Method and Apparatus for Improving Network Security

A control node for improving network security, wherein a network comprises the control node and at least two subnets in communication with the control node, and wherein the control node comprises:

• a processor;
• and
• a storage medium coupled to the processor, wherein instructions are stored on the storage medium and are executable by the processor to instruct the processor to:
• obtain alarm information, wherein the alarm information comprises address information of attack sources that attack a subnet of the at least two subnets and identification information of the attacked subnet of the at least two subnets;
• determine threat information of each attack source based on the alarm information,
• obtain a threat value of each attack source according to the threat information of the attack source;
• determine a value of association between each attack source and all the attacked subnets;
• determine, for an attacked subnet, a danger level imposed by each attack source that attacks the subnet on the subnet using a threat value of each attack source that attacks the subnet and a value of association between each attack source that attacks the subnet;
• obtain a blacklist based on the danger levels imposed by the attack sources;
• and
• send the obtained blacklist to at least one subnet that is not attacked yet in the network.

A non-transitory computer readable medium storing codes for improving network security, wherein when executed by a processor of a computer, the codes perform:

• obtaining, by a control node, alarm information, wherein the alarm information comprises address information of attack sources that attack a subnet of the at least two subnets and identification information of the attacked subnet of the at least two subnets;
• determining threat information of each attack source based on the alarm information;
• obtaining a threat value of each attack source according to the threat information of the attack source;
• determining a value of association between each attack source and all the attacked subnets;
• determining, for an attacked subnet, a danger level imposed by each attack source that attacks the subnet on the subnet using a threat value of each attack source that attacks the subnet and a value of association between each attack source that attacks the subnet;
• obtaining a blacklist based on the danger levels imposed by the attack sources;
• and
• sending, by the control node, the obtained blacklist to at least one subnet that is not attacked yet in the network.