Automatic Generation Model of Host Micro- Segmentation in Distribution Master Station Based on Distributed Intrusion Detection

The traditional host-agent-based micro-segmentation scheme can effectively prevent wanton damage after attackers invade the internal business network, but there are still the following two shortcomings. The first is that the solution cannot sense the location of the compromised node, which will lead to the destruction of other nodes that have legitimate communication links with it; secondly, if the software functions installed in the host are too complex for security reasons, it will occupy more host resources, which affects the execution of normal programs. Because of the above problems, this paper proposes an automatic generation technology of host micro-segmentation based on distributed intrusion detection. By installing an agent in each host to collect host operating information and implement a micro- segmentation strategy, the collected data will be sent to an independent server where a policy computing unit is deployed. The policy computing unit performs intrusion detection and analysis according to the information collected by each host, updates the segmentation policy according to the analysis result, and sends it to the agent software of each host. The proposed technology can greatly improve the security of the internal network without occupying too many service host resources.