Abstract:SummaryWith the rapid development of the internet, cyberspace security issues have become increasingly prominent. The importance of constructing a cyberspace security system is self‐evident, but compared with attackers, defenders in cyberspace are in a castle‐like passive defense state in most cases. Therefore, building a reliable, accurate, timely, and active defense system is challenging. The key is to accurately focus on defense priorities, the anticipation of attackers who will likely succeed, and blocking attacks in a timely manner. In this article, we propose an active defense model based on the interaction of situational awareness and firewalls. First, by biasing the integrity, confidentiality, and availability of assets to get the score of assets, and using the Common Vulnerability Scoring System to assess the threat level of assets, we combine the two to determine the maximum system damage that the asset will suffer if it is lost, and then focus on defense. Meanwhile, log analysis of the network situational awareness platform can predict successful attackers, and then the linked firewall strategy can block these attacks in time before the attackers obtain attack gains. After that, we force the attackers to give up their attacks on the target by increasing the attack cost. We compared our model with iptables auto‐blocking and nginx auto‐blocking, and our model excelled them across the board in terms of comprehensiveness and false positive rate. The experimental results verify thar our active defense model proposed in this article can better reduce the defense cost and increase the attack cost, thus achieving the relatively defense goal.

Internet Fraud and Defense System Research

Study on Phishing Attack Behaviours and Defence Model

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

Intrusion Detection And Simulation For High-Speed Networks

Hybrid Analyses and System Architecture for Telecom Frauds

Modeling, analysis and defense strategies against Internet attacks

Analysis of "Telecom and Network Fraud" Problem and Countermeasure in Colleges and Universities

Research and Realizing of Intrusion Prevention System Model Based on INTRANET

Research on Computer Network Security Analysis Model

Analysis of Influencing Factors and Countermeasures of Computer Network Security

Active Defense System Model Based on Campus Network

An Active Defense Model Based on Situational Awareness and Firewalls

Defense Technology of DDoS Attacks

Software Attack Modelling And Its Application

DMAT : A New Network and Computer Attack Classification

Analysis and Research of Attack Model

Research and Implementation of Network Attack Platform and Attack Decision-making System Model

A Cyberspace Attack and Defense Model with Security Performance Analysis Based on Automata Theory

NETWORK SYSTEM SELF-DEFENSE SYSTEM BASED ON NETWORK SECURITY SITUATION AWARENESS

Overview of Fraudulent Data Attack on Power System State Estimation and Defense Mechanism