Network protocol simulation method based on independent research and development

Abstract

The invention relates to the technical field of network security, in particular to a network protocol simulation method based on independent research and development, which comprises the following steps: S1, simulating a mainstream communication protocol and an application protocol in a protocol simulation mode; s2, interacting with a simulation protocol in a real protocol connection mode, and recording abnormal behavior connection information and command execution information content; s3, judging known contents for response by implementing protocol simulation; and S4, covering five categories of system service, database service, application service, industrial control service and Internet of Things service through a sensing protocol. The method has the advantages of being high in safety, good in stability, high in processing result accuracy, high in processing capacity and wide in coverage range.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network protocol simulation method based on independent research and development. Background Art

[0002] With the development of network technology, various communication protocols and application protocols are being used more and more widely. The normal operation of these protocols is crucial to the stable operation of network systems. However, due to the complexity and diversity of the network environment, the implementation and maintenance of protocols face huge challenges. In this context, network protocol simulation technology came into being. By simulating real network protocols, it can help us better understand and master the operating mechanism of network protocols, thereby improving the stability and reliability of network systems.

[0003] The existing network protocol simulation technology mainly simulates the required network protocol by modifying the real service. Although this method can simulate the network protocol, it has certain risks. If there is a problem with the real service, it may cause the simulated network protocol to have problems, thus affecting the normal operation of the network system.

[0004] The existing network protocol simulation technology has the following main problems: First, the existing simulation method is mainly based on the transformation of real services, which not only increases the complexity and difficulty of the simulation, but also may cause instability of the real service; second, the existing simulation technology can often only simulate a few network protocols and cannot meet the growing demand for network protocols; finally, the existing simulation technology is insufficient in processing abnormal behavior connection information, command execution information, etc., and cannot meet the needs of network security monitoring and analysis. Summary of the invention

[0005] The purpose of the present invention is to provide a network protocol simulation method based on independent research and development, which solves the technical problems such as how to realize the simulation of network protocols without modifying the real services, so as to reduce the impact of problems in the real services on the simulated network protocols; how to improve the coverage of network protocol simulation technology to meet the growing demand for network protocols; how to enhance the ability of network protocol simulation technology in processing abnormal behavior connection information, command execution information, etc., to meet the needs of network security monitoring and analysis.

[0006] To achieve the above purpose, the present invention provides the following technical solutions: a network protocol simulation method based on independent research and development, comprising

[0007] S1. Simulate mainstream communication protocols and application protocols through protocol simulation;

[0008] S2, interacting with the simulation protocol through the real protocol connection, recording abnormal behavior connection information and command execution information content;

[0009] S3, by implementing protocol simulation, determine the known content and respond;

[0010] S4. Through the perception protocol, it covers five major categories: system services, database services, application services, industrial control services, and Internet of Things services.

[0011] Preferably, the specific simulation process in S1 is:

[0012] S11. Protocol analysis: When simulating a protocol, first conduct an in-depth analysis of the communication protocol to be simulated, such as TCP / IP, and record its message format, interaction specifications, and the operating principle of the state machine; conduct an in-depth analysis of the security mechanism and error handling mechanism in the protocol, and analyze various data structures, protocol headers, and payload elements in the protocol;

[0013] S12. Protocol modeling: After the protocol analysis is completed in step S11, the specific real protocol is modeled, each field of the protocol is defined, and a protocol state transition model is established to simulate the behavior of the protocol in different states;

[0014] Based on the parsed protocol structure, clearly define each protocol field, including the protocol header, payload, and possible control fields, to ensure that the simulation model is highly accurate and complete and can cover all key information in the protocol;

[0015] Based on the results of protocol analysis, a protocol state transition model is established. The model can reflect the behavior of the protocol in different states, including state transition conditions and actions, so as to accurately capture the dynamic process of protocol interaction such as connection establishment, data transmission, and error handling.

[0016] Using event-driven simulation methods, the simulation system dynamically responds to and simulates various protocol interaction scenarios according to the events and conditions defined in the protocol state transition model, making the model more flexible and adaptable to different simulation scenarios and test cases;

[0017] At the same time, the optimization methods of event priority setting and simulation time compression are adopted to ensure that high-precision results can be obtained during the simulation process while maintaining the real-time performance of the simulation. The establishment of the simulation model can accurately simulate the process of protocol interaction in the simulation environment;

[0018] S13. Simulation environment configuration: In the simulation environment configuration, configure the simulation devices of the simulation environment, use the network simulation configuration tool, GNS3 to configure the topology of the simulation network, so as to build a real network topology and better simulate the actual network environment;

[0019] S14. Simulated protocol connection: The establishment of simulated protocol connection includes handshake and identity authentication, combining encryption algorithm and identity authentication mechanism with handshake process simulation to ensure the connection between the simulated system and the real protocol is secure and reliable;

[0020] By simulating the sending and receiving of handshake requests and responses, the handshake process in real communication is restored. This process involves the various protocol fields, messages and state transitions defined in step S12, ensuring that the connection establishment process complies with the standard, and adjusting mechanisms such as identity authentication and certificate exchange according to the specific protocol simulated;

[0021] Encryption algorithms are used to implement data protection in the simulated handshake process. Key negotiation protocols are used to securely negotiate and share keys. A symmetric encryption algorithm is used to encrypt data to ensure data confidentiality during transmission. SHA-256 is used to verify data integrity.

[0022] S15. Introduce multi-layer security mechanisms and comprehensive security strategies to improve the security of the connection between the simulated system and the real protocol at all technical levels. Adopt defense measures against replay attacks and ensure the independence and uniqueness of each handshake process by introducing timestamps and random numbers. At the same time, adopt defense measures against man-in-the-middle attacks and use certificates and infrastructure to verify the identities of both communicating parties to ensure that all parties involved in each step of the connection are legitimate.

[0023] Preferably, the specific process in S2 is:

[0024] S21. Establish real protocol connection:

[0025] First, the system connects the real protocol with the simulated protocol to create a hybrid network environment and establish a normal protocol connection with the target system or device;

[0026] We conducted in-depth research on protocol adaptability and designed a set of intelligent protocol adaptability algorithms that can automatically adjust connection parameters including protocol versions and interaction specifications according to the dynamic changes of protocols in actual networks, thereby more comprehensively simulating different types of network interactions and improving the system's perception and response level to diverse threats;

[0027] At the same time, the system introduces an intelligent connection management mechanism to dynamically adjust protocol connections according to real-time network status and simulation requirements, improving the flexibility of the system so that it can adapt to different network conditions (heterogeneous networks) and workloads (load balancing);

[0028] When dealing with heterogeneous network interactions, the system uses network virtualization technology to simulate a variety of different network types by building a virtual network layer, making the simulation more realistic and able to achieve multi-channel connections at the same time. This allows the system to establish multiple protocol connections with the target device at the same time, which can improve the system's throughput and fault tolerance, while supporting more complex simulation scenarios.

[0029] S22. Interacting with the simulation protocol: Based on establishing a real protocol connection, interact with the target system through the simulation protocol; the simulation protocol simulates the behavior of the real protocol;

[0030] The system integrates a behavior analysis engine and introduces a deep learning model to learn the features of protocol communication data. Through real-time monitoring and analysis of simulated protocol interactions, it identifies and learns key features in protocol interactions. This supports the system to more intelligently simulate simulated protocol behaviors while capturing possible abnormal behaviors, which helps improve the system's perception of lateral attacks.

[0031] Introducing an adaptive interaction strategy to dynamically adjust the interaction mode with the simulation protocol according to changes in the network environment and escalation of attack risks;

[0032] By adopting streaming processing technology, the efficiency of abnormal behavior detection is improved by real-time monitoring of simulated protocol data streams. When the network load is low or the attack risk is high, the interaction frequency is reduced to simulate more potential attack behaviors. When the network is busy or the attack risk is low, the interaction frequency is increased to more realistically reflect normal network traffic.

[0033] Preferably, the specific process in S3 is:

[0034] S31. Use virtualization or container technology to isolate real services, extract traditional network functions from dedicated hardware, separate the control plane and data plane of the network, and dynamically configure and manage network traffic through a centralized controller;

[0035] Use container technology to virtualize the real service network and protocol, and use the namespace and control group technology provided by the kernel to achieve container isolation;

[0036] The communication between virtualized containers can be isolated through bridge networks, overlay networks, etc.

[0037] S32. Introduce differential analysis technology to effectively detect lateral threats by comparing the behavioral differences between real services and simulated services;

[0038] The differential analysis technology used by the system includes behavior analysis, traffic analysis, and differential signatures. Behavior analysis adaptively establishes a baseline behavior model by monitoring the normal behavior of the system, application, or user, and detects potential abnormal behaviors by comparing actual behaviors with the baseline model in real time or offline. Real-time comparison can immediately discover potential abnormal behaviors, while offline comparison analyzes historical data to identify lateral threats that may be overlooked. Traffic analysis focuses on the basic characteristics and behavior patterns of network traffic to identify possible abnormal traffic and further strengthen the detection and response to lateral threats.

[0039] S33. Use the network configuration in the system to confuse and induce attackers to deviate from the real attack target, and record the attacker's activities in detail, including attack methods, attack paths, and connection methods;

[0040] S34. Use secure synthetic data generation technology to generate simulation data of real services and simulate real scenarios while maintaining the independence of protocol simulation. By using data generation algorithms, generate data with authenticity, diversity, and compliance to ensure the authenticity of the experiment. At the same time, the generation algorithm also takes into account the similarity of the data to ensure that the generated data maintains a certain difference from the real data in content and structure, preventing attackers from analyzing the vulnerabilities of real services through simulated data.

[0041] Preferably, S4 covers five categories of system services, database services, application services, industrial control services, and Internet of Things services through the perception protocol. The specific steps are:

[0042] S41. Expand the scope of perception protocols, apply protocols, implement protocol support, maintain the ability to perceive the latest network technologies and services by regularly updating and adding new protocols, and more comprehensively cover various protocols that may be used for horizontal propagation;

[0043] S42. Introducing the Adaptive Protocol Model (APM), which can learn new protocols and service features in real time and adjust its perception capabilities accordingly;

[0044] S43. Timing simulator compatibility test, collects data of real services, including protocol communication records, network traffic data and various interaction scenarios of real services. Based on the collected data, the system spontaneously creates a virtual test environment to simulate real services. In the virtual test environment, the system performs timing compatibility tests on common scenarios and edge scenarios to ensure that the perception protocol can still run stably in the face of various extreme situations;

[0045] S44. Use a protocol version management mechanism to ensure that the perception protocol can maintain stable support for different versions of the protocol. By establishing a protocol version database, record the protocol name, major version number, minor version number, revision number, feature value, forward and backward compatibility test records and related documents of known protocols;

[0046] By considering the situation of protocol upgrade and evolution, the compatibility of the system between different protocol versions is tested to prevent perception failure caused by protocol updates;

[0047] By establishing PVD, protocol rollback can be supported so that when problems occur, the protocol version can be rolled back to the original version in a timely manner.

[0048] S45. Supports heterogeneous networks, and the perception protocol covers five major categories: system services, database services, application services, industrial control services, and Internet of Things services.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] 1. High security: The protocol simulation of the present invention is not based on the transformation of the real service, but is realized through independent research and development. It responds by judging the known content, and there is no risk of real service failure. In this way, even if there is a problem with the real service, it will not affect the simulated protocol, thereby ensuring the stable operation of the network system;

[0051] Through the deep packet analysis tool, the network traffic during the simulation process is analyzed in detail to further improve the accuracy of the verification simulation results and provide multi-level analysis of protocol interactions;

[0052] Encryption algorithms are used to implement data protection in the simulated handshake process. Key negotiation protocols are used to securely negotiate and share keys. A symmetric encryption algorithm is used to encrypt data to ensure data confidentiality during transmission. SHA-256 is used to verify data integrity.

[0053] Introduce multi-layer security mechanisms and comprehensive security strategies to improve the security of the connection between the simulation system and the real protocol at all technical levels. Adopt defense measures against replay attacks, and ensure the independence and uniqueness of each handshake process by introducing timestamps and random numbers. At the same time, adopt defense measures against man-in-the-middle attacks, use certificates and infrastructure to verify the identities of both parties in communication, and ensure that all parties involved in each step of the connection are legitimate.

[0054] 2. Strong processing capability: The present invention realizes protocol simulation through independent research and development, avoiding transformation based on real services, thereby avoiding the problem of insufficient processing capability that may occur when processing large-scale network data, and can better cope with large-scale network data, thereby improving its use effect.

[0055] 3. Wide coverage: In terms of the richness of perception protocols, the present invention covers five major categories: system services, database services, application services, industrial control services, and Internet of Things services, involving 55 perception protocols such as SSH, FTP, MySQL, Redis, IEC-104, S7, etc., covering the vast majority of mainstream network protocols. This means that the present invention can simulate almost all network protocols, greatly expanding its scope of application. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flow chart of a network protocol simulation method based on independent research and development in the patent of this invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the implementation regulations described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Figure 1 As shown: A network protocol simulation method based on independent research and development, the specific steps are as follows

[0058] 1. Simulate mainstream communication protocols and application protocols through protocol simulation.

[0059] Simulation process:

[0060] (1) Protocol analysis: When simulating a protocol, we first analyze the communication protocol to be simulated, such as TCP / IP, and record its message format, interaction specifications, and the operating principle of the state machine. In particular, we analyze the security mechanism and error handling mechanism in the protocol, and analyze various data structures, protocol headers, payloads, and other elements in the protocol to ensure that the protocol simulation system can accurately restore the real communication process, including the simulation of abnormal situations and corresponding processing strategies.

[0061] (2) Protocol modeling: After the protocol is parsed in step (1), a specific real protocol is modeled through a specific method, each field of the protocol is defined, and a protocol state transition model is established to simulate the behavior of the protocol in different states. According to the protocol structure obtained by parsing, each field of the protocol is clearly defined, including the protocol header, payload, and possible control field, to ensure that the simulation model has high accuracy and completeness and can cover all key information in the protocol. Based on the results of protocol parsing, a protocol state transition model is established, which can reflect the behavior of the protocol in different states, including state transition conditions and actions, so as to accurately capture the dynamic process of protocol interaction such as connection establishment, data transmission, and error handling. Using an event-driven simulation method, the simulation system dynamically responds to and simulates various protocol interaction scenarios according to the events and conditions defined in the protocol state transition model, making the model operation more flexible and adaptable to different simulation scenarios and test cases. At the same time, the optimization method of event priority setting and simulation time compression is adopted to ensure that high-precision results can be obtained during the simulation process while maintaining the real-time performance of the simulation. The establishment of the simulation model can accurately simulate the process of protocol interaction in a simulation environment.

[0062] (3) Simulation environment configuration: In the simulation environment configuration, configure the simulation equipment of the simulation environment, use the network simulation configuration tool, GNS3, to configure the topology of the simulation network to build a real network topology and better simulate the actual network environment. In order to ensure the authenticity and reliability of the simulation environment, advanced simulation technology is used, including using a real-time traffic generator to simulate real network traffic, using network performance simulation tools to simulate various network performance parameters, and simulating the communication effects under different network conditions to improve the ability of the simulation to be close to the actual situation. At the same time, virtualization technology is integrated into the simulation environment to achieve rapid deployment and operation of virtual devices, greatly improving the flexibility and efficiency of the simulation, and enabling the system to more conveniently simulate a variety of network devices and scenarios. In addition, through the deep packet analysis tool, the network traffic during the simulation process is analyzed in detail to further improve the accuracy of the verification simulation results and provide multi-level analysis of protocol interactions.

[0063] (4) Simulation protocol connection: Simulation protocol connection is a key step in the simulation process. The establishment of simulation protocol connection includes handshake and identity authentication. This process is a necessary element to establish a trusted connection between the simulation system and the real protocol. The encryption algorithm and identity authentication mechanism are combined with the handshake process simulation to ensure that the connection between the simulation system and the real protocol is secure and reliable.

[0064] The handshake process of the simulated protocol connection is a key link to ensure the establishment of a trusted connection. By simulating the sending and receiving of handshake requests and responses, the handshake process in real communication is restored. This process involves the various protocol fields, messages and state transfers defined in step (2), ensuring that the connection establishment process complies with the standard, and adjusting the identity authentication and certificate exchange mechanisms according to the specific protocol of the simulation. In terms of security considerations, encryption algorithms are used to implement data protection in the simulated handshake process, and key negotiation protocols are used to securely negotiate and share keys. A symmetric encryption algorithm is used to encrypt data to ensure data confidentiality during transmission, and SHA-256 is used for data integrity verification.

[0065] In addition, we introduce multi-layer security mechanisms and comprehensive security strategies to improve the security of the connection between the simulation system and the real protocol at all technical levels. We adopt defense measures against replay attacks and ensure the independence and uniqueness of each handshake process by introducing timestamps and random numbers. We also adopt defense measures against man-in-the-middle attacks and use certificates and infrastructure to verify the identities of both parties in communication, ensuring that all parties involved in each step of the connection are legitimate.

[0066] 2. Interact with the simulation protocol through real protocol connection to record abnormal behavior connection information, command execution information, etc.

[0067] (1) Establishing a real protocol connection: First, the system innovatively proposes to establish a normal protocol connection with the target system or device by connecting the real protocol with the simulated protocol to create a hybrid network environment. In-depth research on protocol adaptability is conducted to design a set of protocol intelligent adaptability algorithms that can automatically adjust connection parameters, including protocol version, interaction specifications, etc., according to the dynamic changes of the protocol in the actual network, so as to more comprehensively simulate different types of network interactions and improve the system's perception and response level to diverse threats. At the same time, the system innovatively introduces an intelligent connection management mechanism to dynamically adjust the protocol connection according to the real-time network status and simulation requirements. This can improve the flexibility of the system and enable it to adapt to different network conditions (heterogeneous networks) and workloads (load balancing). When dealing with heterogeneous network interactions, the system uses network virtualization technology to simulate multiple different network types by building a virtual network layer, making the simulation more realistic and able to achieve multi-channel connections at the same time, allowing the system to establish multiple protocol connections with the target device at the same time, which can improve the system's throughput and fault tolerance while supporting more complex simulation scenarios.

[0068] (2) Interaction with the simulation protocol: After establishing a real protocol connection, the simulation protocol interacts with the target system. The simulation protocol simulates the behavior of the real protocol, including the sending and receiving of messages, state transitions, etc. The system innovatively integrates a behavior analysis engine and introduces a deep learning model to learn the characteristics of protocol communication data. Through real-time monitoring and analysis of the simulation protocol interaction, the key features in the protocol interaction, including specific message structures, state transition patterns, etc., are identified and learned. This supports the system to capture possible abnormal behaviors while simulating the simulation protocol behavior more intelligently, which helps to improve the system's perception of lateral attacks. In terms of interaction strategy, an adaptive interaction strategy is introduced to dynamically adjust the interaction mode with the simulation protocol according to changes in the network environment and the escalation of attack risks. Streaming processing technology is used to improve the efficiency of abnormal behavior detection by real-time monitoring of the simulation protocol data stream. If the network load is low or the attack risk is high, the interaction frequency is reduced to simulate more potential attack behaviors. When the network is busy or the attack risk is low, the interaction frequency is increased to more realistically reflect normal network traffic.

[0069] 3. Protocol simulation is not based on the transformation of real services, but is achieved through independent research and development. It responds by judging known content, and there is no risk of loss of real services.

[0070] (1) Using virtualization or container technology, real services can be isolated. NFV (Network Functions Virtualization) and SDN (Software Defined Network) are used to extract traditional network functions from dedicated hardware, separate the control plane and data plane of the network, and dynamically configure and manage network traffic through a centralized controller. Container technologies such as Docker and Kubernetes are used to virtualize real service networks and protocols, and the namespace and control group (cgroup) technologies provided by the kernel are used to isolate containers. Each container has its own file system, process space, network space, etc., which reduces the attack surface. Communication between virtualized containers can be isolated through bridge networks, overlay networks, etc.

[0071] (2) Differential analysis technology is introduced to effectively detect lateral threats by comparing the behavioral differences between real services and simulated services. The differential analysis technologies used by the system include behavioral analysis, traffic analysis, and differential signatures. Behavioral analysis adaptively establishes a baseline behavior model by monitoring the normal behavior of the system, application, or user, and detects potential abnormal behaviors by comparing the actual behavior with the baseline model in real time or offline to identify differences. Real-time comparison can immediately discover potential abnormal behaviors, while offline comparison is based on historical data analysis to identify lateral threats that may be overlooked. Traffic analysis focuses on the basic characteristics and behavioral patterns of network traffic to identify possible abnormal traffic and further strengthen the detection and response to lateral threats.

[0072] (3) Use zero-impact honeypot technology to create a virtual environment similar to the real service to attract attackers, while monitoring and analyzing without causing any impact on the real system. Utilize the network configuration in the system to confuse and induce attackers to deviate from the real attack target, and record the attacker's activities in detail, including attack methods, attack paths, connection methods, etc. This helps to reveal the attacker's strategy, attack methods and potential security vulnerabilities. Because the environment is virtual and limited, the virtual environment can effectively isolate the attacker's activities and will not affect the real system. This method can provide an organization with a relatively safe observation window for monitoring attacker behavior and taking necessary countermeasures. This technology effectively reduces the risk of lateral threats to real services because attackers cannot directly attack real services.

[0073] (4) Use innovative secure synthetic data generation technology to generate simulation data of real services to simulate real scenarios while maintaining the independence of protocol simulation. By using innovative data generation algorithms, data with authenticity, diversity, and compliance is generated to ensure the authenticity of the experiment and avoid potential risks that may be caused by direct operation of real data. At the same time, the generation algorithm also takes into account the similarity of data to ensure that the generated data maintains a certain difference from the real data in content and structure, preventing attackers from analyzing the vulnerabilities of real services through simulated data.

[0074] The above technical means together constitute a new comprehensive security strategy, which is used to effectively perceive lateral threats and ensure the security of the system, and can be used as an innovative point for patent applications.

[0075] 4. In terms of the richness of perception protocols, perception protocols cover five major categories: system services, database services, application services, industrial control services, and Internet of Things services, involving 55 perception protocols such as SSH, FTP, MySQL, Redis, IEC-104, S7, etc., covering the vast majority of mainstream network protocols.

[0076] (1) Expand the scope of perceived protocols, including mainstream communication protocols such as TCP / IP, UDP, application protocols such as Http, SMTP, FTP, and system service protocols such as LDAP (Lightweight Directory Access Protocol), RADIUS (Remote Authentication Dial-In User Service), SNTP (Simple Network Time Protocol), etc., to achieve a wide range of protocol support. Maintain the ability to perceive the latest network technologies and services by regularly updating and adding new protocols, thereby more comprehensively covering various protocols that may be used for lateral propagation.

[0077] (2) Introducing the Adaptive Protocol Model (APM), which can learn new protocols and service features in real time and adjust its perception capabilities accordingly. APM introduces a real-time learning mechanism that can actively monitor and identify the addition of new protocols. At the same time, by analyzing the communication mode and data format of the new protocol, it can instantly learn its features, establish a dynamic protocol model, and adjust the model according to real-time data. The model can dynamically parse the data formats of various protocols such as binary data, ASCII text data, TLV (Tag-Length-Value), JSON (JavaScript Object Notation) and XML (eXtensible Markup Language), so that the model can adapt to new data structures and protocol features. One of the core mechanisms of APM is to monitor network traffic and protocol communication, and update the protocol simulator in real time to adapt to the ever-changing network environment, ensuring that it keeps pace with the learned new protocol features, so that the simulator can continuously adapt to new protocols while maintaining accurate simulation of existing protocols. This adaptability helps to improve the system's adaptability to new protocols. Through real-time learning and dynamic adjustment, the system can maintain the sensitivity of perceiving protocols without sacrificing accuracy.

[0078] (3) Timed simulator compatibility test. Utilize the collected data of real services, including protocol communication records, network traffic data, and various interaction scenarios of real services. Based on the collected data, the system spontaneously creates a virtual test environment to simulate real services. In the virtual test environment, the system performs timed compatibility tests on common scenarios and edge scenarios to ensure that the perception protocol can still run stably in the face of various extreme situations. During the test, the perception protocol is verified for its ability to identify the communication modes of each protocol and correctly parse different data formats, ensuring that the perception protocol can accurately and efficiently simulate the behavior of real services in the virtual test environment.

[0079] (4) Use a protocol version management mechanism to ensure that the perception protocol can maintain stable support for different versions of the protocol. By establishing a protocol version database, record the protocol name, major version number, minor version number, patch version, feature value, forward and backward compatibility test (3) records, and related documents of known protocols. The major version number indicates a major change that is not backward compatible, the version number indicates a major change that is backward compatible, and the patch number indicates a minor fix or improvement that is backward compatible. By considering the upgrade and evolution of the protocol, the compatibility of the system between different protocol versions is tested to prevent perception failures caused by protocol updates. By establishing a PVD, in some cases, protocol rollback can also be supported so that when problems occur, the system can roll back to the original protocol version in a timely manner.

[0080] (5) Innovative support for heterogeneous networks. The perception protocol covers five major categories: system services, database services, application services, industrial control services, and Internet of Things services, including comprehensive perception of different fields such as industrial control systems, the Internet of Things, and wireless sensor networks. The perception protocol innovatively introduces protocol format conversion technology to ensure flexible support for different types of protocols, including dynamic conversion of data between different protocol formats, thereby uniformly processing multiple protocol standards. For different communication mechanisms such as P2P (Point-to-Point Communication), C / S (Client-Server Communication), and P / S (Publish-Subscribe Communication), the perception protocol has corresponding processing methods, and includes the interaction of multi-level connection protocols in the scope of involvement, which helps to adapt to the needs of different network hierarchies. Based on the difference analysis technology, it predicts the trend of network environment changes, makes real-time decisions, and dynamically adjusts the configuration; it uses this intelligent adaptability to classify the network environment and select the corresponding configuration according to the current category. At the same time, combined with the feedback mechanism, it supports adjustments based on the actual needs of users, ensuring that the system can more flexibly respond to changes in heterogeneous networks.

[0081] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network protocol simulation method based on independent research and development, characterized in that: The method comprises S1. Simulate mainstream communication protocols and application protocols through protocol simulation; S2, interacting with the simulation protocol through the real protocol connection, recording abnormal behavior connection information and command execution information content; S3, by implementing protocol simulation, determine the known content and respond; S4. Through the perception protocol, it covers five major categories: system services, database services, application services, industrial control services, and Internet of Things services.

2. According to claim 1, a network protocol simulation method based on independent research and development is characterized in that: The specific simulation process in S1 is: S11. Protocol analysis: When simulating a protocol, first conduct an in-depth analysis of the communication protocol to be simulated, such as TCP / IP, and record its message format, interaction specifications, and the operating principle of the state machine; Conduct in-depth analysis of the security mechanisms and error handling mechanisms in the protocol, and analyze various data structures, protocol headers, and payload elements in the protocol; S12. Protocol modeling: After the protocol analysis is completed in step S11, the specific real protocol is modeled, each field of the protocol is defined, and a protocol state transition model is established to simulate the behavior of the protocol in different states; Based on the parsed protocol structure, clearly define each protocol field, including the protocol header, payload, and possible control fields, to ensure that the simulation model is highly accurate and complete and can cover all key information in the protocol; Based on the results of protocol analysis, a protocol state transition model is established. The model can reflect the behavior of the protocol in different states, including state transition conditions and actions, so as to accurately capture the dynamic process of protocol interaction such as connection establishment, data transmission, and error handling. Using event-driven simulation methods, the simulation system dynamically responds to and simulates various protocol interaction scenarios according to the events and conditions defined in the protocol state transition model, making the model more flexible and adaptable to different simulation scenarios and test cases; At the same time, the optimization method of event priority setting and simulation time compression is adopted to ensure that high-precision results can be obtained during the simulation process while maintaining the real-time nature of the simulation. The establishment of the simulation model can accurately simulate the process of protocol interaction in the simulation environment; S13. Simulation environment configuration: In the simulation environment configuration, configure the simulation devices of the simulation environment, use the network simulation configuration tool, GNS3 to configure the topology of the simulation network, so as to build a real network topology and better simulate the actual network environment; S14. Simulated protocol connection: The establishment of simulated protocol connection includes handshake and identity authentication, combining encryption algorithm and identity authentication mechanism with handshake process simulation to ensure the connection between the simulated system and the real protocol is secure and reliable; By simulating the sending and receiving of handshake requests and responses, the handshake process in real communication is restored. This process involves the various protocol fields, messages and state transitions defined in step S12, ensuring that the connection establishment process complies with the standard, and adjusting mechanisms such as identity authentication and certificate exchange according to the specific protocol simulated; Encryption algorithms are used to implement data protection in the simulated handshake process. Key negotiation protocols are used to securely negotiate and share keys. A symmetric encryption algorithm is used to encrypt data to ensure data confidentiality during transmission. SHA-256 is used to verify data integrity. S15. Introduce multi-layer security mechanisms and comprehensive security strategies to improve the security of the connection between the simulated system and the real protocol at all technical levels. Adopt defense measures against replay attacks and ensure the independence and uniqueness of each handshake process by introducing timestamps and random numbers. At the same time, adopt defense measures against man-in-the-middle attacks and use certificates and infrastructure to verify the identities of both communicating parties to ensure that all parties involved in each step of the connection are legitimate.

3. The network protocol simulation method based on independent research and development according to claim 1 is characterized in that: The specific process in S2 is: S21. Establish real protocol connection: First, the system proposes to connect the real protocol with the simulated protocol to create a hybrid network environment and establish a normal protocol connection with the target system or device; We conducted in-depth research on protocol adaptability and designed a set of intelligent protocol adaptability algorithms that can automatically adjust connection parameters including protocol versions and interaction specifications according to the dynamic changes of protocols in actual networks, thereby more comprehensively simulating different types of network interactions and improving the system's perception and response level to diverse threats; At the same time, the system introduces an intelligent connection management mechanism to dynamically adjust protocol connections according to real-time network status and simulation requirements, improving the flexibility of the system so that it can adapt to different network conditions (heterogeneous networks) and workloads (load balancing); When dealing with heterogeneous network interactions, the system uses network virtualization technology to simulate a variety of different network types by building a virtual network layer, making the simulation more realistic and able to achieve multi-channel connections at the same time. This allows the system to establish multiple protocol connections with the target device at the same time, which can improve the system's throughput and fault tolerance, while supporting more complex simulation scenarios. S22. Interacting with the simulation protocol: Based on establishing a real protocol connection, interact with the target system through the simulation protocol; The emulated protocol simulates the behavior of the real protocol; The system integrates a behavior analysis engine and introduces a deep learning model to learn the features of protocol communication data. Through real-time monitoring and analysis of simulated protocol interactions, it identifies and learns key features in protocol interactions. This supports the system to more intelligently simulate simulated protocol behaviors while capturing possible abnormal behaviors, which helps improve the system's perception of lateral attacks. Introducing an adaptive interaction strategy to dynamically adjust the interaction mode with the simulation protocol according to changes in the network environment and escalation of attack risks; By adopting streaming processing technology, the efficiency of abnormal behavior detection is improved by real-time monitoring of simulated protocol data streams. When the network load is low or the attack risk is high, the interaction frequency is reduced to simulate more potential attack behaviors. When the network is busy or the attack risk is low, the interaction frequency is increased to more realistically reflect normal network traffic.

4. The network protocol simulation method based on independent research and development according to claim 1 is characterized in that: The specific process in S3 is: S31. Use virtualization or container technology to isolate real services, extract traditional network functions from dedicated hardware, separate the control plane and data plane of the network, and dynamically configure and manage network traffic through a centralized controller; Use container technology to virtualize the real service network and protocol, and use the namespace and control group technology provided by the kernel to achieve container isolation; The communication between virtualized containers can be isolated through bridge networks, overlay networks, etc. S32. Introduce differential analysis technology to effectively detect lateral threats by comparing the behavioral differences between real services and simulated services; The differential analysis technology used by the system includes behavior analysis, traffic analysis, and differential signatures. Behavior analysis adaptively establishes a baseline behavior model by monitoring the normal behavior of the system, application, or user, and detects potential abnormal behaviors by comparing actual behaviors with the baseline model in real time or offline. Real-time comparison can immediately discover potential abnormal behaviors, while offline comparison analyzes historical data to identify lateral threats that may be overlooked. Traffic analysis focuses on the basic characteristics and behavior patterns of network traffic to identify possible abnormal traffic and further strengthen the detection and response to lateral threats. S33. Use the network configuration in the system to confuse and induce attackers to deviate from the real attack target, and record the attacker's activities in detail, including attack methods, attack paths, and connection methods; S34. Use secure synthetic data generation technology to generate simulation data of real services and simulate real scenarios while maintaining the independence of protocol simulation. By using data generation algorithms, generate data with authenticity, diversity, and compliance to ensure the authenticity of the experiment. At the same time, the generation algorithm also takes into account the similarity of the data to ensure that the generated data maintains a certain difference from the real data in content and structure, preventing attackers from analyzing the vulnerabilities of real services through simulated data.

5. The network protocol simulation method based on independent research and development according to claim 1 is characterized in that: The S4 covers five categories of system services, database services, application services, industrial control services, and Internet of Things services through the perception protocol. The specific steps are as follows: S41. Expand the scope of perception protocols, apply protocols, implement protocol support, maintain the ability to perceive the latest network technologies and services by regularly updating and adding new protocols, and more comprehensively cover various protocols that may be used for horizontal propagation; S42. Introducing the Adaptive Protocol Model (APM), which can learn new protocols and service features in real time and adjust its perception capabilities accordingly; S43. Timing simulator compatibility test, collects data of real services, including protocol communication records, network traffic data and various interaction scenarios of real services. Based on the collected data, the system spontaneously creates a virtual test environment to simulate real services. In the virtual test environment, the system performs timing compatibility tests on common scenarios and edge scenarios to ensure that the perception protocol can still run stably in the face of various extreme situations; S44. Use a protocol version management mechanism to ensure that the perception protocol can maintain stable support for different versions of the protocol. By establishing a protocol version database, record the protocol name, major version number, minor version number, revision number, feature value, forward and backward compatibility test records and related documents of known protocols; By considering the upgrade and evolution of the protocol, the compatibility of the system between different protocol versions is tested to prevent perception failure caused by protocol updates; By establishing PVD, protocol rollback can be supported so that when problems occur, the protocol can be rolled back to the original version in a timely manner. S45. Supports heterogeneous networks, and the perception protocol covers five major categories: system services, database services, application services, industrial control services, and Internet of Things services.

Images