Moving target protection method based on operating system fingerprint jumping

Abstract

The invention relates to a moving target protection method based on operating system fingerprint jumping. According to the method, protection is carried out in view of scanning tools used by an attacker, pointed fingerprint jumping is carried out by utilizing an operating system feature library of the scanning tools, and identification and fingerprint feature disguise for attack scanning behaviors are realized, so that the attacker cannot correctly obtain specific information of an operating system to be attacked, and then the next step of attack behavior cannot be carried out to realize network protection. In order to improve the complexity of the operating system, pointed jumping is carried out for an attacker scanning technology, the external attacker cannot obtain the specific information of an information system inside the network by deploying the technological means on an outlet network, so that the original information of the user does not need to change, and the improvement cost is avoided; meanwhile, the attacker cannot correctly obtain the information of the operating system inside the network and also cannot correctly adopt an appropriate attack method, and then the protective capacity of the information system is improved.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a mobile target protection method based on operating system fingerprint jumps. Background technique [0002] The current network protection system with firewalls, intrusion detection and other technologies as the core is increasingly limited in preventing network attacks, and the attack and defense are in a serious asymmetric state: attackers have sufficient time to study the information system to be attacked and find loopholes to attack , and even if the defender finds 99% of the loopholes and protects them, if the loopholes used by the attacker are not within the scope of the loopholes found, the attack cannot be effectively avoided. Therefore, this static protection idea is inherently different from the dynamic attack behavior. For this reason, the academic community has proposed moving target defense (MTD) technology, which does not pursue a completely secure i...

AI Technical Summary

Problems solved by technology

[0006] 1. This solution requires that the application system can run on virtual machines of different operating systems, that is to say, the use of this technology requires the transformation of the existing information system so that it can run on different operating systems and migrate to virtual machines. on-board, which makes the program transformation costly and complicated to implement

[0007] 2. This solution does not solve the security problem of the operating system itself. Because the operating system has loopholes, the probability of attacking the system is very high. Once the virtual machine rotation time is long, the attacker still has enough time to complete the attack. Therefore, the protection capability of this scheme is limited

Images