Research on intrusion tolerance system based on behavioral baseline and defense-in-depth architecture

Tolerance technology is the third-generation network security technology commonly used in the world. It is derived from the category of information survival and endogenous security technology. A scholar from Carnegie Mellon University gave this survival technology a definition: the so-called "invasion survival technology." It is the ability of the system to perform its own tasks within a limited time when external attacks, failures and accidents have occurred. It assumes that we cannot detect intrusions to the system completely and correctly. When external intrusions or failures occur suddenly, we can use tolerance technology to solve the problem of survival of the system to ensure the confidentiality, integrity, and integrity of the information system. reliability and non-repudiation. In the current Internet security incidents, countless experiences and lessons tell us that it is not enough to rely on blocking and defensing for network security. Based on the existing network defense-in-depth architecture and the common behavior and parameter baselines of current emergency response systems, this paper designs an intrusion-tolerant system based on the behavioral baseline and network-in-depth architecture, which realizes intrusion tolerance and malicious behavior blocking under high confrontation intensity. To adapt to the maximum recovery and necessary tolerance under the attack technology of international APT organizations, and to protect the integrity and availability of the system to the greatest extent.