Based on the cyber kill chain model

this paper proposes an evolutionary idea and implementation method for critical information infrastructures defense system. It monitors

analyzes and disposes of network intrusion traffic at the backbone network

metropolitan area network

and corporate intranet

which further expands the defense depth of critical information infrastructures. Through the comprehensive use of DPI

deception defense

big data

bypass blocking and other technologies

the alarms are converged layer by layer

and displayed to network security operators with a visual interface

which improves the accuracy of the monitoring of attack events

system protection effect and the effi ciency of network security operation.