Network intrusion prevention method and device and medium

Abstract

The invention relates to a network intrusion prevention method and device and a medium, and belongs to the technical field of network security. The method comprises the following steps: acquiring a network data packet; matching the network data packet with a pre-established attack feature library to judge whether an attack behavior exists or not; inputting the network data packet into a normal network behavior baseline model to judge whether an abnormal behavior exists or not; if the attack behavior exists and the abnormal behavior exists, generating a potential attack signal, attack type information, an abnormal behavior signal and behavior abnormal degree information; based on the potential attack signal, the attack type information, the abnormal behavior signal and the behavior abnormal degree information, judging whether an intrusion behavior exists or not; and if the intrusion behavior exists, executing a defense action on the intrusion behavior. According to the method and the device, the intrusion is efficiently detected and defended on the OpenWRT platform based on the embedded Linux system.

Description

Technical Field

[0001] This disclosure belongs to the field of network security technology, and specifically relates to a network intrusion prevention method, device and medium. Background Technology

[0002] With the rapid development of network technology, network security faces increasingly severe challenges. Various network attack methods are constantly emerging, seriously threatening the security and stability of network systems. Traditional network security methods can only perform access control based on pre-set rules, making it difficult to cope with new and complex attack behaviors. Intrusion Detection and Prevention Systems (IDPS) can compensate for the shortcomings of firewalls, monitoring network traffic in real time, detecting potential attacks, and taking corresponding defensive measures. However, they have certain limitations in terms of flexibility, real-time performance, and intelligence, especially on the OpenWRT platform based on the embedded Linux system. How to efficiently implement intrusion detection and prevention functions to ensure network security is an important issue facing researchers. Summary of the Invention

[0003] This disclosure proposes a network intrusion prevention method, device, and medium to solve the problem of how to efficiently implement intrusion detection and prevention functions on the OpenWRT platform based on an embedded Linux system.

[0004] According to a first aspect of this disclosure, a network intrusion prevention method is provided, applied to an OpenWRT platform based on an embedded Linux system. The method includes: acquiring network data packets; matching the network data packets with a pre-established attack signature database to determine whether an attack behavior exists; inputting the network data packets into a normal network behavior baseline model to determine whether abnormal behavior exists; if an attack behavior exists and abnormal behavior exists, generating potential attack signals, attack type information, abnormal behavior signals, and behavior abnormality degree information; determining whether an intrusion behavior exists based on the potential attack signals, the attack type information, the abnormal behavior signals, and the behavior abnormality degree information; and if an intrusion behavior exists, performing defensive actions against the intrusion behavior.

[0005] In some embodiments, the Libpcap library is used to acquire network packets via an Ethernet interface or a Wi-Fi interface.

[0006] In some embodiments, the attack signature database includes abnormal traffic characteristics of DDoS attacks and specific port access patterns of port scans.

[0007] In some embodiments, the defensive action includes blocking the IP address of the attack source or isolating the network segment where the infected device is located.

[0008] In some embodiments, iptables is used to block the IP address of the attack source.

[0009] In some embodiments, the network segment where the infected device resides is isolated via network configuration commands.

[0010] According to a second aspect of this disclosure, a network intrusion prevention device is provided, comprising: a network data packet acquisition module for acquiring network data packets; a feature matching module for matching the network data packets with a pre-established attack feature database to determine whether an attack behavior exists; a traffic behavior comparison module for comparing the network data packets with a normal network behavior baseline model to determine whether abnormal behavior exists; a signal and information generation module for generating potential attack signals, attack type information, abnormal behavior signals, and behavior abnormality degree information if both attack behavior and abnormal behavior exist; an intrusion behavior judgment module for determining whether an intrusion behavior exists based on the potential attack signals, the attack type information, the abnormal behavior signals, and the behavior abnormality degree information; and a defense action execution module for executing defense actions against the intrusion behavior if it exists.

[0011] According to a third aspect of this disclosure, a network intrusion prevention device is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the network intrusion prevention method as described above based on instructions stored in the memory.

[0012] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided that stores computer program instructions thereon, which, when executed by a processor, implement the network intrusion prevention method as described above.

[0013] Advantages of this disclosure: In some embodiments of this solution, the network intrusion prevention method includes: acquiring network data packets; matching the network data packets with a pre-established attack signature database to determine whether an attack behavior exists; comparing the network data packets with a normal network behavior baseline model to determine whether abnormal behavior exists; if an attack behavior exists and abnormal behavior exists, generating potential attack signals, attack type information, abnormal behavior signals, and behavior abnormality degree information; based on the potential attack signals, attack type information, abnormal behavior signals, and behavior abnormality degree information, determining whether an intrusion behavior exists; if an intrusion behavior exists, performing defensive actions against the intrusion behavior. Through the above method, efficient intrusion detection and defense are achieved on the OpenWRT platform based on an embedded Linux system. Attached Figure Description

[0014] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the specification, serve to explain the principles of this disclosure.

[0015] This disclosure can be more clearly understood with reference to the accompanying drawings and the following detailed description.

[0016] Figure 1 This is a flowchart illustrating a network intrusion prevention method according to some embodiments of the present disclosure.

[0017] Figure 2 This is a block diagram illustrating a network intrusion prevention device according to some embodiments of the present disclosure.

[0018] Figure 3 This is a block diagram illustrating a network intrusion prevention device according to other embodiments of the present disclosure.

[0019] Figure 4 This is a block diagram illustrating a computer system for implementing some embodiments of the present disclosure. Detailed Implementation

[0020] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present disclosure.

[0021] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0022] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this disclosure or its application or utility.

[0023] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0024] In all the examples shown and discussed herein, any specific values ​​should be understood as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0025] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0026] With the rapid development of network technology, network security faces increasingly severe challenges. Various network attack methods are constantly emerging, seriously threatening the security and stability of network systems. Traditional network security methods can only perform access control based on pre-set rules, making it difficult to cope with new and complex attack behaviors. Intrusion Detection and Prevention Systems (IDPS) can compensate for the shortcomings of firewalls, monitoring network traffic in real time, detecting potential attacks, and taking corresponding defensive measures. However, they have certain limitations in terms of flexibility, real-time performance, and intelligence, especially on the OpenWRT platform based on the embedded Linux system. How to efficiently implement intrusion detection and prevention functions to ensure network security is an important issue facing researchers.

[0027] In view of this, this disclosure proposes a network intrusion prevention method, device and medium, which realizes efficient intrusion detection and intrusion prevention on the OpenWRT platform based on the embedded Linux system.

[0028] Example 1 is a flowchart illustrating a network intrusion prevention method according to some embodiments of the present disclosure. Figure 1 As shown, the network intrusion prevention method includes steps S110 to S160.

[0029] In step S110, network data packets are acquired.

[0030] This system utilizes the network interfaces in the OpenWRT system to collect network data packets in real time. The Lippcap library is used to acquire these packets, supporting traffic collection from different network interfaces, such as Ethernet and Wi-Fi.

[0031] In step S120, the network data packets are matched against a pre-established attack signature database to determine whether any attack behavior (potential) exists. If a matching signature is found, it is determined that a potential attack behavior exists.

[0032] The attack signature database includes abnormal traffic characteristics of DDoS attacks and specific port access patterns of port scans.

[0033] In step S130, the network data packets are input into the normal network behavior baseline model to determine whether abnormal behavior exists. By establishing a baseline model of normal network behavior, changes in network traffic behavior are detected in real time. When traffic behavior deviates from the baseline model, it is determined to be abnormal behavior.

[0034] Machine learning algorithms, such as support vector machines and neural networks, are used to train the dataset and establish a baseline model of normal network behavior. During system operation, the baseline model is continuously optimized and updated to improve its analytical accuracy.

[0035] In step S140, if there is an attack and an abnormal behavior, a potential attack signal, attack type information, abnormal behavior signal, and behavior abnormality information are generated.

[0036] In step S150, based on the potential attack signal, the attack type information, the abnormal behavior signal, and the abnormality level information, it is determined whether there is an intrusion behavior.

[0037] In step S160, if an intrusion occurs, a defensive action is performed against the intrusion.

[0038] The defensive actions include blocking the IP address of the attack source or isolating the network segment where the infected device is located.

[0039] Use iptables to block the IP address of the attack source. Isolate the network segment where the infected device is located using network configuration commands.

[0040] Figure 2 This is a block diagram illustrating a network intrusion prevention device according to some embodiments of the present disclosure. Figure 2 As shown, the network intrusion prevention device 200 includes a network data packet acquisition module 210, a feature matching module 220, a traffic behavior detection module 230, a signal and information generation module 240, an intrusion behavior judgment module 250, and a defense action execution module 260.

[0041] The network packet acquisition module 210 is configured to acquire network packets;

[0042] The feature matching module 220 is configured to match the network data packets with a pre-established attack feature database to determine whether an attack behavior exists.

[0043] The traffic behavior detection module 230 is configured to input the network data packets into a normal network behavior baseline model to determine whether there is abnormal behavior.

[0044] The signal and information generation module 240 is configured to generate a potential attack signal, attack type information, abnormal behavior signal, and abnormal behavior degree information if there is a potential attack behavior and abnormal behavior.

[0045] The intrusion behavior judgment module 250 is configured to determine whether intrusion behavior exists based on the potential attack signal, the attack type information, the abnormal behavior signal, and the abnormality degree information.

[0046] The defense action execution module 260 is configured to perform defense actions against intrusion behavior if intrusion behavior is present.

[0047] This disclosure enables efficient intrusion detection and defense on the OpenWRT platform based on an embedded Linux system.

[0048] Figure 3 This is a block diagram illustrating a network intrusion prevention device according to other embodiments of the present disclosure. For example... Figure 3 As shown, the network intrusion prevention device 300 includes a memory 310 and a processor 320 coupled to the memory 310. The memory 310 is used to store instructions for executing embodiments of the network intrusion prevention method. The processor 320 is configured to execute the network intrusion prevention method in any of the embodiments of this disclosure based on the instructions stored in the memory 310.

[0049] Figure 4 This is a block diagram illustrating a computer system for implementing some embodiments of the present disclosure. Figure 4 As shown, the computer system 400 can be represented in the form of a general-purpose computer device. The computer system 400 includes a memory 410, a processor 420, and a bus 430 connecting different system components.

[0050] The memory 410 may include, for example, system memory, non-volatile storage media, etc. The system memory may store, for example, an operating system, application programs, a boot loader, and other programs. The system memory may include volatile storage media, such as random access memory (RAM) and / or cache memory. The non-volatile storage media may store, for example, instructions for executing corresponding embodiments of at least one of the network intrusion prevention methods. Non-volatile storage media include, but are not limited to, disk storage, optical storage, flash memory, etc.

[0051] The processor 420 can be implemented using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates, or transistors, or other discrete hardware components. Correspondingly, each module, such as the acquisition module, feature matching module, traffic behavior comparison module, signal and information generation module, intrusion behavior judgment module, and defense action execution module, can be implemented by executing instructions from the central processing unit (CPU) memory to perform the corresponding steps, or by dedicated circuitry to execute the corresponding steps.

[0052] Bus 430 can use any of the various bus architectures. For example, bus architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, and Peripheral Component Interconnect (PCI) bus.

[0053] The computer system 400 may also include an input / output interface 440, a network interface 450, and a storage interface 460. These interfaces 440, 450, and 460, as well as the memory 410 and processor 420, can be connected via a bus 430. The input / output interface 440 provides a connection interface for input / output devices such as a monitor, mouse, and keyboard. The network interface 450 provides a connection interface for various networked devices. The storage interface 460 provides a connection interface for external storage devices such as floppy disks, USB flash drives, and SD cards.

[0054] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus, and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations thereof, can be implemented by computer-readable program instructions.

[0055] These computer-readable program instructions are provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable device to produce a machine, such that execution of the instructions by the processor produces means for implementing the functions specified in one or more boxes of the flowchart and / or block diagram.

[0056] These computer-readable program instructions may also be stored in a computer-readable storage medium. These instructions cause a computer to work in a particular manner to produce an article of manufacture, including instructions that implement the functions specified in one or more boxes in a flowchart and / or block diagram.

[0057] This disclosure may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects.

[0058] This disclosure enables efficient intrusion detection and defense on the OpenWRT platform based on an embedded Linux system.

[0059] The network intrusion prevention methods, apparatus, and media according to this disclosure have been described in detail. To avoid obscuring the concept of this disclosure, some details known in the art have not been described. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

[0060] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A network intrusion prevention method, applied to the OpenWRT platform based on an embedded Linux system, characterized in that, The method includes: Acquire network data packets; The network data packets are matched with a pre-established attack signature database to determine whether an attack has occurred. The network data packets are input into a normal network behavior baseline model to determine whether any abnormal behavior exists; If an attack or abnormal behavior is present, generate potential attack signals, attack type information, abnormal behavior signals, and information on the degree of abnormality of the behavior. Based on the potential attack signals, the attack type information, the abnormal behavior signals, and the abnormality level information, it is determined whether an intrusion behavior exists; If an intrusion occurs, defensive actions will be taken against the intrusion.

2. The network intrusion prevention method according to claim 1, characterized in that, Use the Libpcap library to capture network packets via Ethernet or Wi-Fi interfaces.

3. The network intrusion prevention method according to claim 1, characterized in that, The attack signature database includes abnormal traffic characteristics of DDoS attacks and specific port access patterns of port scans.

4. The network intrusion prevention method according to claim 1, characterized in that, The defensive actions include blocking the IP address of the attack source or isolating the network segment where the infected device is located.

5. The network intrusion prevention method according to claim 4, characterized in that, Use iptables to block the IP address of the attack source.

6. The network intrusion prevention method according to claim 4, characterized in that, Isolate the network segment where the infected device is located using network configuration commands.

7. A network intrusion prevention device, characterized in that, include; The network packet acquisition module is used to acquire network packets; The feature matching module is used to match the network data packets with a pre-established attack feature database to determine whether an attack behavior exists. The traffic behavior detection module is used to input the network data packets into the normal network behavior baseline model to determine whether there is abnormal behavior. The signal and information generation module is used to generate potential attack signals, attack type information, abnormal behavior signals, and abnormal behavior degree information if potential attack behavior and abnormal behavior exist. The intrusion behavior determination module is used to determine whether intrusion behavior exists based on the potential attack signal, the attack type information, the abnormal behavior signal, and the abnormality degree information. The defense action execution module is used to perform defense actions against intrusion behavior if intrusion behavior exists.

8. A network intrusion prevention device, characterized in that, include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the network intrusion prevention method as described in any one of claims 1 to 6 based on instructions stored in the memory.

9. A computer-readable storage medium, characterized in that, It stores computer program instructions that, when executed by a processor, implement the network intrusion prevention method as described in any one of claims 1 to 6.

Images