Linux system port multiplexing attack detection method and device

Through the Linux system kernel and application layer linkage detection, combined with the traversal of socket socket data tables and port sharing detection rules, real-time automatic detection of attacks on port reuse of Linux system is achieved, solving the problem of lack of effective automatic detection methods in the existing technology, and improving system security and stability.

CN119577753AActive Publication Date: 2025-03-07BEIJING BIG DATA CENT
View PDF 7 Cites 0 Cited by

Patent Information

Application Number
CN202411600766.3
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-11-11
Publication Date
2025-03-07
Estimated Expiration
2044-11-11

Smart Images

  • Figure CN119577753A_ABST
    Figure CN119577753A_ABST
Patent Text Reader

Abstract

The invention discloses a Linux system port multiplexing attack detection method and device, and the method comprises the steps: detecting a setsocket system to call a first process, obtaining corresponding process information, and transmitting the corresponding process information to an application layer; obtaining a first socket inode number in the first process information called by the setsocket system through the application layer; acquiring a first socket corresponding to the inode number of the first socket in the socket socket data table, traversing the socket socket data table, and acquiring a second socket sharing a port with the first socket according to a port sharing detection rule; and on the basis of the first socket and the second socket, judging whether corresponding port multiplexing attack behaviors exist when the setsocket system calls the first process and when the setsocket system calls the second process or not. Through linkage detection of a system kernel and an application layer, real-time automatic detection of a port multiplexing attack behavior is realized.
Need to check novelty before this filing date? Find Prior Art

Citation Information

Patent Citations

  • Master-slave communication method and system adopting reliable and unreliable networks in monitoring program

    CN103841148A

  • Advanced persistent threat detection method based on aggressive behavior analysis

    CN105871883A

  • UDP-based data transmission method and connection device

    CN111314273A

  • Network attack information processing method and device, electronic equipment and storage medium

    CN111565199A

  • Hidden port detection method and device based on Linux kernel

    CN116484364A