Network protection method and system based on false topology generation and system architecture

Abstract

The invention belongs to the technical field of network security, and particularly relates to a network protection method and system based on false topology generation and a system architecture, and the method comprises the steps: constructing different false network topologies for different real host nodes in a network according to network related information, wherein the network related information at least comprises honeypot information, the number of subnets and real host node information; adjusting the response message delay and link bandwidth of the destination host node according to the position of the destination host node in the false network topology; and identifying the malicious traffic source host by combining the related data packet transmitted to the honeypot and utilizing the SDN controller to carry out flow rule traffic statistics on the SDN switch, and isolating the identified host. In order to solve the problem that real network configuration is easy to obtain by network investigation in the existing static network, the invention uses the idea of mimicry defense to cheat internal attackers by constructing a false network topology so as to protect a benign host in the network and improve the stability and reliability of network operation.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network protection method, system and system architecture based on false topology generation. Background technique [0002] While static configuration of networks and hosts simplifies reachability and manageability, it also makes network reconnaissance easier. Attackers can perform network reconnaissance and identify exploitable vulnerabilities, giving attackers a tactical advantage. In particular, an insider attacker probing a networked environment can identify hosts and open ports, and map their topology for known vulnerabilities or zero-day vulnerabilities for further attack operations. Sophisticated targeted attacks such as APTs rely on network fingerprinting to identify hosts and vulnerabilities. According to authoritative statistics, as many as 70% of network attacks are caused by network reconnaissance. [0003] Static network configurations allow...

AI Technical Summary

Problems solved by technology

[0004] To this end, the present invention provides a network protection method, system and system architecture based on false topology generation. Aiming at the problems that the existing static network is easy to be detected by the network to obtain the real network configuration, the idea of ​​mimic defense is used to build a false network topology To deceive internal attackers to protect benign hosts in the network and improve network stability and reliability

Images