Method and apparatus for improving network security
AssigneeHuawei Technologies Co., Ltd.
InventorsXiaoxin Wu, Jinming Li
Life of this patent
Estimating the term…
Abstract
A method and an apparatus for improving network security. The method includes obtaining, by a control node, alarm information, where the alarm information includes address information of an attack source that attacks a subnet of at least two subnets and identification information of the attacked subnet of the at least two subnets, using, by the control node, the alarm information to sort the attack sources in descending order of threat levels, and using a sorting result as a blacklist, and sending, by the control node, the obtained blacklist to at least one subnet that is not attacked yet in the network system. The method and apparatus are applicable to collaborative defense among multiple subnets.
Claims17
A method for improving network security in a network comprising a control node in communication with a first subnet and a second subnet, the method comprising:
- obtaining, by the control node, alarm information comprising information of a respective attack source attacking the first subnet and identification information of the first subnet;
- determining threat information of the respective attack source;
- obtaining a threat value of the respective attack source according to the threat information;
- determining a value of an association between the respective attack source and the first subnet based on an attack relationship between the respective attack source and the first subnet by determining the value of the association between the respective attack source and the first subnet according to rs=[(I−aW)−1−I]·bs, where rs represents the value of the association between one of each attack source and the first subnet, bs represents a Boolean vector of the attack relationship between the respective attack source and the first subnet, s represents an identifier of the respective attack source, a represents the threat value of the respective attack source, I represents an identity matrix, and W represents an address of the respective attack source;
- determining, for the first subnet, a danger level imposed by the respective attack source on the first subnet using the threat value of the respective attack source and the value of the association;
- obtaining a blacklist based on the danger level imposed by the respective attack source;
- and
- sending, by the control node, the blacklist to the second subnet.
A control node for improving network security, and configured to communicate with a first subnet and a second subnet, and the control node comprising:
- a processor;
- and
- a storage medium coupled to the processor and comprising instructions that are executable by the processor and that cause the processor to be configured to:
- obtain alarm information comprising information of a respective attack source attacking the first subnet and identification information of the first subnet;
- determine threat information of the respective attack source;
- obtain a threat value of the respective attack source according to the threat information;
- determine a value of an association between the respective attack source and the first subnet according to an attack relationship between the respective attack source and the first subnet by determining the value of the association between the respective attack source and the first subnet according to rs=[(I−aW)−1−I]·bs, wherein rs represents the value of the association between one of each attack source and the first subnet, bs represents a Boolean vector of the attack relationship between the respective attack source and the first subnet, s represents an identifier of the respective attack source, a represents the threat value of the respective attack source, I represents an identity matrix, and W represents an address of the respective attack source;
- determine, for an attacked subnet, a danger level imposed by the respective attack source on the first subnet using the threat value of the respective attack source and the value of the association;
- obtain a blacklist based on the danger level imposed by the respective attack source;
- and
- send the blacklist to the second subnet.
A non-transitory computer readable medium storing codes for improving network security that, when executed by a processor of a computer, cause the processor to:
- obtain alarm information comprising information of a respective attack source attacking a first subnet and identification information of the first subnet;
- determine threat information of the respective attack source,
- obtain a threat value of the respective attack source according to the threat information;
- determine a value of an association between the respective attack source and the first subnet according to an attack relationship between the respective attack source and the first subnet by determining the value of the association between the respective attack source and the first subnet according to rs=[(I−aW)−1−I]·bs, wherein rs represents the value of the association between one of each attack source and the first subnet, bs represents a Boolean vector of the attack relationship between the respective attack source and the first subnet, s represents an identifier of the respective attack source, a represents the threat value of the respective attack source, I represents an identity matrix, and W represents an address of the respective attack source;
- determine, for an attacked subnet, a danger level imposed by the respective attack source on the first subnet using the threat value of the respective attack source and the value of the association;
- obtain a blacklist based on the danger level imposed by the respective attack source;
- and
- send the blacklist to a second subnet.
Dependencies are inferred from the claim text.