one second defense system detects and intercepts the network attack according to the detection and defense rules; wherein, the second defense The system is a defense system that is connected to the first node controller.
  • the at least one second defense system is at least one defense system that detects defense before the first defense system.
  • the at least one second defense system comprises a first defense system.
  • the at least one second defense system is at least one defense system that performs detection defense after the first defense system.
  • the sending module 13 is further configured to send the feature data of the network attack to the management control system, so that the management control system determines the network attack feature according to the feature data, and establishes a new detection and defense rule according to the network attack feature.
  • the detection and defense rules are sent to at least one node controller managed by the management control system.
  • the node controller provided by the foregoing embodiment is used to implement the technical solution of the node controller in any of the foregoing methods, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 8 is a schematic structural diagram of Embodiment 1 of a network security protection device according to the present invention. As shown in FIG. 8, the network security protection device 20 is configured to manage multiple node controllers.
  • the network security protection device 20 includes:
  • the receiving module 21 is configured to receive a detection and defense rule sent by the first node controller, where the detection and defense rule is a rule that is established by the first node controller according to the feature data of the detected new network attack,
  • the first node controller is any node controller managed by the network security device;
  • the sending module 22 is configured to send the detection and defense rules to the at least one node controller, so that the at least one node controller updates the rules of the corresponding defense system to the detection and defense rules.
  • the at least one node control comprises one or more node controllers that are unexpected except the first node controller.
  • the receiving module 21 is further configured to receive and store feature data of a network attack sent by the first node controller.
  • the device further includes: a processing module 23, configured to establish a new detection and defense rule according to the feature data, and send the new detection and defense rule to the at least one node controller, so that the at least one node controller Update the rules of the corresponding defense system to detection and defense rules.
  • a processing module 23 configured to establish a new detection and defense rule according to the feature data, and send the new detection and defense rule to the at least one node controller, so that the at least one node controller Update the rules of the corresponding defense system to detection and defense rules.
  • the at least one node controller may include the first node controller, and may also include other controllers than the first node controller.
  • the network security protection device provided in this embodiment is used to implement the technical solution of the management control system in any of the foregoing methods, and the implementation principle and technical effects are similar, and details are not described herein again.
  • each module of the network security protection device 20 is further Used to perform the functions below.
  • the receiving module 21 is configured to receive feature data of a network attack sent by the first node controller, where the first node controller is any node controller managed by the management control system;
  • the processing module 23 is configured to establish a new detection and defense rule according to the feature data
  • the sending module 22 is configured to send the detection and defense rules to the at least one node controller, so that the at least one node controller updates the rules of the corresponding defense system to the detection and defense rules.
  • processing module 23 is specifically configured to:
  • a detection alarm for monitoring the attack feature is added to the traffic monitoring rule, and an interception strategy corresponding to the attack feature is customized, and detection and defense rules are obtained.
  • the receiving module 21 is further configured to receive a detection and defense rule sent by the first node controller, where the detection and defense rules are rules established by the first node controller according to the detected feature data of the new network attack.
  • the first node controller is any node controller managed by the management control system;
  • the sending module 22 is further configured to send the detection and defense rules to the at least one node controller, so that the at least one node controller updates the rules of the corresponding defense system to the detection and defense rules.
  • the network security protection device provided in this embodiment is used to implement the technical solution of the management control system in any of the foregoing methods, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 9 is a schematic structural diagram of Embodiment 3 of a node controller according to the present invention. As shown in FIG. 9, the node controller 30 is connected to multiple defense systems, and the node controller 30 includes:
  • the receiving module 31 receives the detection and defense rules sent by the management control system
  • the sending module 32 is configured to send the detection and defense rules to a corresponding defense system for updating the rules.
  • the node controller provided in this embodiment is used to perform the technical solution of the node controller in any of the foregoing methods, and the implementation principle and technical effects are similar, and details are not described herein again.
  • the receiving module can be implemented as a receiver
  • the transmitting module can be implemented as a transmitter
  • the processing module can be implemented as a processor
  • data and program code can be stored in the memory. Executed by the controller according to the corresponding program instructions.
  • the processor may be a central processing unit (English: Central Processing Unit, CPU for short), or may be other general-purpose processors, digital signal processors (English) : Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), etc.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • FIG. 10 is a schematic structural diagram of Embodiment 4 of a node controller according to the present invention.
  • the node controller 40 includes at least one processor 41, a memory 42, and a communication interface 43.
  • the at least one processor 41, the memory 42 and the communication interface 43 are each connected by a bus 44;
  • the memory 42 stores computer execution instructions;
  • the at least one processor 41 executes computer execution instructions stored by the memory 42
  • the node controller 40 performs data interaction with the defense system or the management control system through the communication interface 43 to perform various possible network security protection methods on the node controller side in any of the foregoing embodiments.
  • FIG. 11 is a schematic structural diagram of Embodiment 3 of a network security protection device according to the present invention.
  • the protection device 50 includes at least one processor 51, a memory 52, and a communication interface 53.
  • the at least one processor 51, the memory 52, and the communication interface 53 are each connected by a bus 54;
  • the memory 52 stores computer execution instructions;
  • the at least one processor 51 executes computer execution instructions stored by the memory 52 And causing the network security protection device to perform data interaction with the node controller through the communication interface to perform a network security protection method provided by various possible designs of the management control system in any of the foregoing embodiments.
  • the processor 41 in the node controller 40 or the processor 51 of the network security device 50 may include different types of processors or include the same type of processor; the processor may be any of the following: central processing A device with computational processing capability, such as a Central Processing Unit (CPU), an ARM processor, a Field Programmable Gate Array (FPGA), or a dedicated processor. In an alternative embodiment, the at least one processor may also be integrated as a many-core processor.
  • CPU Central Processing Unit
  • FPGA Field Programmable Gate Array
  • the memory 42 in the node controller 40 or the memory 52 of the network security device 50 may be any one or any combination of the following: a random access memory (RAM), a read only memory (read) Only memory (referred to as ROM), non-volatile memory (NVM), solid state drive (SSD), mechanical hard disk, disk, disk array and other storage media.
  • RAM random access memory
  • ROM read only memory
  • NVM non-volatile memory
  • SSD solid state drive
  • the communication interface 43 and the communication interface 53 are each used for data exchange between the node controller and the network security device with other devices.
  • the communication interface may be any one or any combination of the following: a network interface (such as an Ethernet interface), a wireless network card, and the like having a network access function.
  • Bus 44 and bus 54 may each include an address bus, a data bus, a control bus, etc., for convenience of representation, the bus (bus 44 or bus 54) is indicated by a thick line in Figures 10 and 11 .
  • the bus may be any one or any combination of the following: an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, and an extended industry standard structure ( Extended Industry Standard Architecture (EISA) bus and other devices for wired data transmission.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium stores computer execution instructions, when the at least one processor of the node controller executes the computer execution instruction, the node controller performs the above A variety of network security methods that may be designed.
  • the embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium stores computer execution instructions, and when at least one processor of the network security protection device executes the computer execution instruction, the network security protection device performs the above
  • the network security protection methods provided by various possible designs in the embodiments.
  • a computer program product is also provided in an embodiment of the invention, the computer program product comprising computer executed instructions stored in a computer readable storage medium.
  • At least one processor of the node controller can read the computer executable instructions from a computer readable storage medium, and the at least one processor executes the computer to execute the instructions such that the node controller implements network security provided by various possible designs in the foregoing method embodiments Protection method.
  • a computer program product is also provided in an embodiment of the invention, the computer program product comprising computer executed instructions stored in a computer readable storage medium.
  • At least one processor of the network security device can read the computer executable instructions from a computer readable storage medium, and the at least one processor executes the computer to execute the instructions such that the network security device implements various possible designs or fourth aspects or Four possible aspects of network security protection that may be designed.

Abstract

本发明实施例提供一种网络安全防护方法和装置，第一节点控制器接收第一防御系统发送的网络攻击的特征数据，第一防御系统为与第一节点控制器连接的任一个防御系统，根据特征数据建立新的检测和防御规则，将检测和防御规则发送至至少一个第二防御系统，以使至少一个第二防御系统根据检测和防御规则检测和拦截网络攻击；其中，第二防御系统为与第一节点控制器连接的防御系统。每个防御系统可以将检测到的攻击的特征数据发送至节点控制器，节点控制器生成检测和防御规则并分别发送给该节点控制器管理的多个防御系统，以实现多个防御系统同时对该攻击的检测和防御，提高入侵发现和防御能力，有效减轻单一防御系统的防御压力。

Description

网络安全防护方法和装置 技术领域
本发明实施例涉及互联网技术，尤其涉及一种网络安全防护方法和装置。
背景技术
随着网络技术的不断发展，网络病毒、攻击、黑客等技术也更加迅猛，病毒变种、攻击智能化、繁殖化，网络安全的维护显得尤为重要。
图1为常规的网络安全防护系统示意图，如图1所示，针对当前的网络攻击和病毒木马的繁衍，大部分企业会在网络层部署防火墙Anti-DDos，入侵检测系统(英文：Intrusion Detection Systems，简称：IDS)，入侵防御系统(英文：Intrusion Prevention System，简称：IPS)以及防火墙对其进行检测和拦截；而在应用层会有web应用防御系统(英文：Web Application Firewall，简称：WAF)，主机入侵防御系统(英文：Host-based Intrusion Prevention System，简称：HIPS)，对Webshell，病毒木马，rootkit进行检测和防御，对服务器的攻击进行拦截处理，单一特征的网络攻击就由相应检测和防御功能的防御系统去完成检测和拦截。
然而，上面提供的安全防护系统中，各个防御系统单一作战不能有效跟上层或者相邻的防御系统进行有效交流，不能及时更新检测特征来进行防御拦截动作，网络攻击突破单点防御系统后，导致另外的防御系统的防御压力大大增大，攻击流量的无限放大，容易造成多个单节点的防御系统失效，租户面临很大的安全威胁。
发明内容
本申请提供一种网络安全防护方法和装置，用于解决各个防御系统单一作战不能有效跟上层或者相邻的防御系统进行有效交流，不能及时更新检测特征来进行防御拦截动作，网络攻击突破单点防御系统后，导致另外的防御系统的防御压力大大增大，攻击流量的无限放大，容易造成多个单节点的防御系统失效，租户面临很大的安全威胁的问题。
本申请第一方面提供一种网络安全防护方法，应用于第一节点控制器，第一节点控制器与多个防御系统连接；方法包括：
接收第一防御系统发送的网络攻击的特征数据，第一防御系统为与第一节点控制器连接的任一个防御系统；
根据特征数据建立新的检测和防御规则；
将检测和防御规则发送至至少一个第二防御系统，以使至少一个第二防御系统根据检测和防御规则检测和拦截网络攻击；其中，第二防御系统为与第一节点控制器连接的防御系统。
上述方案提供的网络安全防护方法，设置节点控制器连接多个防御系统，每个防御系统可以将检测到的攻击的特征数据发送至节点控制器，节点控制器生成检测和防御规则并分别发送给该节点控制器管理的多个防御系统，以实现多个防御系统同时对该攻击的检测和防御，提高入侵发现和防御能力，有效减轻单一防御系统的防御压力，同时能够避免单一防御系统 局限性，并且防御系统之间的数据共享，可以建立全面的安全数据中心。
一种可能设计中，至少一个第二防御系统为在第一防御系统之前进行检测防御的至少一个防御系统。
一种可能设计中，至少一个第二防御系统包括第一防御系统。
一种可能设计中，至少一个第二防御系统为在第一防御系统之后进行检测防御的至少一个防御系统。
一种可能设计中，根据特征数据建立新的检测和防御规则，包括：
根据特征数据分析获取网络攻击的攻击特征；
在流量监测规则中加入监测攻击特征的检测告警，并定制与攻击特征对应的拦截策略，得到检测和防御规则。
一种可能设计中，方法还包括：
将网络攻击的特征数据发送至管理控制系统，以使管理控制系统根据特征数据确定网络攻击特征、并根据网络攻击特征建立新的检测和防御规则、并将检测和防御规则发送至管理控制系统管理的包括所述第一节点控制器的至少一个节点控制器。
一种可能设计中，方法还包括：
将检测和防御规则发送至管理控制系统，以使管理控制系统将检测和防御规则发送至管理控制系统管理的除了所述第一节点控制器以外的至少一个节点控制器。
本申请第二方面提供一种网络安全防护方法，应用于第一节点控制器，第一节点控制器与多个防御系统连接；方法包括：
接收第一防御系统发送的网络攻击的特征数据，第一防御系统为与第一节点控制器连接的任一个防御系统；
根据网络攻击的特征数据建立新的检测和防御规则；
将检测和防御规则通过管理控制系统发送至管理控制系统管理的至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
一种可能设计中，所述至少一个节点控制包括除了所述第一节点控制器意外的一个或多个节点控制器。
该方案中，节点控制器连接多个防御系统，每个管理控制系统可控制管理多个节点控制器，每个防御系统可以将检测到的攻击的特征数据发送至节点控制器，节点控制器生成检测和防御规则并发送至管理控制系统，或者节点控制器将接收到的特征数据直接发送给管理控制系统，通过管理控制器将检测和防御规则发送至其他节点控制器，以使其他节点控制器对连接的防御系统进行检测和防御规则的更新，以实现防御系统之间的数据共享，大大提高我们的入侵发现和防御能力,构建业界最有竞争力的防御体系。还可以建立全面的安全数据中心。
一种可能设计中，根据特征数据建立新的检测和防御规则，包括：
根据特征数据分析获取网络攻击的攻击特征；
在流量监测规则中加入监测攻击特征的检测告警，并定制与攻击特征对应的拦截策略，得到检测和防御规则。
一种可能设计中，将检测和防御规则发送至至少一个第二防御系统，以使至少一个第二防御系统根据检测和防御规则检测和拦截网络攻击；其中，第二防御系统为与第一节点控制 器连接的防御系统。
一种可能设计中，至少一个第二防御系统为在第一防御系统之前进行检测防御的至少一个防御系统。
一种可能设计中，至少一个第二防御系统包括第一防御系统。
一种可能设计中，至少一个第二防御系统为在第一防御系统之后进行检测防御的至少一个防御系统。
一种可能设计中，将网络攻击的特征数据发送至管理控制系统，以使管理控制系统根据特征数据确定网络攻击特征、并根据网络攻击特征建立新的检测和防御规则、并将检测和防御规则发送至管理控制系统管理的至少一个节点控制器。本方案中，该至少一个节点控制器可以包括第一节点控制器。
本申请第三方面提供一种网络安全防护方法，应用于管理控制系统，管理控制系统用于管理多个节点控制器；方法包括：
接收第一节点控制器发送的检测和防御规则，检测和防御规则为第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，第一节点控制器为管理控制系统管理的任一个节点控制器；
将检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
一种可能设计中，所述至少一个节点控制器包括除了所述第一节点控制器以外的一个或者多个节点控制器。
一种可能设计中，方法还包括：
接收并存储第一节点控制器发送的网络攻击的特征数据。
一种可能设计中，方法还包括：
根据特征数据建立新的检测和防御规则，并将新的检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。本方案中，一种可能设计中，发送管理控制系统根据数据特征建立的新的检测和防御规则的至少一个节点控制器可以包括第一节点控制器。
一种可能设计中，至少一个节点控制器可以包括第一节点控制器，也可以包括除了第一节点控制器之外的其他控制器。
本申请第四方面提供一种网络安全防护方法，应用于管理控制系统，管理控制系统用于管理多个节点控制器；方法包括：
接收第一节点控制器发送的网络攻击的特征数据，第一节点控制器为管理控制系统管理的任一个节点控制器；
根据特征数据建立新的检测和防御规则；
将检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
一种可能设计中，所述至少一个节点控制器包括第一节点控制器。
一种可能设计中，根据特征数据建立新的检测和防御规则，包括：
根据特征数据分析获取网络攻击的攻击特征；
在流量监测规则中加入监测攻击特征的检测告警，并定制与攻击特征对应的拦截策略， 得到检测和防御规则。
一种可能设计中，方法还包括：
接收第一节点控制器发送的检测和防御规则，检测和防御规则为第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，第一节点控制器为管理控制系统管理的任一个节点控制器；
将检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
本方案中，管理控制系统发送从第一节点控制器接收来的检测和防御规则的至少一个节点控制器可不包括第一节点控制器，即是除了第一节点控制器之外的一个或多个节点控制器。
本申请第五方面提供一种网络安全防护方法，应用于第二节点控制器，所述第二节点控制器与多个防御系统连接，所述方法包括：
接收管理控制系统发送的检测和防御规则；
将检测和防御规则下发至对应的防御系统进行规则的更新。
本申请第六方面提供一种节点控制器，所述节点控制器与多个防御系统连接；所述节点控制器包括：
接收模块，用于接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述节点控制器连接的任一个防御系统；
处理模块，用于根据所述特征数据建立新的检测和防御规则；
发送模块，用于将所述检测和防御规则发送至至少一个第二防御系统，以使所述至少一个第二防御系统根据所述检测和防御规则检测和拦截所述网络攻击；其中，第二防御系统为与所述节点控制器连接的防御系统。
一种可能设计中，所述发送模块发送检测和防御规则的所述至少一个第二防御系统为在所述第一防御系统之前进行检测防御的至少一个防御系统。
一种可能设计中，至少一个第二防御系统包括第一防御系统。
一种可能设计中，至少一个第二防御系统为在第一防御系统之后进行检测防御的至少一个防御系统。
一种可能设计中，所述处理模块具体用于：
根据所述特征数据分析获取所述网络攻击的攻击特征；
在流量监测规则中加入监测所述攻击特征的检测告警，并定制与所述攻击特征对应的拦截策略，得到所述检测和防御规则。
一种可能设计中，所述发送模块还用于：
将所述网络攻击的所述特征数据发送至管理控制系统，以使所述管理控制系统根据所述特征数据确定网络攻击特征、并根据所述网络攻击特征建立新的检测和防御规则、并将所述检测和防御规则发送至所述管理控制系统管理的包括所述第一节点控制器的至少一个节点控制器。
一种可能设计中，所述发送模块还用于：
将所述检测和防御规则发送至管理控制系统，以使所述管理控制系统将所述检测和防御规则发送至所述管理控制系统管理的除了所述第一节点控制器以外的至少一个节点控制器。
本申请第七方面提供一种节点控制器，所述节点控制器与多个防御系统连接；所述节点 控制器包括：
接收模块，用于接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述第一节点控制器连接的任一个防御系统；
处理模块，用于根据所述网络攻击的所述特征数据建立新的检测和防御规则；
发送模块，用于将所述检测和防御规则通过所述管理控制系统发送至所述管理控制系统管理的至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
一种可能设计中，所述处理模块具体用于：
根据特征数据分析获取网络攻击的攻击特征；
在流量监测规则中加入监测攻击特征的检测告警，并定制与攻击特征对应的拦截策略，得到检测和防御规则。
一种可能设计中，所述发送模块还用于将检测和防御规则发送至至少一个第二防御系统，以使至少一个第二防御系统根据检测和防御规则检测和拦截网络攻击；其中，第二防御系统为与第一节点控制器连接的防御系统。
一种可能设计中，至少一个第二防御系统为在第一防御系统之前进行检测防御的至少一个防御系统。
一种可能设计中，至少一个第二防御系统包括第一防御系统。
一种可能设计中，至少一个第二防御系统为在第一防御系统之后进行检测防御的至少一个防御系统。
一种可能设计中，所述发送模块还用于将网络攻击的特征数据发送至管理控制系统，以使管理控制系统根据特征数据确定网络攻击特征、并根据网络攻击特征建立新的检测和防御规则、并将检测和防御规则发送至管理控制系统管理的至少一个节点控制器。
本申请第八方面提供一种网络安全防护装置，所述网络安全防护装置用于管理多个节点控制器；所述网络安全防护装置包括：
接收模块，用于接收第一节点控制器发送的检测和防御规则，所述检测和防御规则为所述第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，所述第一节点控制器为所述网络安全防护装置管理的任一个节点控制器；
发送模块，用于将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
一种可能设计中，所述接收模块还用于接收并存储第一节点控制器发送的网络攻击的特征数据。
一种可能设计中，所述装置还包括：处理模块用于根据特征数据建立新的检测和防御规则，并将新的检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
一种可能设计中，至少一个节点控制器可以包括第一节点控制器，也可以包括除了第一节点控制器之外的其他控制器。
本申请第九方面提供一种网络安全防护装置，所述网络安全防护装置用于管理多个节点控制器；所述网络安全防护装置包括：
接收模块，用于接收第一节点控制器发送的网络攻击的特征数据，所述第一节点控制器 为所述管理控制系统管理的任一个节点控制器；
处理模块，用于根据所述特征数据建立新的检测和防御规则；
发送模块，用于将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
一种可能设计中，所述处理模块具体用于：
根据特征数据分析获取网络攻击的攻击特征；
在流量监测规则中加入监测攻击特征的检测告警，并定制与攻击特征对应的拦截策略，得到检测和防御规则。
一种可能设计中，所述接收模块还用于接收第一节点控制器发送的检测和防御规则，检测和防御规则为第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，第一节点控制器为管理控制系统管理的任一个节点控制器；
所述发送模块还用于将检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
本申请第十方面提供一种节点控制器，所述节点控制器与多个防御系统连接，所述节点控制器包括：
接收模块，接收管理控制系统发送的检测和防御规则；
发送模块，用于将所述检测和防御规则下发至对应的防御系统进行规则的更新。
本申请第十一方面提供一种节点控制器，该节点控制器包括至少一个处理器、存储器和通信接口。所述至少一个处理器、所述存储器和所述通信接口均通过总线连接；所述存储器存储计算机执行指令；所述至少一个处理器执行所述存储器存储的计算机执行指令，使得所述节点控制器通过所述通信接口与防御系统或者管理控制系统进行数据交互来执行上述第一方面或者第一方面的的各种可能设计或者第二方面或者第二方面的各种可能设计提供的网络安全防护方法。
本申请第十二方面提供一种网络安全防护装置，该网络安全防护装置包括至少一个处理器、存储器和通信接口。所述至少一个处理器、所述存储器和所述通信接口均通过总线连接；所述存储器存储计算机执行指令；所述至少一个处理器执行所述存储器存储的计算机执行指令，使得所述网络安全防护装置通过所述通信接口与节点控制器进行数据交互来执行上述第三方面或者第三方面的的各种可能设计或者第四方面或者第四方面的各种可能设计提供的网络安全防护方法。
本申请第十三方面提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当节点控制器的至少一个处理器执行该计算机执行指令时，节点控制器执行上述第一方面或者第一方面的的各种可能设计或者第二方面或者第二方面的各种可能设计提供的网络安全防护方法。
本申请第十四方面提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当网络安全防护装置的至少一个处理器执行该计算机执行指令时，网络安全防护装置执行上述第三方面或者第三方面的的各种可能设计或者第四方面或者第四方面的各种可能设计提供的网络安全防护方法。
本申请第十五方面提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中。节点控制器的至少一个处理器可以从计算 机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得节点控制器实施第一方面或者第一方面的的各种可能设计或者第二方面或者第二方面的各种可能设计提供的网络安全防护方法。
本申请第十六方面提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中。网络安全防护装置的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得网络安全防护装置实施上述第三方面或者第三方面的的各种可能设计或者第四方面或者第四方面的各种可能设计提供的网络安全防护方法。
本申请提供的网络安全防护方法和装置，节点控制器接收连接控制的任一个防御系统发送的网络攻击的特征数据，根据特征数据建立新的检测和防御规则，将检测和防御规则发送至至少一个防御系统，以使接收到新的检测和防御规则的防御系统对该网络攻击进行检测和拦截网络攻击，或者通过管理控制系统发送给其他的节点控制器，然后发送给其他节点控制器控制的多个防御系统。实现多个防御系统之间的联动或者不同的节点控制器之间的联动，实现多个防御系统同时对该攻击的检测和防御，提高入侵发现和防御能力，有效减轻单一防御系统的防御压力，避免单一防御系统的局限性，各防御系统的数据共享，建立强大全面的安全数据中心提供强大的修复能力。
附图说明
图1为常规的网络安全防护系统示意图；
图2为本发明提供的网络安全防护系统架构示意图；
图3为本发明提供的网络安全防护系统各个节点装置的功能模块示意图；
图4为本发明网络安全防护方法实施例一的流程图；
图5为本发明网络安全防护方法实施例二的流程图；
图6为本发明网络安全防护方法实施例三的流程图；
图7为本发明节点控制器实施例一的结构示意图；
图8为本发明网络安全防护装置实施例一的结构示意图；
图9为本发明节点控制器实施例三的结构示意图；
图10为本发明节点控制器实施例四的结构示意图；
图11为本发明网络安全防护装置实施例三的结构示意图。
具体实施方式
图1所示的安全防护系统中，单点的防御系统被黑客突破后带来的防御流量压力变大。单一的节点防御系统的检测特征单薄，对新型的网络攻击手段不能有效识别。当某一节点的防御系统发现了新型的攻击方法之后不能有效的通知到另外的防御节点或者延迟很久才能人工通知到运维人员来进行规则的更新。各个防御系统单一作战不能有效跟上层或者相邻的防御系统进行有效交流，不能及时更新检测特征来进行防御拦截动作。
为了克服这些问题，本方案提供的网络安全防护系统上增加了节点控制器(也称为节点控制中心)和管理控制系统(也称为管理中心)，每个节点控制器分别与下层的多个防御系统连接，就层次而言相当于这些防御系统的”上司”。节点控制器和管理控制系统可以实现 节点直接的联动，也能让单个防御节点的防御服务系统之间联动起来，实现共同防御。图2为本发明提供的网络安全防护系统架构示意图，如图2所示，提供一种具体的网络安全防护系统，管理控制系统管理第一节点控制器和第二节点控制器，第一节点控制器和第二节点控制器分别连接防ddos攻击(英文：Anti Distributed Denial of Service，简称：Anti-Ddos)、入侵防御系统(英文：Intrusion Prevention System，简称：IPS)、防火墙(英文：firewall，简称：FW)、入侵检测系统(英文：Intrusion Detection Systems，简称：IDS)、网站应用级入侵防御系统(英文：Web Application Firewall，简称：WAF)、基于主机的入侵防御(英文：Host-based Intrusion Prevention System，简称：HIPS)、基于主机的检测系统(英文：Host-based Intrusion Detection Systems，简称：HIDS)等防御系统，然后防御系统下层与虚拟机(英文：virtual machine，简称：VM)连接，进行安全防护。
在具体实施中，节点控制器可以接收到各个防御系统发现的网络攻击或黑客攻击的特征数据，根据这些特征数据建立新的检测和防御规则，然后将更新后的检测和防御规则下发通知到其他相应的防御系统，由对应功能的防御系统进行检测和拦截这些黑客攻击；实现同一防御节点下服务之间的联动；并且该节点控制器将新型的网络攻击特征上报到了管理控制系统，管理控制系统更新系统中的检测和防御规则并将这些更新内容实时通知到所有节点控制器，然后由节点控制器来调度分配任务给相应的防御系统。或者节点控制器将根据特征数据重新建立的检测和防御规则直接通过管理控制系统发送到其他的节点控制器，以使其他的节点控制器也可以对检测和防御规则进行更新，这样就实现了节点之间的联动防御。
图3为本发明提供的网络安全防护系统各个节点装置的功能模块示意图，节点控制器(节点控制中心)和防御系统以及管理控制系统的连接关系如图3所示，下面对各个装置进行具体介绍。
首先介绍节点控制器，节点控制器部署有数据存储中心、关联分析系统、规则系统、通讯调度系统。
数据存储中心，用于将节点处的防御系统上报的数据和攻击的特征数据存储在系统中。
关联分析系统，用于通过将各个防御系统上报到数据存储中心的数据进行强关联，通过建立的数据模型进行数据分析处理，分析出攻击特征；例如：当IDS系统发现了网络流量端口异常扫描行为，将异常的网络流量数据上报到节点控制器的数据存储中心；而此时HIDS将主机中的进程访问的网络端口信息也上报到了节点的数据存储中心，通过进程的行为和网络端口的数据进行关联分析，还原黑客攻击的入侵特征，得出此特征可能是APT攻击；而关联分析系统就是通过IDS上报的网络流量和HIDS上报的进程访问的网络端口信息数据进行关联，得出该网络攻击的特征数据。
规则系统，用于根据关联分析的结果更新相应的检测和防御规则；本身也维护了防御系统的已有的检测和防御规则；例如之上的关联分析系统通过关联分析，得出了APT的攻击特征数据，那么规则系统就更新IDS的流量检测和防御规则，规则中加入对此类网络特征数据包的检测告警；同时也更新HIDS的主机中此进程行为的检测特征，并制定此类网络攻击包和进程行为的防御规则(也称为拦截策略)。
通讯调度系统，用于通知节点下面的各个防御系统进行检测和防御规则的更新，并将检测和防御规则下发到各个防御系统；同时将这些策略上报给管理控制系统；同时也负责接收管理控制系统下发的检测和防御规则，并用于接收下面的防御系统上报的特征数据。
其次，介绍管理控制系统，本发明中管理控制系统包括数据存储中心，数据分析中心，规则策略系统，节点管理系统。
数据存储中心，用于对各节点控制器上报的数据(包括网络攻击的特征数据或者节点控制器发送的检测和防御规则)进行存储。数据分析中心，用于对存储中心的数据进行分析，建立模型。规则策略系统，用于根据数据分析的攻击的特征数据，通过建立的模型进行规则和策略的制定以及更新并同步给通讯调度系统；同上面的节点控制器的规则系统功能一样。节点管理系统，用于管理各节点控制器，各节点控制器的健康度以及心跳信息。通讯调度系统，用于负责接收各节点控制器上报的数据和攻击的特征数据，并下发监测和防御规则到各节点控制器。
基于上述图2所示的网络安全防护系统架构以及图3所示的网络安全防护系统的每个节点装置的功能，下面以几个具体的实施例来介绍本发明提供的网络安全防护方法。
图4为本发明网络安全防护方法实施例一的流程图，如图4所示，该方案提供的网络安全防护方法的具体步骤为：
S101：接收第一防御系统发送的网络攻击的特征数据。
在本步骤中，第一节点控制器(不特指某个节点控制器，可以是系统中任意一个节点控制器)，防御系统发现了异常的网络特征或者异常进程访问特征，则获取这些特征数据，上报给节点控制器，该节点控制器则接收到下层的任意一个防御系统发送的网络攻击的特征数据(也称为攻击特征)。
S102：根据所述特征数据建立新的检测和防御规则。
在本步骤中，节点控制器根据特征数据分析获取所述网络攻击的攻击特征；在目前的流量监测规则中加入监测所述攻击特征的检测告警，并定制与所述攻击特征对应的拦截策略，得到所述检测和防御规则。
例如：当IDS系统发现了网络流量端口异常扫描行为，将异常的网络流量数据上报；而此时HIDS将主机中的进程访问的网络端口信息也上报到了节点控制器，通过进程的行为和网络端口的数据进行关联分析，还原黑客攻击的入侵特征，得出此特征可能是APT攻击，即通过IDS上报的网络流量和HIDS上报的进程访问的网络端口信息数据进行关联，得出的攻击特征。然后根据关联分析的结果更新相应的检测和防御规则。即更新IDS的流量检测规则，规则中加入对此类网络特征数据包的检测告警；同时也更新HIDS的主机中此进程行为的检测特征，并制定此类网络攻击包和进程行为的防御规则，得到新的检测和防御规则。
S103：将所述检测和防御规则发送至至少一个第二防御系统。
在本步骤中，第一节点控制器在根据接收到的攻击得到建立了新的检测和防御规则之后，需要将该检测和防御规则通知给一个或者多个防御系统，进行规则更新以对该网络攻击进行防御。
该方案中的至少一个第二防御系统，可以包括第一防御系统，也可以包括先与第一防御系统进行检测和防御的上层防御系统，还可以包括在第一防御系统之后再进行检测和防御的下层防御系统，对此本方案不做限制。
即至少一个第二防御系统为在第一防御系统之前进行检测防御的至少一个防御系统。
可选的，至少一个第二防御系统包括第一防御系统。
可选的，至少一个第二防御系统包括在第一防御系统之后进行检测防御的至少一个防御 系统。
S104：至少一个第二防御系统根据所述检测和防御规则检测和拦截所述网络攻击。
在本步骤中，接收到该新的检测和防御规则的第二防御系统对本地的策略进行更新，对前述的网络攻击进行检测和拦截。
本实施例提供的网络安全防护方法，设置节点控制器连接多个防御系统，每个防御系统可以将检测到的攻击的特征数据发送至节点控制器，节点控制器生成检测和防御规则并分别发送给该节点控制器管理的多个防御系统，以实现多个防御系统同时对该攻击的检测和防御，提高入侵发现和防御能力，有效减轻单一防御系统的防御压力，同时能够避免单一防御系统局限性。
可选的，在上述实施例一的基础上，步骤S102之前，第一节点控制器还可以将网络攻击的特征数据发送至管理控制系统，以使管理控制系统根据特征数据确定网络攻击特征、并根据网络攻击特征建立新的检测和防御规则、并将检测和防御规则发送至管理控制系统管理的至少一个节点控制器，该至少一个节点控制器可以是管理控制系统管理的部分或者全部节点控制器。
本方案的实质是将网络攻击的特征数据上报至管理控制系统，由管理控制系统对特征数据进行分析处理，得到新的检测和防御规则，然后通知该至少一个节点控制器(包括第一控制节点)，节点控制器再通知给各个防御系统进行检测和防御规则更新。
可选的，在上述实施例一的基础上，步骤S102之后，该第一节点控制器还可以将检测和防御规则发送至管理控制系统，以使管理控制系统将检测和防御规则发送至管理控制系统管理的除了第一控制节点以外的至少一个节点控制器。
在管理控制系统侧，接收第一节点控制器发送的检测和防御规则，所述检测和防御规则为所述第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，所述第一节点控制器为所述管理控制系统管理的任一个节点控制器；将所述检测和防御规则发送至除了第一控制节点以外的至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
该方案是与实施例并列的方案，本方案的实质是节点控制器分析处理得到的检测和防御规则直接上报至管理控制系统，管理控制系统将该新的检测和防御规则转发至多个节点控制器，节点控制器再通知给各个防御系统进行检测和防御规则更新。
通过上述的可选方案，建立强大全面的安全数据中心，提供强大的修复能力，确保单点防御系统有效的运行，大大提高我们的入侵发现和防御能力,构建业界最有竞争力的防御体系。
图5为本发明网络安全防护方法实施例二的流程图，如图5所示，该方案的具体实现步骤为：
S201：接收第一防御系统发送的网络攻击的特征数据。
S202：根据所述网络攻击的所述特征数据建立新的检测和防御规则。
上述步骤中，第一节点控制器接收网络攻击的特征数据，并根据特征数据建立检测和防御规则的具体实现与实施例一类似，在此不再赘述。
S203：将所述检测和防御规则通过管理控制系统发送至所述管理控制系统管理的至少一个节点控制器。
第一节点控制器将新的检测和防御规则发送至管理控制系统，由管理控制系统将新的检测和防御规则发送给除了第一控制节点以外的至少一个节点控制器(例如图2中所述的第二节点控制器)。
在管理控制系统侧，接收第一节点控制器发送的检测和防御规则，所述检测和防御规则为所述第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，所述第一节点控制器为所述管理控制系统管理的任一个节点控制器；将所述检测和防御规则发送至除了第一控制节点以外的至少一个节点控制器(例如图2中所述的第二节点控制器)，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
在该第二节点控制器侧，接收管理控制系统发送的检测和防御规则，并将所述检测和防御规则下发至对应的防御系统进行规则的更新。具体的可以实现为S204和S205。
S204：将所述检测和防御规则发送至至少一个防御系统。
S205：将对应的防御系统的规则更新为所述检测和防御规则。
在上述步骤中，其他的节点控制器在接收到管理控制系统发送的检测和防御规则之后，将该检测和防御规则发送给其下层连接的一个或者多个防御系统，该至少一个防御系统可以是与该检测和防御规则对应的防御系统，也可以是与检测和防御规则对应的防御系统的上层的防御系统，也可以是与检测和防御规则对应的防御系统的下层的防御系统，对此本方案不做限制。
该些防御系统接收到新的检测和防御规则之后，对本地的策略进行更新，对前述的网络攻击进行检测和拦截。
本实施例提供的网络安全防护方法，每个防御系统可以将检测到的攻击的特征数据发送至节点控制器，节点控制器生成检测和防御规则并发送至管理控制系统，以使其他节点控制器对连接的防御系统进行检测和防御规则的更新，以实现防御系统之间的数据共享，大大提高我们的入侵发现和防御能力,构建业界最有竞争力的防御体系。还可以建立全面的安全数据中心。
可选的，在上述实施例二的基础上，S201之后，第一节点控制器可以直接上特征数据发送至管理控制系统，由管理控制系统根据特征数据建立新的检测和防御规则。即管理控制系统接收第一节点控制器发送的网络攻击的特征数据，并根据所述特征数据建立新的检测和防御规则，然后管理控制系统将建立的所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
该些节点控制器接收管理控制系统发送的检测和防御规则；将所述检测和防御规则下发至对应的防御系统进行规则的更新。
上述方案中，同一个节点控制器的防御系统之间实现共同治敌，还可以通过管理控制系统通知其他的节点控制器对对应的防御系统进行检测和防御规则的更新，防患于未然，实现数据共享，大大提高入侵发现和防御能力，避免单一防御系统的局限性，缓解防御系统的压力。同时可以提供强大的修复能力，确保单点防御系统的有效运行。
上述实施例一或二是基于图2系统架构的方案说明，下面基于图3所示的各个节点装置的具体功能模块，对该网络安全防护方法进行说明。
图6为本发明网络安全防护方法实施例三的流程图，如图6所示，该网络安全防护方法的一种具体实现步骤为：
1)、发现新的网络攻击的特征数据，上报到节点控制器1。
多个防御系统发现了异常网络特征和异常进程访问特征，然后将这些网络攻击的特征数据上报到节点控制器1。
2)、上报到存储中心。
节点控制器1的通讯调度系统将防御系统上报的数据传送到数据存储中心。
3)、数据和攻击特征关联分析。
关联分析系统通过各防御系统上报的数据进行关联分析，比如还原一个进程的网络行为，将访问的端口，访问的文件信息，修改的文件信息，时间，权限等数据信息多维度对比，关联起来分析。
4)、更新检测和防御规则。
上述关联分析系统关联分析得出此类网络攻击特征和恶意进程特征，通知给规则策略系统；规则策略系统将关联分析的结果进行解读，然后更新此类攻击的检测和拦截规则。
5)、开启下发和通知任务。
节点控制器1的规则策略系统将更新后的检测和拦截规则同步给通讯调度系统；由通讯调度系统负责更新规则的下发给各个防御系统。
6)、通知并下发新的检测和防御规则到当前节点下的各个防御系统。
节点控制器1的的通讯调度系统将更新后的检测和防御规则下发给下面的相应的防御系统，接收新的检测和防御规则的防御系统可以是Anti-Ddos本身，也可以是其上层或者下层的其他防御系统，还可以是该节点控制器下的所有防御系统。
7)、将新型的网络攻击特征和数据上报到管理控制系统。
该第一节点控制器1的通讯调度系统还可以将发现的新型网络攻击的特征数据的上报到管理控制系统。
8)、根据节点控制器1上报的数据和攻击特征进行实时分析并更新升级自己的检测和防御规则。
管理控制系统对节点控制器1上报的网路攻击的特征数据进行分析，如同节点控制器1的关联分析一样，根据网络，端口，修改文件，时间，权限等数据进行关联，还原攻击行为。
9)、通知并下发新的检测和防御规则到其余节点控制器。
管理控制系统对关联分析的结果进行解读，然后更新此类攻击的检测和拦截规则；(或者直接利用节点控制器的新的检测和防御规则，不需要管理控制系统再进行关联分析得出这些新的检测和防御规则)，然后将更新的检测和防御规则下发到其余的节点控制器(例如节点控制器2)。
10)通知并下发新的检测和防御规则到当前节点下的各个防御系统。
其他的节点控制器收到管理控制系统下发的检测和防御规则后就由通讯调度系统负责将新的检测和防御规则下发到该节点控制器下面的相应的防御系统进行规则更新。
在上述方案中，所有的防御系统上报到节点控制器的数据格式都是按照预先自定义的数据格式进行数据的上报，例如：网络数据有网络数据的格式，进程信息有进程的数据字段和格式等；对规则和策略的格式制定也是预先定义好的，只接收和生成预先自定义且能有效识别的文件；节点控制器和管理控制系统也只处理定义的签名的规则和策略，且节点控制器和管理控制系统的规则和策略文件格式是相同的。
本发明提供的网络安全防护方法，多个防御系统的数据上报到节点控制器，节点控制器根据数据和攻击特征建立并更新检测和防御规则；然后将建立的新的检测和防御规则下发到同节点下面的另外防御系统，实现共同制敌；另外当前节点可以将新发现的网络攻击特征上报到管理控制系统，由管理控制系统来通知其余节点下的防御系及时更新检测和防御规则，防患于未然，大大提高入侵发现和防御能力，构件更为安全的防御体系，避免单一防御系统的局限性，减少单一防御系统的防御压力。
图7为本发明节点控制器实施例一的结构示意图，如图7所示，所述节点控制器10包括：
接收模块11，用于接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述节点控制器连接的任一个防御系统；
处理模块12，用于根据所述特征数据建立新的检测和防御规则；
发送模块13，用于将所述检测和防御规则发送至至少一个第二防御系统，以使所述至少一个第二防御系统根据所述检测和防御规则检测和拦截所述网络攻击；其中，第二防御系统为与所述节点控制器连接的防御系统。
可选的，所述发送模块13发送检测和防御规则的所述至少一个第二防御系统为在所述第一防御系统之前进行检测防御的至少一个防御系统。
可选的，所述处理模块12具体用于：
根据所述特征数据分析获取所述网络攻击的攻击特征；
在流量监测规则中加入监测所述攻击特征的检测告警，并定制与所述攻击特征对应的拦截策略，得到所述检测和防御规则。
可选的，所述发送模块13还用于：
将所述网络攻击的所述特征数据发送至管理控制系统，以使所述管理控制系统根据所述特征数据确定网络攻击特征、并根据所述网络攻击特征建立新的检测和防御规则、并将所述检测和防御规则发送至所述管理控制系统管理的包括所述第一节点控制器的至少一个节点控制器。
可选的，所述发送模块13还用于：
将所述检测和防御规则发送至管理控制系统，以使所述管理控制系统将所述检测和防御规则发送至所述管理控制系统管理的除了所述第一节点控制器以外的至少一个节点控制器。
可选的，所述发送模块13发送检测和防御规则的所述至少一个第二防御系统为在所述第一防御系统之前进行检测防御的至少一个防御系统。
可选的，所述发送模块13发送检测和防御规则的至少一个第二防御系统包括第一防御系统。
可选的，所述发送模块13发送检测和防御规则的至少一个第二防御系统为在第一防御系统之后进行检测防御的至少一个防御系统。
上述实施例提供的节点控制器，用于执行前述方法任一实施例中的节点控制器的技术方案，其实现原理和技术效果类似，在此不再赘述。
可选的，在该节点控制器的实施例二中，
接收模块11，用于接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述第一节点控制器连接的任一个防御系统；
处理模块12，用于根据所述网络攻击的所述特征数据建立新的检测和防御规则；
发送模块13，用于将所述检测和防御规则通过所述管理控制系统发送至所述管理控制系统管理的至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
可选的，所述处理模块12具体用于：
根据特征数据分析获取网络攻击的攻击特征；
在流量监测规则中加入监测攻击特征的检测告警，并定制与攻击特征对应的拦截策略，得到检测和防御规则。
可选的，所述发送模块13还用于将检测和防御规则发送至至少一个第二防御系统，以使至少一个第二防御系统根据检测和防御规则检测和拦截网络攻击；其中，第二防御系统为与第一节点控制器连接的防御系统。
可选的，至少一个第二防御系统为在第一防御系统之前进行检测防御的至少一个防御系统。
可选的，至少一个第二防御系统包括第一防御系统。
可选的，至少一个第二防御系统为在第一防御系统之后进行检测防御的至少一个防御系统。
可选的，所述发送模块13还用于将网络攻击的特征数据发送至管理控制系统，以使管理控制系统根据特征数据确定网络攻击特征、并根据网络攻击特征建立新的检测和防御规则、并将检测和防御规则发送至管理控制系统管理的至少一个节点控制器。
上述实施例提供的节点控制器，用于执行前述方法任一实施例中的节点控制器的技术方案，其实现原理和技术效果类似，在此不再赘述。
图8为本发明网络安全防护装置实施例一的结构示意图，如图8所示，所述网络安全防护装置20用于管理多个节点控制器；所述网络安全防护装置20包括：
接收模块21，用于接收第一节点控制器发送的检测和防御规则，所述检测和防御规则为所述第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，所述第一节点控制器为所述网络安全防护装置管理的任一个节点控制器；
发送模块22，用于将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
可选的，所述至少一个节点控制包括除了所述第一节点控制器意外的一个或多个节点控制器。
可选的，所述接收模块21还用于接收并存储第一节点控制器发送的网络攻击的特征数据。
可选的，所述装置还包括：处理模块23，用于根据特征数据建立新的检测和防御规则，并将新的检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
可选的，至少一个节点控制器可以包括第一节点控制器，也可以包括除了第一节点控制器之外的其他控制器。
本实施例提供的网络安全防护装置，用于执行前述方法任一实施例中的管理控制系统的技术方案，其实现原理和技术效果类似，在此不再赘述。
在本发明网络安全防护装置实施例二中，可选的，该网络安全防护装置20的各个模块还 用于执行下面的功能。
接收模块21，用于接收第一节点控制器发送的网络攻击的特征数据，所述第一节点控制器为所述管理控制系统管理的任一个节点控制器；
处理模块23，用于根据所述特征数据建立新的检测和防御规则；
发送模块22，用于将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
可选的，所述处理模块23具体用于：
根据特征数据分析获取网络攻击的攻击特征；
在流量监测规则中加入监测攻击特征的检测告警，并定制与攻击特征对应的拦截策略，得到检测和防御规则。
可选的，所述接收模块21还用于接收第一节点控制器发送的检测和防御规则，检测和防御规则为第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，第一节点控制器为管理控制系统管理的任一个节点控制器；
所述发送模块22还用于将检测和防御规则发送至至少一个节点控制器，以使至少一个节点控制器将对应的防御系统的规则更新为检测和防御规则。
本实施例提供的网络安全防护装置，用于执行前述方法任一实施例中的管理控制系统的技术方案，其实现原理和技术效果类似，在此不再赘述。
图9为本发明节点控制器实施例三的结构示意图，如图9所示，所述节点控制器30与多个防御系统连接，所述节点控制器30包括：
接收模块31，接收管理控制系统发送的检测和防御规则；
发送模块32，用于将所述检测和防御规则下发至对应的防御系统进行规则的更新。
本实施例提供的节点控制器，用于执行前述方法任一实施例中的节点控制器的技术方案，其实现原理和技术效果类似，在此不再赘述。
前述的节点控制器和管理控制系统的具体实现中，接收模块可以被实现为接收器，发送模块可以被实现为发送器，处理模块可以被实现为处理器，数据和程序代码可存储在存储器中，由控制器根据相应的程序指令控制执行。
在上述节点控制器或者管理控制系统的具体实现中，应理解，处理器可以是中央处理单元(英文：Central Processing Unit，简称：CPU)，还可以是其他通用处理器、数字信号处理器(英文：Digital Signal Processor，简称：DSP)、专用集成电路(英文：Application Specific Integrated Circuit，简称：ASIC)等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
图10为本发明节点控制器实施例四的结构示意图，如图10所示，该节点控制器40包括至少一个处理器41、存储器42和通信接口43。所述至少一个处理器41、所述存储器42和所述通信接口43均通过总线44连接；所述存储器42存储计算机执行指令；所述至少一个处理器41执行所述存储器42存储的计算机执行指令，使得所述节点控制器40通过所述通信接口43与防御系统或者管理控制系统进行数据交互来执行前述任一实施例中节点控制器侧的各种可能的网络安全防护方法。
图11为本发明网络安全防护装置实施例三的结构示意图，如图11所示，该网络安全防 护装置50包括至少一个处理器51、存储器52和通信接口53。所述至少一个处理器51、所述存储器52和所述通信接口53均通过总线54连接；所述存储器52存储计算机执行指令；所述至少一个处理器51执行所述存储器52存储的计算机执行指令，使得所述网络安全防护装置通过所述通信接口与节点控制器进行数据交互来执行上述任一实施例中管理控制系统的各种可能设计提供的网络安全防护方法。
在上述节点控制器40中的处理器41或者网络安全防护装置50的处理器51，可以包括不同类型的处理器，或者包括相同类型的处理器；处理器可以是以下的任一种：中央处理器(Central Processing Unit，简称CPU)、ARM处理器、现场可编程门阵列(Field Programmable Gate Array，简称FPGA)、专用处理器等具有计算处理能力的器件。一种可选实施方式，所述至少一个处理器还可以集成为众核处理器。
在上述节点控制器40中的存储器42或者网络安全防护装置50的存储器52可以是以下的任一种或任一种组合：随机存取存储器(Random Access Memory，简称RAM)、只读存储器(read only memory，简称ROM)、非易失性存储器(non-volatile memory，简称NVM)、固态硬盘(Solid State Drives，简称SSD)、机械硬盘、磁盘、磁盘整列等存储介质。
通信接口43和通信接口53各自用于节点控制器和网络安全防护装置与其他设备进行数据交互。通信接口可以是以下的任一种或任一种组合：网络接口(例如以太网接口)、无线网卡等具有网络接入功能的器件。
总线44和总线54各自可以包括地址总线、数据总线、控制总线等，为便于表示，图10和图11中用一条粗线表示该总线(总线44或总线54)。该总线可以是以下的任一种或任一种组合：工业标准体系结构(Industry Standard Architecture，简称ISA)总线、外设组件互连标准(Peripheral Component Interconnect，简称PCI)总线、扩展工业标准结构(Extended Industry Standard Architecture，简称EISA)总线等有线数据传输的器件。
此外，本发明实施例里还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当节点控制器的至少一个处理器执行该计算机执行指令时，节点控制器执行上述各种可能设计提供的网络安全防护方法。
本发明实施例里还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当网络安全防护装置的至少一个处理器执行该计算机执行指令时，网络安全防护装置执行上述实施例中的各种可能设计提供的网络安全防护方法。
本发明实施例里还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中。节点控制器的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得节点控制器实施前述方法实施例中的各种可能设计提供的网络安全防护方法。
本发明实施例里还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中。网络安全防护装置的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得网络安全防护装置实施上述的各种可能设计或者第四方面或者第四方面的各种可能设计提供的网络安全防护方法。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (18)

  1. 一种网络安全防护方法，其特征在于，应用于第一节点控制器，所述第一节点控制器与多个防御系统连接；所述方法包括：
    接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述第一节点控制器连接的任一个防御系统；
    根据所述特征数据建立新的检测和防御规则；
    将所述检测和防御规则发送至至少一个第二防御系统，以使所述至少一个第二防御系统根据所述检测和防御规则检测和拦截所述网络攻击；其中，第二防御系统为与所述第一节点控制器连接的防御系统。
  2. 根据权利要求1所述的方法，其特征在于，所述至少一个第二防御系统为在所述第一防御系统之前进行检测防御的至少一个防御系统。
  3. 根据权利要求1或2所述的方法，其特征在于，所述根据所述特征数据建立新的检测和防御规则，包括：
    根据所述特征数据分析获取所述网络攻击的攻击特征；
    在流量监测规则中加入监测所述攻击特征的检测告警，并定制与所述攻击特征对应的拦截策略，得到所述检测和防御规则。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述方法还包括：
    将所述网络攻击的所述特征数据发送至管理控制系统，以使所述管理控制系统根据所述特征数据确定网络攻击特征、并根据所述网络攻击特征建立新的检测和防御规则、并将所述检测和防御规则发送至所述管理控制系统管理的包括所述第一节点控制器的至少一个节点控制器。
  5. 根据权利要求1至3任一项所述的方法，其特征在于，所述方法还包括：
    将所述检测和防御规则发送至管理控制系统，以使所述管理控制系统将所述检测和防御规则发送至所述管理控制系统管理的除了所述第一节点控制器以外的至少一个节点控制器。
  6. 一种网络安全防护方法，其特征在于，应用于第一节点控制器，所述第一节点控制器与多个防御系统连接；所述方法包括：
    接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述第一节点控制器连接的任一个防御系统；
    根据所述网络攻击的所述特征数据建立新的检测和防御规则；
    将所述检测和防御规则通过管理控制系统发送至所述管理控制系统管理的至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
  7. 一种网络安全防护方法，其特征在于，应用于管理控制系统，所述管理控制系统用于管理多个节点控制器；所述方法包括：
    接收第一节点控制器发送的检测和防御规则，所述检测和防御规则为所述第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，所述第一节点控制器为所述管理控制系统管理的任一个节点控制器；
    将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
  8. 一种网络安全防护方法，其特征在于，应用于管理控制系统，所述管理控制系统用于管理多个节点控制器；所述方法包括：
    接收第一节点控制器发送的网络攻击的特征数据，所述第一节点控制器为所述管理控制系统管理的任一个节点控制器；
    根据所述特征数据建立新的检测和防御规则；
    将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
  9. 一种网络安全防护方法，其特征在于，应用于第二节点控制器，所述第二节点控制器与多个防御系统连接，所述方法包括：
    接收管理控制系统发送的检测和防御规则；
    将所述检测和防御规则下发至对应的防御系统进行规则的更新。
  10. 一种节点控制器，其特征在于，所述节点控制器与多个防御系统连接；所述节点控制器包括：
    接收模块，用于接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述节点控制器连接的任一个防御系统；
    处理模块，用于根据所述特征数据建立新的检测和防御规则；
    发送模块，用于将所述检测和防御规则发送至至少一个第二防御系统，以使所述至少一个第二防御系统根据所述检测和防御规则检测和拦截所述网络攻击；其中，第二防御系统为与所述节点控制器连接的防御系统。
  11. 根据权利要求10所述的节点控制器，其特征在于，所述发送模块发送检测和防御规则的所述至少一个第二防御系统为在所述第一防御系统之前进行检测防御的至少一个防御系统。
  12. 根据权利要求10或11所述的节点控制器，其特征在于，所述处理模块具体用于：
    根据所述特征数据分析获取所述网络攻击的攻击特征；
    在流量监测规则中加入监测所述攻击特征的检测告警，并定制与所述攻击特征对应的拦截策略，得到所述检测和防御规则。
  13. 根据权利要求10至12任一项所述的节点控制器，其特征在于，所述发送模块还用于：
    将所述网络攻击的所述特征数据发送至管理控制系统，以使所述管理控制系统根据所述特征数据确定网络攻击特征、并根据所述网络攻击特征建立新的检测和防御规则、并将所述检测和防御规则发送至所述管理控制系统管理的包括所述第一节点控制器的至少一个节点控制器。
  14. 根据权利要求10至12任一项所述的节点控制器，其特征在于，所述发送模块还用于：
    将所述检测和防御规则发送至管理控制系统，以使所述管理控制系统将所述检测和防御规则发送至所述管理控制系统管理的除了所述第一节点控制器以外的至少一个节点控制器。
  15. 一种节点控制器，其特征在于，所述节点控制器与多个防御系统连接；所述节点控制器包括：
    接收模块，用于接收第一防御系统发送的网络攻击的特征数据，所述第一防御系统为与所述第一节点控制器连接的任一个防御系统；
    处理模块，用于根据所述网络攻击的所述特征数据建立新的检测和防御规则；
    发送模块，用于将所述检测和防御规则通过所述管理控制系统发送至所述管理控制系统管理的至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
  16. 一种网络安全防护装置，其特征在于，所述网络安全防护装置用于管理多个节点控制器；所述网络安全防护装置包括：
    接收模块，用于接收第一节点控制器发送的检测和防御规则，所述检测和防御规则为所述第一节点控制器根据检测到的新的网络攻击的特征数据建立的规则，所述第一节点控制器为所述网络安全防护装置管理的任一个节点控制器；
    发送模块，用于将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
  17. 一种网络安全防护装置，其特征在于，所述网络安全防护装置用于管理多个节点控制器；所述网络安全防护装置包括：
    接收模块，用于接收第一节点控制器发送的网络攻击的特征数据，所述第一节点控制器为所述管理控制系统管理的任一个节点控制器；
    处理模块，用于根据所述特征数据建立新的检测和防御规则；
    发送模块，用于将所述检测和防御规则发送至至少一个节点控制器，以使所述至少一个节点控制器将对应的防御系统的规则更新为所述检测和防御规则。
  18. 一种节点控制器，其特征在于，所述节点控制器与多个防御系统连接，所述节点控制器包括：
    接收模块，接收管理控制系统发送的检测和防御规则；
    发送模块，用于将所述检测和防御规则下发至对应的防御系统进行规则的更新。
PCT/CN2017/099868 2016-11-24 2017-08-31 网络安全防护方法和装置 WO2018095098A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611042445.1A CN106657019A (zh) 2016-11-24 2016-11-24 网络安全防护方法和装置
CN201611042445.1 2016-11-24

Publications (1)

Publication Number Publication Date
WO2018095098A1 true WO2018095098A1 (zh) 2018-05-31

Family

ID=58812509

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/099868 WO2018095098A1 (zh) 2016-11-24 2017-08-31 网络安全防护方法和装置

Country Status (2)

Country Link
CN (1) CN106657019A (zh)
WO (1) WO2018095098A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113242258A (zh) * 2021-05-27 2021-08-10 安天科技集团股份有限公司 一种主机集群的威胁检测方法和装置

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106657019A (zh) * 2016-11-24 2017-05-10 华为技术有限公司 网络安全防护方法和装置
CN109768949B (zh) * 2017-11-09 2021-09-03 阿里巴巴集团控股有限公司 一种端口扫描处理系统、方法及相关装置
CN108494766A (zh) * 2018-03-21 2018-09-04 北京知道创宇信息技术有限公司 Waf规则管理方法及waf群组
CN108881233B (zh) * 2018-06-21 2021-06-01 中国联合网络通信集团有限公司 防攻击处理方法、装置、设备及存储介质
CN108471430A (zh) * 2018-07-03 2018-08-31 杭州安恒信息技术股份有限公司 一种物联网嵌入式安全防护方法及装置
CN109361534B (zh) * 2018-09-20 2021-10-01 中国航天系统科学与工程研究院 一种网络安全模拟系统
US20200252420A1 (en) * 2019-02-05 2020-08-06 Carrier Corporation Cyber defense and response system for buildings
CN113055395B (zh) * 2021-03-26 2023-09-05 深信服科技股份有限公司 一种安全检测方法、装置、设备及存储介质
CN114024739B (zh) * 2021-11-03 2024-02-06 中国联合网络通信集团有限公司 抗DDoS攻击协同防御方法、平台、设备及介质
CN114301689B (zh) * 2021-12-29 2024-02-23 北京安天网络安全技术有限公司 校园网络安全防护方法、装置、计算设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101184088A (zh) * 2007-12-14 2008-05-21 浙江工业大学 一种多点联动的局域网防火墙协同方法
CN101938459A (zh) * 2010-06-22 2011-01-05 北京豪讯美通科技有限公司 全程全网安全协同防御系统
WO2013041128A1 (en) * 2011-09-20 2013-03-28 Nokia Siemens Networks Oy Multiplexing core networks in ran sharing
CN104639504A (zh) * 2013-11-12 2015-05-20 华为技术有限公司 网络协同防御方法、装置和系统
CN106657019A (zh) * 2016-11-24 2017-05-10 华为技术有限公司 网络安全防护方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101184088A (zh) * 2007-12-14 2008-05-21 浙江工业大学 一种多点联动的局域网防火墙协同方法
CN101938459A (zh) * 2010-06-22 2011-01-05 北京豪讯美通科技有限公司 全程全网安全协同防御系统
WO2013041128A1 (en) * 2011-09-20 2013-03-28 Nokia Siemens Networks Oy Multiplexing core networks in ran sharing
CN104639504A (zh) * 2013-11-12 2015-05-20 华为技术有限公司 网络协同防御方法、装置和系统
CN106657019A (zh) * 2016-11-24 2017-05-10 华为技术有限公司 网络安全防护方法和装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113242258A (zh) * 2021-05-27 2021-08-10 安天科技集团股份有限公司 一种主机集群的威胁检测方法和装置
CN113242258B (zh) * 2021-05-27 2023-11-14 安天科技集团股份有限公司 一种主机集群的威胁检测方法和装置

Also Published As

Publication number Publication date
CN106657019A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
WO2018095098A1 (zh) 网络安全防护方法和装置
US10360062B2 (en) System and method for providing a self-monitoring, self-reporting, and self-repairing virtual asset configured for extrusion and intrusion detection and threat scoring in a cloud computing environment
CA3006003C (en) Dual memory introspection for securing multiple network endpoints
US10567431B2 (en) Emulating shellcode attacks
US9942270B2 (en) Database deception in directory services
EP3214568B1 (en) Method, apparatus and system for processing cloud application attack behaviours in cloud computing system
KR101535502B1 (ko) 보안 내재형 가상 네트워크 제어 시스템 및 방법
JP6083009B1 (ja) Ｓｄｎコントローラ
US10440055B2 (en) Apparatus and method for implementing network deception
US20160078229A1 (en) System And Method For Threat Risk Scoring Of Security Threats
US20170026387A1 (en) Monitoring access of network darkspace
EP3476101B1 (en) Method, device and system for network security
KR101553264B1 (ko) 네트워크 침입방지 시스템 및 방법
WO2016191232A1 (en) Mitigation of computer network attacks
TWI520002B (zh) Protection Method and System of Cloud Virtual Network Security
EP3035636B1 (en) Computer defenses and counterattacks
JP6256773B2 (ja) セキュリティシステム
EP3186921A1 (en) Distributed detection of malicious cloud actors
KR20030049853A (ko) 네트워크 보호 시스템 및 그 운영 방법
WO2020057156A1 (zh) 一种安全管理方法和安全管理装置
Li et al. Research of Intrusion Protection System using correlation policy

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17872912

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17872912

Country of ref document: EP

Kind code of ref document: A1