An automatic blocking method and system for IPv6 attack based on NAT64

Abstract

The application provides an IPv6 attack automatic blocking method and system based on NAT64, and relates to the technical field of network security.The method provided by the application comprises the following steps: obtaining traffic data passing through a network boundary, extracting key information of the traffic data in real time and processing the key information in a standardized manner, obtaining general data and constructing a NAT64 database; performing abnormal behavior detection on the general data, marking the general data as potential attack sources, and extracting abnormal information of the potential attack sources; based on NAT64 address mapping, reversely querying the NAT64 database by taking the abnormal information as a query condition, judging whether an IPv4 address of the potential attack sources is converted by NAT64 based on a query result, and obtaining an attack source IPv6 address if the IPv4 address is converted by NAT64; generating a blocking instruction for the attack source IPv6 address based on a blocking policy template, and sending the blocking instruction to a network security device through a device interface protocol to complete automatic blocking; and recording a blocking operation log and sending an alarm notification in real time.The application realizes automatic blocking of IPv6 attacks in combination with an abnormal behavior detection mechanism, an address mapping identification mechanism and an automatic blocking policy.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for automatically blocking IPv6 attacks based on NAT64. Background Technology

[0002] With the continuous evolution of the Internet, the IPv6 protocol is becoming increasingly popular, and NAT64, as a key transition technology, is widely used to achieve interconnection between IPv6 and IPv4 networks. However, in a NAT64 environment, IPv6 networks face many new security challenges, especially in terms of attack protection.

[0003] Currently, many security devices are deployed within IPv4 networks, and the attack source addresses they detect are all IPv4 addresses translated by NAT64. This makes it impossible to accurately and promptly identify and handle the real IPv6 attack sources. This problem often results in delayed attack interception and inaccurate blocking scope, leading to malicious occupation of network resources, severe interference with normal user services, and even potentially triggering wider network security incidents. Therefore, there is an urgent need to provide a solution to improve these issues. Summary of the Invention

[0004] The purpose of this invention is to provide an automatic blocking method for IPv6 attacks based on NAT64, which can improve the problems of untimely interception and inaccurate blocking in the prior art.

[0005] In a first aspect, the present invention provides an automatic blocking method for IPv6 attacks based on NAT64, comprising:

[0006] In-real-time capture of IPv6 inbound traffic on the data forwarding path of the NAT64 gateway, and synchronous acquisition of mapping relationships generated during NAT64 address translation. A NAT64 translation context profile is constructed based on the IPv6 inbound traffic and the mapping relationships. For each original IPv6 source address, all NAT64 translation events triggered within a preset time window are aggregated, and multi-dimensional behavioral features are extracted. Based on the multi-dimensional behavioral features, a dynamic behavioral profile is constructed for each original IPv6 source address. Key information of traffic data passing through the network boundary is extracted in real-time, and the key information is standardized to obtain general data and construct a NAT64 database. Anomaly detection is performed based on the NAT64 translation context profile and the dynamic behavioral profile. If anomaly behavior is identified, it is marked as a potential attack source, and the anomaly information of the potential attack source is extracted.

[0007] Based on NAT64 address mapping, the abnormal information is used as a query condition to query the NAT64 database in reverse. Based on the query result, it is determined whether the IPv4 address of the potential attack source has undergone NAT64 translation. If so, the IPv6 address of the potential attack source is obtained.

[0008] Based on the blocking policy template, a blocking command is generated for the IPv6 address of the potential attack source. The blocking command is sent to the network security device through the device interface protocol to complete the automatic blocking. The blocking operation log is recorded and an alarm notification is sent in real time.

[0009] This invention provides an automatic blocking method for IPv6 attacks based on NAT64. By acquiring traffic data at the network boundary and combining abnormal behavior detection and address mapping identification mechanisms, the method identifies the IPv6 address that initiates the attack and implements access control and blocking processing for the IPv6 address through an automatic blocking policy.

[0010] Optionally, the mapping relationship includes the original IPv6 source address, the mapped IPv4 source port, the target IPv4 server address, the target IPv4 server port, and the transport layer protocol type;

[0011] The multidimensional behavioral characteristics include the frequency of mapping session establishment per unit time, the distribution entropy or concentration of the target IPv4 service, session duration, number of data exchange bytes and connection termination method, the dispersion of the IPv4 source port used for mapping, application layer protocol characteristics, and IPv6 address structure attributes; wherein, the application layer protocol characteristics include TLS fingerprint, HTTP request path or payload entropy value, and the IPv6 address structure attributes include whether it is a temporary privacy address, an SLAAC generated address or a fixed prefix address.

[0012] Optionally, the dynamic behavior profile is stored in structured data format and updated in real time as the time window slides.

[0013] Optionally, the key information includes session access time node, source IPv6 address, source port, destination IPv6 address, destination port, NAT64 source IPv4 address, NAT64 source port, NAT64 destination IPv4 address, and NAT64 destination port.

[0014] Optionally, when performing abnormal behavior detection based on the NAT64 translation context profile and the dynamic behavior profile, the method further includes:

[0015] Aggregate NAT64 source IPv4 addresses and count the number of times the NAT64 source IPv4 addresses access different destination IPv4 addresses within a sliding time window. If the number exceeds a first preset threshold, abnormal behavior is detected.

[0016] Alternatively, it aggregates the NAT64 source IPv4 address, NAT64 destination IPv4 address, destination port, and network transport layer protocol to calculate the number of accesses per unit time. If the number of accesses exceeds a second preset threshold, there is abnormal behavior. The second preset threshold can be either a static threshold or a dynamic baseline.

[0017] Alternatively, based on deep packet inspection, the packet payload and protocol characteristics of the general data are analyzed, and the analysis results are matched with a predefined rule base. If a match is successful, abnormal behavior is identified. The predefined rule base includes attack payload characteristics and protocol anomaly characteristics.

[0018] Alternatively, an anomaly score can be obtained by performing an unsupervised model on the general data; a supervised score can be obtained by classifying and identifying the general data based on a supervised model; the unsupervised score and the supervised score can be weighted and fused to obtain a comprehensive score; if the comprehensive score is greater than a third preset threshold, an abnormal behavior exists; the unsupervised model includes Lone Forest, Local Anomaly Factor, and Autoencoder; the supervised model includes Random Forest and Deep Neural Network.

[0019] Optionally, determining whether the IPv4 address of a potential attack source has undergone NAT64 translation includes: using the anomaly information as a query condition to perform a reverse query on the NAT64 database, matching the IPv4 address of the potential attack source with the NAT64 database, and if an IPv6 address field is extracted from the query result, it indicates that the IPv4 address of the potential attack source has undergone NAT64 translation, and the IPv6 address of the potential attack source is obtained; if no IPv6 address field is obtained from the query result, it indicates that the IPv4 address of the potential attack source has not undergone NAT64 translation.

[0020] Optionally, when generating a blocking command, the process includes: injecting the abnormal information into a predefined blocking policy template, outputting a blocking command targeting the IPv6 address of the potential attack source, wherein the blocking command includes a blocking name, blocking action, blocking time, blocking source IP address, and blocking reason; the abnormal information includes attack time, attack event name, attack severity, attack source address, attack source port, destination IP address, and destination port; and setting the blocking duration and blocking scope based on the attack event, attack severity, and attack event name in the abnormal information.

[0021] Optionally, when setting the blocking duration and scope based on the attack event, attack severity, and attack event name based on the abnormal information, the following are included:

[0022] If the attack is a light scan, the attack severity is low, and the corresponding ban duration is the first predetermined duration; if the attack is a severe flood attack, the attack severity is medium, and the corresponding ban duration is the second predetermined duration; if the attack is a repeated attack, the attack severity is high, and the corresponding ban duration is the third predetermined duration or a permanent ban.

[0023] If the attack is a single point of attack, the blocking scope is the single attack source IP address; if the attack is a distributed attack and the number of detected attack source IP addresses is greater than the first threshold, the blocking scope is the network segment where the attack source IP address is located; if the attack has advanced persistent threat characteristics and the number of detected attack source IP addresses is greater than the second threshold, the blocking scope is the network segment where the attack source IP address is located.

[0024] Optionally, the device interface protocol includes the RESTful API protocol, SSH+CLI script, and NETCONF / YANG protocol; the network security device includes a NAT64 gateway and a firewall.

[0025] Secondly, the present invention provides an automatic IPv6 attack blocking system based on NAT64, comprising:

[0026] The traffic acquisition module is used to capture IPv6 inbound traffic in real time on the data forwarding path of the NAT64 gateway, and simultaneously acquire the mapping relationship generated during the NAT64 address translation process. Based on the IPv6 inbound traffic and the mapping relationship, a NAT64 translation context profile is constructed. For each original IPv6 source address, all NAT64 translation events triggered within a preset time window are aggregated, and multi-dimensional behavioral features are extracted. Based on the multi-dimensional behavioral features, a dynamic behavioral profile is constructed for each original IPv6 source address. Key information of traffic data passing through the network boundary is extracted in real time, and the key information is standardized to obtain general data and construct a NAT64 database.

[0027] An anomaly detection module is used to detect abnormal behavior based on the NAT64 translation context profile and the dynamic behavior profile. If abnormal behavior is identified, it is marked as a potential attack source, and the abnormal information of the potential attack source is extracted.

[0028] The address mapping module is used to use the abnormal information as a query condition based on NAT64 address mapping to query the NAT64 database in reverse. Based on the query result, it determines whether the IPv4 address of the potential attack source has undergone NAT64 translation. If so, it obtains the IPv6 address of the potential attack source.

[0029] The automatic blocking module is used to generate blocking instructions for the IPv6 addresses of potential attack sources based on the blocking policy template, and send the blocking instructions to the network security device through the device interface protocol to complete the automatic blocking; it also records the blocking operation log and sends alarm notifications in real time. Attached Figure Description

[0030] Figure 1 A flowchart of an automatic blocking method for IPv6 attacks based on NAT64 provided in this embodiment of the invention;

[0031] Figure 2 This is a structural diagram of an automatic IPv6 attack blocking system based on NAT64 provided in an embodiment of the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0033] See Figure 1 This invention provides an automatic blocking method for IPv6 attacks based on NAT64, comprising the following steps:

[0034] S1. Capture IPv6 inbound traffic in real time on the data forwarding path of the NAT64 gateway, and synchronously obtain the mapping relationship generated during the NAT64 address translation process. Construct a NAT64 translation context profile based on the IPv6 inbound traffic and the mapping relationship. For each original IPv6 source address, aggregate all NAT64 translation events triggered within a preset time window and extract multi-dimensional behavioral features. Based on the multi-dimensional behavioral features, construct a dynamic behavioral profile for each original IPv6 source address. Extract key information from traffic data passing through the network boundary in real time, standardize the key information, obtain general data, and construct a NAT64 database.

[0035] S2. Based on NAT64 translation context profile and dynamic behavior profile, abnormal behavior is detected. If abnormal behavior is identified, it is marked as a potential attack source, and the abnormal information of the potential attack source is extracted.

[0036] S3. Based on NAT64 address mapping, use the abnormal information as a query condition to query the NAT64 database in reverse. Based on the query result, determine whether the IPv4 address of the potential attack source has been translated by NAT64. If so, obtain the IPv6 address of the potential attack source.

[0037] S4. Generate blocking instructions for potential attack source IPv6 addresses based on the blocking policy template, and send the blocking instructions to the network security device through the device interface protocol to complete the automatic blocking; record the blocking operation log and send alarm notifications in real time.

[0038] In fact, the automatic blocking method provided by this invention standardizes the acquired traffic data and constructs a database, combines abnormal behavior detection and address mapping mechanisms to determine the attack source and its IPv6 address, generates a blocking instruction for the address based on the blocking policy template, and finally transmits the instruction to the network security device through the device interface protocol. Therefore, it can automatically block the IPv6 address that initiates the attack and achieve the purpose of access control and blocking processing for the address.

[0039] In some embodiments, in step S1, IPv6 inbound traffic is captured in real time on the data forwarding path of the NAT64 gateway, and the mapping relationship generated during the NAT64 address translation process is obtained synchronously. The mapping relationship includes at least the original IPv6 source address, the mapped IPv4 source port, the target IPv4 server address and port, and the transport layer protocol type. For each original IPv6 source address, based on a preset time window, all NAT64 translation events triggered within the preset time window are aggregated, and multi-dimensional behavioral features are extracted. The multi-dimensional behavioral features include:

[0040] (a) Frequency of mapping session establishment per unit time;

[0041] (b) Distribution entropy or concentration of the target IPv4 service;

[0042] (c) Session duration, number of bytes of data exchanged, and connection termination method;

[0043] (d) The degree of dispersion of the IPv4 source ports used for mapping;

[0044] (e) Application layer protocol characteristics, including TLS fingerprints, HTTP request paths, or payload entropy values;

[0045] (f) IPv6 address structure attributes, including whether it is a temporary privacy address, a SLAAC generated address, or a fixed prefix address;

[0046] Based on the aforementioned multi-dimensional behavioral characteristics, a dynamic behavioral profile is constructed for each IPv6 source address. This profile is stored in structured data and updated in real-time as the time window slides, characterizing the network behavior pattern of the IPv6 source address. Subsequently, key information is extracted from the collected logs and traffic. This key information may include session access time, source IPv6 address, source port, destination IPv6 address, destination port, NAT64 source IPv4 address, NAT64 source port, NAT64 destination IPv4 address, and NAT64 destination port. The extracted key information is then standardized using JSON, converting it into structured data with a unified format, standardized fields, and conforming to JSON syntax standards. A NAT64 database is constructed based on this standardized general data to provide data support for subsequent analysis and IPv6 blocking.

[0047] Specifically, the JSON schema defined for the key information is as follows:

[0048] {

[0049] "sessionTime": {},

[0050] "srcIpv6": {},

[0051] "srcIpv6Port": {},

[0052] "destIpv6": {},

[0053] "destIpv6Port": {},

[0054] "nat64SrcIpv4": {},

[0055] "nat64SrcIpv4Port": {},

[0056] "nat64DestIpv4": {},

[0057] "nat64DestIpv4Port": {},

[0058] "valid": true

[0059] };

[0060] The descriptions of each field are as follows:

[0061] sessionTime: The time when the session log was retrieved;

[0062] srcIpv6: Source IPv6 address;

[0063] srcIpv6Port: Source IPv6 port;

[0064] destIpv6: Destination IPv6 address;

[0065] destIpv6Port: Destination IPv6 port;

[0066] nat64SrcIpv4: NAT64 source IPv4 address;

[0067] nat64SrcIpv4Port: NAT64 source IPv4 port;

[0068] nat64DestIpv4: NAT64 destination IPv4 address;

[0069] nat64DestIpv4Port: NAT64 destination IPv4 port;

[0070] valid: The result of validity.

[0071] In some embodiments, when abnormal behavior detection is performed in step S2 based on the NAT64 translation context profile and the dynamic behavior profile, and if abnormal behavior is identified, it is marked as a potential attack source and the abnormal information of the potential attack source is extracted, the abnormal behavior detection is mainly achieved in the following ways:

[0072] Specifically, anomaly analysis is performed on contextual profile data, including the following detection modes:

[0073] Single address accessing multiple destinations in a short period: Aggregate by NAT64 source IPv4 address and count the number of different destination IPv4 addresses accessed within a sliding window time (e.g., 30 seconds). If the number exceeds a first preset threshold... (like If the value is adjusted according to the internal server size, it is considered abnormal.

[0074] Request frequency exceeding threshold: The system aggregates requests per unit time (e.g., number of packets or connections established) based on NAT64 source IPv4 address, NAT64 destination IPv4 address, destination port, and network transport layer protocol. If the number of requests exceeds a second preset threshold (e.g., 1000 pps or 100 connections / s), it is considered abnormal. The second preset threshold can be either a static threshold or a dynamic baseline. Static thresholds are fixed values ​​preset based on experience, business rules, or industry standards, suitable for scenarios with clear traffic expectations. For example, a normal business API might not exceed 100 requests per second, so a threshold of 1000 is set to capture abnormal bursts. Dynamic baselines are reference values ​​dynamically calculated based on the statistical characteristics of historical data, automatically adjusting over time and according to changes in business scenarios. They are suitable for complex scenarios with large business fluctuations and periodic traffic characteristics.

[0075] Behavioral pattern matching of known attack characteristics: Based on deep packet inspection, the packet payload and protocol characteristics of general data are analyzed. The analysis results are then matched against a predefined rule base. If a match is successful, the attack is identified as an anomaly. The predefined rule base includes attack payload characteristics and protocol anomaly characteristics. Common attack payload characteristics can be SQL injection, cross-site scripting, and known malware. Common protocol anomaly characteristics can be SYN Flood (a large number of TCP packets containing only the SYN flag, without subsequent ACK, and with randomly changing source ports), UDP Flood (sending a large number of small UDP packets to random or specific ports, exhausting the target's bandwidth or processing resources; the source address may be random), and ICMP protocol anomalies (a large number of ping requests).

[0076] Attack identification based on machine learning models: First, an unsupervised model is used to perform anomaly detection on real-time general data (for unknown attack detection) to obtain an unsupervised score. Among them, unsupervised models include Isolation Forest, Local Outlier Factor (LOF), and Autoencoder; when using autoencoder, it is trained using historical normal traffic data and the reconstruction error of general data is used as the outlier score.

[0077] Secondly, a supervised model is used to classify and identify general data (for the identification of known attack patterns) to obtain supervised scores. Based on historical labeled data (such as known DDoS, scanning, spoofing, and other attack samples), a supervised classification model (such as XGBoost, Random Forest, or Deep Neural Network classification models) is trained, and the probability that the current traffic belongs to the attack class is output as the supervised score. ;

[0078] Finally, unsupervised scoring and supervised rating A weighted fusion is performed to obtain a comprehensive score. If the overall score Greater than the third preset threshold (like If the number of such cases is found to be abnormal, the subsequent banning process will be triggered.

[0079] In some embodiments, when determining whether the IPv4 address of a potential attack source has undergone NAT64 translation in step S3, based on NAT64 address mapping, the obtained attack source address, attack source port, destination IP address, and destination port are used as query conditions to perform a reverse query on the NAT64 database. The IPv4 address of the potential attack source is matched with the NAT64 database. If an IPv6 address field is extracted from the query result, it indicates that the IPv4 address of the potential attack source has undergone NAT64 translation, and the IPv6 address of the potential attack source is obtained. If no IPv6 address field is obtained from the query result, it indicates that the IPv4 address of the potential attack source has not undergone NAT64 translation, and there is no corresponding IPv6 address for this address; it is a native IPv4 address.

[0080] In some embodiments, when generating a blocking instruction for the potential attack source IPv6 address based on the blocking policy template in step S4, abnormal information is injected into the predefined blocking policy template, and a blocking instruction for the potential attack source IPv6 address is output. The blocking instruction includes the blocking name, blocking action, blocking duration, blocking source IP address, and blocking reason. The blocking duration and blocking scope are set based on the attack event, attack severity, and attack event name in the abnormal information. The higher the attack severity, the longer the blocking duration and the wider the blocking scope.

[0081] Specifically, the blocking commands generated and issued by the system use a structured data format, represented as JSON objects, containing key fields such as policy name, action, source IP address, target region, blocking duration, reason for blocking, and creator. This command is used to automatically configure network devices (such as firewalls) to achieve precise blocking of abnormal IPv6 addresses.

[0082] The data format definition for blocking commands is as follows:

[0083] {"policy_name":"AUTO_BLOCK_IPV6_{{ATTACK_SOURCE}}_{{TIMESTAMP}}",

[0084] "action": "deny",

[0085] "source_ip": "{{ATTACK_SOURCE}}",

[0086] "destination_zone": "NAT64_INTERNAL",

[0087] "duration": "{{BLOCK_DURATION}}",

[0088] "reason": "Detected: {{ATTACK_TYPE}} via automated analysis",

[0089] "created_by": "Auto-Security-System"};

[0090] The descriptions of each field are as follows:

[0091] policy_name: Policy name, dynamically generated using a fixed prefix AUTO_BLOCK_IPV6 combined with the attack source address (ATTACK_SOURCE) and timestamp (TIMESTAMP) to ensure uniqueness;

[0092] action: Executes an action, which is always "deny", indicating that access is denied;

[0093] source_ip: The IPv6 address of the attack source, corresponding to the source of the anomaly identified by the anomaly detection module;

[0094] destination_zone: target zone, fixed as BLOCK_DURATION, indicating that the blocking policy applies to the NAT64 internal network zone;

[0095] duration: The duration of the ban, which is dynamically set according to the severity of the attack;

[0096] Reason: The reason for the ban, including the attack type (ATTACK_TYPE) and the source of the detection;

[0097] created_by: Policy creator, identified as Auto-Security-System.

[0098] The following is a practical example of a blocking command, demonstrating the automatically generated policy configuration when the system detects a SYN Flood attack at source address 2001:db8::a1b2:

[0099] {

[0100] "policy_name":"AUTO_BLOCK_IPV6_2001:db8::a1b2:30_min_202509011030",

[0101] "action": "deny",

[0102] "source_ip": "2001:db8::a1b2",

[0103] "destination_zone": "NAT64_INTERNAL",

[0104] "duration": 1800,

[0105] "reason": "Detected: SYN Flood via automated analysis",

[0106] "created_by": "Auto-Security-System"

[0107] };

[0108] The actual meanings of each field in this instruction are as follows:

[0109] policy_name: Policy name, attack source address is 2001:db8::a1b2, timestamp is 30_min_202509011030;

[0110] action: The action to be executed is deny, which means that access is denied;

[0111] source_ip: The attack source IPv6 address is 2001:db8::a1b2;

[0112] destination_zone: The target zone is set to NAT64_INTERNAL, indicating that the blocking policy applies to the NAT64 internal network zone;

[0113] Duration: The ban lasts for 1800 seconds, or 30 minutes.

[0114] Reason: The reason for the ban was "SYN Flood attack detected";

[0115] created_by: The policy creator is "Auto-Security-System".

[0116] Specifically, when setting blocking time and scope based on the attack event, attack severity, and attack event name, if the attack event is a minor scan, the attack severity is low, and the corresponding blocking time can be 5 minutes. This is because the attack event may be an automated tool, security research, or a false alarm, and a short-term blocking is sufficient to interrupt the current scanning task without causing long-term impact on the real users who are falsely reported. If the attack event is a severe flood attack, the attack severity is medium, and the corresponding blocking time can be 30 minutes. This is because the attack aims to cause service interruption, has a huge impact, and requires a sufficiently long blocking time to mitigate the attack waves. The specific blocking time can be dynamically adjusted according to the attack traffic volume (e.g., the larger the traffic, the longer the blocking). If the attack event is a repeated attack, the attack severity is high, and the corresponding blocking time can be 24 hours or a permanent blocking. This is because if a source address triggers different alarms multiple times within a certain period of time, it indicates that it is a targeted attacker with a strong purpose and needs to be isolated for a long time.

[0117] If the attack is a single-point attack, the blocking scope is the single attack source IP address (e.g., blocking the / 32 network segment for IPv4, and blocking the / 128 network segment for IPv6). If the attack is a distributed attack, and the number of detected attack source IP addresses is greater than the first threshold (e.g., 10), the blocking scope is the network segment where the attack source IP address is located (e.g., blocking the / 24 network segment for IPv4, and blocking the / 48 network segment for IPv6). If the attack exhibits advanced persistent threat characteristics, and the number of detected attack source IP addresses is greater than the second threshold (e.g., 100), then instead of blocking a single IP, the entire network segment where the attack source IP is located is blocked (e.g., blocking the entire / 64 network segment for IPv6).

[0118] It should be noted that the above rules for determining the duration and scope of bans are for illustrative purposes only, and can be determined by other reasonable rules as well. This application is not limited to these rules.

[0119] In some embodiments, when the blocking command is sent to the network security device via the device interface protocol in step S4 to complete the automatic blocking, the system generates the blocking command and then sends it to the target network security device via a standardized device interface protocol. This immediately puts the attack source into a blocked state, and its subsequent traffic will be blocked in real time. Simultaneously, the system records detailed logs of the blocking operation and proactively sends real-time alerts to the network administrator for subsequent attack tracing, policy auditing, and incident handling. The device interface protocol can be a RESTful API protocol, an SSH+CLI script, or a NETCONF / YANG protocol; the network security device can be a NAT64 gateway or a firewall.

[0120] Specifically, SSH+CLI scripts are automation tools that log into devices via the SSH protocol, simulate an administrator's input, and send command-line instructions (CLI) one by one. This method is highly versatile and suitable for scenarios where traditional network devices (such as Juniper SRX and Huawei NE series routers) only provide command-line management interfaces. The specific blocking process for this protocol is as follows:

[0121] Establish an encrypted connection with the network security device via an SSH client (such as the Paramiko library); automatically load the corresponding command-line interface (CLI) module script based on the device manufacturer (e.g., Juniper uses the `set securitypolicies...` command, Huawei uses the `acl ipv6 number...` command); populate the template with the IPv6 address to be blocked as a variable to generate a complete CLI command sequence; execute the command sequence and verify the configuration output (e.g., check "commitcomplete" or "OK"); after the configuration takes effect, the IPv6 address is prohibited from NAT64 protocol translation.

[0122] Specifically, the RESTful API protocol uses HTTP / HTTPS to call the REST API interface provided by the device, transmitting policy configurations in JSON or XML format. This protocol is simple to develop and easy to integrate with existing automation systems or cloud platforms; it is suitable for security devices that support REST APIs (such as Huawei USG firewalls, H3C SecPath firewalls, etc.). The specific blocking process of this protocol is as follows:

[0123] Construct a standard HTTP POST request that carries an authentication token based on OAuth2 or API Key; the request body includes the IPv6 address to be blocked, the duration of the block, the reason for the block, and the policy name; after receiving the request, the network security device dynamically creates an access control list (ACL) rule through its policy engine to deny all IPv4 mapping connections initiated by the IPv6 address through the NAT64 gateway.

[0124] Specifically, the NETCONF / YANG protocol is an XML-based network configuration protocol that uses the YANG data model to define configuration structures. This protocol supports functions such as transactions, verification, and rollback, and is suitable for devices that support standardized network configurations (e.g., Cisco IOS-XR, OpenDaylight controllers). The specific blocking process for this protocol is as follows:

[0125] Establish a management session with network security devices via the NETCONF over SSH protocol; load predefined YANG data models (e.g., ietf-access-control-list, openconfig-acl); construct an XML or JSON configuration fragment conforming to the YANG data model schema, which describes the new ACL entry for IPv6 addresses; and use the NETCONF protocol... <edit-config>The operation pushes the configuration fragment to the network security device; the device parses and submits the configuration to achieve precise blocking of IPv6 addresses.

[0126] refer to Figure 2 This invention provides an automatic IPv6 attack blocking system based on NAT64, comprising the following steps:

[0127] The traffic acquisition module 100 is used to capture IPv6 inbound traffic in real time on the data forwarding path of the NAT64 gateway, and simultaneously acquire the mapping relationship generated during the NAT64 address translation process. Based on the IPv6 inbound traffic and the mapping relationship, it constructs a NAT64 translation context profile. For each original IPv6 source address, it aggregates all NAT64 translation events triggered within a preset time window and extracts multi-dimensional behavioral features. Based on the multi-dimensional behavioral features, it constructs a dynamic behavioral profile for each original IPv6 source address. It extracts key information from traffic data passing through the network boundary in real time, standardizes the key information, obtains general data, and constructs a NAT64 database.

[0128] The anomaly detection module 200 is used to detect abnormal behavior based on NAT64 translation context profile and dynamic behavior profile. If abnormal behavior is identified, it is marked as a potential attack source and the abnormal information of the potential attack source is extracted.

[0129] The address mapping module 300 is used to perform reverse lookup of the NAT64 database based on NAT64 address mapping, using abnormal information as query conditions. Based on the query results, it determines whether the IPv4 address of the potential attack source has undergone NAT64 translation. If so, it obtains the IPv6 address of the potential attack source.

[0130] The automatic blocking module 400 is used to generate blocking instructions for potential attack source IPv6 addresses based on blocking policy templates, and send the blocking instructions to network security devices through the device interface protocol to complete automatic blocking; it also records blocking operation logs and sends alarm notifications in real time.

[0131] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A method for automatically blocking an IPv6 attack based on NAT64, characterized in that, The application comprises the following steps: Real-time capturing of IPv6 inbound traffic on the data forwarding path of the NAT64 gateway, and synchronously obtaining the mapping relationship generated in the NAT64 address conversion process, constructing a NAT64 conversion context portrait based on the IPv6 inbound traffic and the mapping relationship; for each original IPv6 source address, aggregating all NAT64 conversion events triggered within a preset time window, and extracting multi-dimensional behavior features; Based on the multi-dimensional behavior features, a dynamic behavior portrait is constructed for each original IPv6 source address; Real-time extraction of key information of traffic data passing through the network boundary, standardization processing of the key information, obtaining of general data, and construction of a NAT64 database; Based on the NAT64 conversion context portrait and the dynamic behavior portrait, abnormal behavior detection is performed, and if an abnormal behavior is identified, the potential attack source is marked, and abnormal information of the potential attack source is extracted; Based on the NAT64 address mapping, the abnormal information is used as a query condition to reversely query the NAT64 database, and based on the query result, it is judged whether the IPv4 address of the potential attack source is converted by the NAT64, and if yes, the IPv6 address of the potential attack source is obtained; Based on the blocking policy template, a blocking instruction is generated for the potential attack source IPv6 address, the blocking instruction is sent to the network security device through the device interface protocol to complete automatic blocking, and a blocking operation log is recorded and an alarm notification is sent in real time.

2. The automatic banning method of claim 1, wherein, The mapping relationship comprises an original IPv6 source address, a mapped IPv4 source port, a target IPv4 server address, a target IPv4 server port, and a transport layer protocol type; The multi-dimensional behavior features comprise mapping session establishment frequency per unit time, distribution entropy value or concentration degree of target IPv4 service, session duration, data interaction byte number, and connection termination mode, discrete degree of the IPv4 source port used for mapping, application layer protocol features, and IPv6 address structure attributes; wherein the application layer protocol features comprise TLS fingerprint, HTTP request path, or payload entropy value, and the IPv6 address structure attributes comprise whether it is a temporary privacy address, a SLAAC generated address, or a fixed prefix address.

3. The method of automatically banning of claim 1, wherein, The dynamic behavior portrait is stored in a structured data form and is updated in real time with a time window sliding.

4. The method of automatically banning of claim 2, wherein, The key information comprises session access time node, source IPv6 address, source port, destination IPv6 address, destination port, NAT64 source IPv4 address, NAT64 source port, NAT64 destination IPv4 address, and NAT64 destination port.

5. The method of automatically banning of claim 4, wherein, When the abnormal behavior detection is performed based on the NAT64 conversion context portrait and the dynamic behavior portrait, the following steps are included: Aggregating the NAT64 source IPv4 address, and within a sliding time window, counting the number of different destination IPv4 addresses accessed by the NAT64 source IPv4 address, if the number exceeds a first preset threshold, there is an abnormal behavior; Or, aggregate the NAT64 source IPv4 address, the NAT64 destination IPv4 address, the destination port, and the network transport layer protocol, calculate the access frequency per unit time, and if the access frequency exceeds a second preset threshold, the abnormal behavior exists, and the second preset threshold includes a static threshold and a dynamic baseline; Or, based on deep packet inspection, analyze the data packet payload and protocol features of the general data, match the analysis result with a predefined rule library, and if the matching is successful, the abnormal behavior exists; the predefined rule library includes attack payload features and protocol anomaly features; Or, based on an unsupervised model, perform abnormal scoring on the general data to obtain an unsupervised score; based on a supervised model, perform classification identification on the general data to obtain a supervised score; weight and fuse the unsupervised score and the supervised score to obtain a comprehensive score; if the comprehensive score is greater than a third preset threshold, the abnormal behavior exists; the unsupervised model includes an isolation forest, a local outlier factor, and a self-encoder; the supervised model includes a random forest and a deep neural network.

6. The method of automatically banning of claim 1, wherein, When judging whether the IPv4 address of the potential attack source is converted by NAT64, the method comprises: taking the abnormal information as a query condition, querying a NAT64 database in reverse, matching the IPv4 address of the potential attack source with the NAT64 database, and if an IPv6 address field is extracted in the query result, it indicates that the IPv4 address of the potential attack source has been converted by NAT64, and the IPv6 address of the potential attack source is obtained; if no IPv6 address field is obtained in the query result, it indicates that the IPv4 address of the potential attack source has not been converted by NAT64.

7. The method of automatically banning of claim 1, wherein, When generating a ban instruction, the method comprises: injecting the abnormal information into a predefined ban strategy template, and outputting a ban instruction for the IPv6 address of the potential attack source, the ban instruction including a ban name, a ban action, a ban duration, a ban source IP address, and a ban reason; the abnormal information includes an attack time, an attack event name, an attack severity, an attack source address, an attack source port, a destination IP address, and a destination port; and the ban duration and ban range are set based on the attack event, attack severity, and attack event name of the abnormal information.

8. The method of automatically banning of claim 7, wherein, When setting the ban duration and ban range based on the attack event, attack severity, and attack event name of the abnormal information, the method comprises: If the attack event is a light scan, the attack severity is low, and the corresponding ban duration is a first predetermined duration; if the attack event is a serious Flood attack, the attack severity is medium, and the corresponding ban duration is a second predetermined duration; if the attack event is a repeated attack, the attack severity is high, and the corresponding ban duration is a third predetermined duration or permanent ban; If the attack event is a single-point attack, the blocking range is a single attack source IP address; if the attack event is a distributed attack and the number of detected attack source IP addresses is greater than a first threshold, the blocking range is a network segment where the attack source IP addresses are located; if the attack event is a high-advanced persistent threat feature and the number of detected attack source IP addresses is greater than a second threshold, the blocking range is a network segment where the attack source IP addresses are located.

9. The method of automatically banning of claim 1, wherein, The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall.

10. A system for automatically blocking NAT64-based IPv6 attacks, characterized in that, The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall. The device interface protocol includes a RESTful API protocol, an SSH+CLI script, and a NETCONF / YANG protocol; and the network security device includes a NAT64 gateway and a firewall.

Images