GA/T 1728-2020Information security technology Security technical requirements for IPv6-based high-performance network intrusion detection system products (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard was proposed by the Cyber Security Bureau of the Ministry of Public Security.

This standard is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security.

Drafting organizations of this standard. Computer Information System Security Product Quality Supervision and Inspection Center of the Ministry of Public Security, the Third Research Institute of the Ministry of Public Security, and Wang Shenxin Information Technology (Beijing) Co., Ltd.

1 Scope

This standard specifies the security function requirements, environmental adaptability requirements, performance of IPv6-based high-performance network intrusion detection system products Requirements, security requirements and security classification.

This standard applies to the design, development and testing of high-performance network intrusion detection system products based on IPv6.

2 Normative references

The following documents are indispensable for the application of this document. For dated reference documents, only the dated version applies to this document.

For undated references, the latest version (including all amendments) applies to this document.

GB/T 18336.3-2015 Information Technology Security Technology Information Technology Security Assessment Criteria Part 3: Security Assurance Components GB/T 25069-2010 Information Security Technical Terms

3 Terms and definitions

The following terms and definitions defined in GB/T 18336.3-2015 and GB/T 25069-2010 apply to this document.

event

A record of the occurrence or change of a system, service or network status can be used as the basis for analyzing security incidents.

Security incident

Through the analysis and processing of the incident, the occurrence of a system, service or network state can be identified, indicating a possible security breach Failure of rules or certain protective measures, or a previously unknown situation that may be related to safety, is likely to endanger business operations and Threat information security.

Invade

Any behavior that endangers or may endanger the integrity, confidentiality or availability of resources.

Intrusion detection

By collecting information and analyzing several key points in the computer network or computer system, discover the network or system Whether there are violations of security policies and signs of attacks.

detector

Used to collect real-time events that may indicate intrusions or abuse of information system resources, and to conduct preliminary analysis of the collected information Intrusion detection system components.