Discussion of adaptive intrusion detection technology based on SYN cookie

摘要

In order to strengthen the network service security mechanism of enterprises that have online trading business or have key and confidential information circulation, adaptive intrusion detection technology on the basis of SYN Cookie is studied and analyzed. This research proposes a general, self-learning and extensible defense system architecture. Based on this, an anti-denial of service products is developed, which can effectively detect and respond to the popular denial of service attacks. At the same time, the network is connected in a transparent way and the traffic flow is detected and intercepted. The system uses the high-performance network processor as the hardware platform, which is divided into three parts: the defense engine, the honey pot system and the monitoring and management center. Finally, in terms of its own security, the defense engine adopts the dual-unit hot standby technology to avoid single point failure, and it uses the failure open policy. Once the system fails or malfunctions, the system will open to all traffic and do nothing to avoid becoming the bottleneck of network entry and exit. The experiment shows that this method can identify the SYN Flood attack in the abnormal data flow accurately. It also shows excellent performance in the experiment.