Local area network security protection system and method for defending ARP spoofing and network scanning

Abstract

The invention provides a local area network security protection system and method for defending against ARP spoofing and network scanning, and the basic technical idea is that the method comprises the steps: an IP address and a default gateway IP allocated to a host by a DHCP server at a DHCP interaction stage are modified when the host in a local area network obtains the IP address, wherein the IP address obtained by each host occupies one network segment alone; and ARP spoofing between hosts in the same network segment is eradicated; secondly, a plurality of inexistent disguised hosts are randomly generated in a network segment where each host IP is located, the disguised hosts can generate false flow to confuse attackers, attack trapping and false response can be performed on scanning behaviors of the attackers, and when the attackers actively scan a local area network, the attackers can touch the false hosts with a great probability, and the false host can be used for carrying out real-time early warning and blocking on scanning behaviors of an attacker; and thirdly, the default gateway IP allocated to the host is dynamically updated when the DHCP lease of the host expires for renewing, thereby increasing the difficulty of implementing ARP spoofing on the gateway.

Description

technical field [0001] The invention relates to the field of network security, in particular to a local area network security protection system and method for defending against ARP deception and network scanning. Background technique [0002] With the rapid development of information technology, the Internet has become an inaccessible part of human production and life. As of December 2018, the number of Internet users in my country reached 829 million, with a penetration rate of 59.6%, an increase of 3.8 percentage points from the end of 2017. 56.53 million new netizens were added. The number of mobile phone netizens in my country has reached 817 million, and the proportion of Internet users accessing the Internet through mobile phones is as high as 98.6%. With the development of mobile Internet technology, the large-scale popularization of wireless network technology represented by WIFI has had a profound impact on social and economic development and people's daily life. ...

AI Technical Summary

Problems solved by technology

This type of method often has a high false alarm rate, and has poor detection capabilities for concealed network scanning or ARP spoofing behavior. Attackers can use new attack methods to evade the security protection system and pretend to be normal users.

In addition, the existing protection methods often adopt the method of passive traffic analysis, it is difficult to achieve real-time active defense

Images