Design of Network Security Early Warning System

The paper presents a distributed architecture of pre-warning system to solve problems of the current network protection, such as low reliability of network events alarming, low efficiency and reliability of pre-warning and difficulties to monitor the whole network security status. The architecture includes three parts, detection domain, warning agent and local warning center. The system can percept and analyze all-round and multi-level security events by analyzing information from many monitoring equipment and safety probes deployed in the whole network. The system then forms the diagram of security situation and distributes pre-warning information immediately. Thus, the abilities to detect, to identify, to track, to forecast and prevent early network attacks and violations are improved.