| 摘要 |
<p>The invention relates to a hardware and software platform for preventing and detecting cybernetic attacks upon computer networks. According to the invention, the platform comprises: an intruder detection system (1) comprising a packet decoding module (1a) which decodes various packet formats taken from the network, a preprocessing module (1b) for the reconstruction of a communication stream based on the received packets and another module (1c) for execution of rules of identification of attacks upon the data packets received from the network, a data aggregating system (2) comprising a module (2b) which distributes the data extracted following rule processing to various internal or external systems, a module (2a) which sends alerts and notifications to third systems and a module (2c) which stores information concerning the streams within the network and partial or total information obtained after rule implementation, and a network management expert system (3) comprising a module (3b) for aggregation of various data from the said module (2c) and for subjecting them to a series of transformations and correlations, the results being then added to a knowledge data base (3c), either by addition, or by correction of pre-existing data regarding trends and activities recorded and learned by the system, an expert system (3a) which can be activated by data received from another module (2b) and which, using data from the knowledge data base (3c) may activate or not one or several corrective actions within the network, in order to stop or limit a cybernetic attack, and a module (3d) controlled by the expert system (3), which can reconfigure network equipments in order to stop and/or limit cybernetic attacks.</p> |
