Network security defense system and network security defense method based on dynamic transformation

Abstract

The invention provides a network security defense system and network security defense method based on dynamic transformation. The network security defense system comprises a communication processing unit, a terminal information unit and a dynamic transformation unit. A terminal information table is configured for each network terminal in an inner network through the communication processing unit; the terminal information tables comprise true IP addresses, virtual IP addresses and outer network access IP addresses allocated to the network terminals; the dynamic transformation unit dynamically transforms the virtual IP addresses; and the communication processing unit enables the network terminals in the inner network to communicate with each other through the vIPs and communicate with the outer network through the wIPs. According to the system and the method, the static features of the conventional inner network are broken; through transforming the IP address information of the network terminals in the inner network, an attacker cannot obtain the topological structure of the inner network and cannot accurately obtain the true information of the network terminals in the inner network; therefore, the inner network attacking behaviors are effectively defensed; and the security of the inner network is improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network security defense system and a network security defense method based on dynamic transformation. Background technique [0002] Intranet security is very important in the actual network environment, but it is ignored by most network security devices. Existing methods generally detect attack behaviors by collecting traffic, but abnormal traffic is often generated after the attack behavior, so such methods cannot provide real-time defense against the attack behavior. Another method is to deploy a network security defense system on hosts connected to the network. Although it can defend against some attacks, it cannot defend against unknown intranet attacks. Static IP address assignments allow attackers to accurately and quickly target attacks by scanning local or remote networks. Determining the IP address of the active host in the target network is the first step in most at...

AI Technical Summary

Problems solved by technology

However, due to the static nature of the existing network topology information, attackers often have sufficient time to analyze the intranet architecture and network address information, thereby gradually infiltrating the intranet and reaching the attack target

Images