| 摘要 |
The invention relates to a protection unit (15) for protecting a packet-based network from attacks, comprising: a signature analyzer (5) for analyzing a packet stream (6) received in a security border node (2a) of the packet-based network (1) and for detecting attacks by comparing signatures of the packet stream (6) with a set of signatures of previously identified attacks, an anomaly detector, in particular a statistical analyzer (7), for detecting anomalies in the packet stream (6), and a signature interference unit (9) for updating the set of signatures when anomalies in the packet stream (6) are detected, the updated set of signatures (12) being subsequently used for performing the signature analysis. A distribution unit (13) distributes at least one signature of the updated set of signatures (12) to at least one further, preferably to each further security border node of the packet-based network (1). The invention also relates to a security border node comprising such a protection unit, to a network comprising at least two such protection units, and to a corresponding protection method.
|
