A defense method, system, device, terminal and storage medium based on a dynamic network

Abstract

The application belongs to the technical field of network defense, and discloses a defense method, system, device, terminal and storage medium based on a dynamic network, which comprises the following steps: continuously performing real-time identification and processing on access data packets, if it is judged that a target source IP is a virtual node, then the access data packets are sent to a virtual node processing module, otherwise, if it is judged that it is normal communication, then the access data packets are released, and the attack target source IP is recorded in a database; relevant feature analysis is performed on the attack target source IP in the database based on a Markov process learning model, a suitable rule base is constructed, and the rule base is automatically updated, so that the attack target source IP is accurately detected in real time. A large number of virtual nodes are dynamically constructed in the network, so that the attacker is effectively confused, the decision of the attacker is disturbed, the attacker cannot accurately obtain information such as a network topology, a server type and a system vulnerability, and the network penetration of the attacker is invalidated.

Description

Technical Field

[0001] This invention belongs to the field of network defense technology, and in particular relates to a defense method, system, device, terminal and storage medium based on dynamic networks. Background Technology

[0002] With cyberattacks becoming increasingly sophisticated and automated, existing defense methods are struggling to effectively address the growing complexity of network intrusions, exacerbating the asymmetry between offensive and defensive positions. To address this "easy to attack, difficult to defend" situation, mobile target defense technology has emerged. It aims to alter the attributes of system elements in a way that is controllable by the defender, enabling the protected network to undergo random, dynamic, and heterogeneous changes. This disrupts the attack chain's dependence on a deterministic, static, and homogeneous operating environment, thereby increasing the difficulty for attackers.

[0003] The purpose of this invention is to overcome the shortcomings of the static, deterministic and similar nature of various network elements, increase the difficulty for attackers to probe the network and penetrate network nodes, effectively resist malicious attacks against the target network, and improve the survival rate of the target network.

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0005] Existing defense methods are struggling to effectively address increasingly complex network intrusions, exacerbating the asymmetry in the power dynamics between network attackers and defenders. Summary of the Invention

[0006] In view of the problems existing in the prior art, the present invention provides a defense method, system, device, terminal and storage medium based on dynamic networks.

[0007] This invention is implemented as follows: a defense method based on dynamic networks includes:

[0008] Step 1: The perception and processing module continuously identifies and processes access data packets in real time. If it determines that the target source IP is a virtual node, it sends the access data packet to the virtual node processing module. Otherwise, it considers it as normal communication and allows it to pass. If it determines that it is an attack target source IP, it blocks the target source IP and records the attack target source IP into the database.

[0009] Step 2: The virtual node processing module is used to construct fake response data packets. If the target source IP is a virtual node, it calls the virtual nodes in the virtual node pool to respond.

[0010] Step 3: The virtual node generation module uses time as the axis and adjusts the virtual node generation according to the configured dynamic time interval T. next Virtual nodes are generated periodically to create a dynamic network environment.

[0011] Step 4: The feature analysis module performs relevant feature analysis on the attack target source IPs in the database based on the Markov process learning model, constructs a suitable rule base, and automatically updates the rule base to achieve real-time and accurate detection of attack target source IPs. The detection process involves the following steps:

[0012] For the updated rule base, vulnerability detection methods are used to approximate the attack results;

[0013] The approximate detection result of the detection matrix obtained from the rule base is substituted into the vulnerability detection method, and the received estimate is calculated using the vulnerability detection method formula.

[0014] The performance of the variable vulnerability detection method was verified by analyzing the attack rate.

[0015] For the updated rule base A=H H H+σ 2 I, whereσ 2 Let X be the noise variance, and I be the identity matrix. An iterative vulnerability detection method is used to approximate the detection matrix A of the rule base. The iterative formula for the vulnerability detection method is X. k+1 =X k -h k X k (AX k -I), where X k h is the approximate value of the matrix detection obtained in the k-th iteration. k Step size factor;

[0016] In the iterative formula of the vulnerability detection method, a larger step size is selected in the initial iteration. As the number of iterations increases, the step size gradually decreases, eventually approaching 1. Specifically, the optimal update formula is:

[0017] h k =1 / (1-θ·trace(E) k ) / N)

[0018] Among them, E k Let N be the error matrix, N be the order of the matrix, and θ be the adjustment factor. The adjustment factor θ ranges from [0,1]. The larger the value of θ, the larger the initial iteration step size and the worse the algorithm stability. The smaller the value of θ, the smaller the initial iteration step size and the better the algorithm stability. To meet the trade-off between performance and stability, the value of θ is taken as 0.8.

[0019] The approximate detection value X of the detection matrix of the rule base obtained after the k-th iteration is... k The received estimate of the transmitted signal vector X is obtained using the vulnerability detection method. Based on the estimated value, accurate data of the source IP of the attack target is obtained.

[0020] Furthermore, the fake response data packets include fake MAC addresses, fake operating system types and versions, fake IP addresses, and fake open ports, etc.

[0021] Furthermore, the generation of virtual nodes specifically includes:

[0022] (1) Based on the IP range configured by the user, randomly select several IP addresses to generate virtual nodes, and require that the IP range configured by the user does not conflict with the IP addresses currently in use in the target network.

[0023] (2) No user configuration is required. Based on the received ARP request information and / or routing information, it automatically learns and records the IP addresses currently in use in the network, searches the logical subnets where the IP addresses in use are located, and randomly selects unused IP addresses to generate virtual nodes.

[0024] Furthermore, the dynamic change time interval T next It will dynamically adjust based on the attack intensity and duration, as detailed below:

[0025]

[0026] Where: p attack For attack strength, t hold The duration of the attack intensity, t period t represents the average duration of a single network access between real nodes. mix This represents the minimum acceptable duration for a single network access between real nodes.

[0027] Furthermore, the feature analysis module performs relevant feature analysis on the source IPs of attack targets in the database, specifically including:

[0028] (1) Establish a Markov process learning model of the attack target source IP;

[0029] (2) Sample the source IP of the attack target to obtain the feature vector and determine the initial parameters of the model;

[0030] (3) Iteratively train the Markov process learning model. Based on the given number of samples, generate a Markov process learning model with different parameters for each attack target source IP. There are a total of m models, where m≥1.

[0031] (4) Sample the source IP of the target to be attacked to obtain the feature vector;

[0032] (5) Segment the feature vector of the target IP to be detected, progressively calculate the maximum similarity for all Markov process learning models, and exclude the Markov process learning model with the smallest similarity, and finally obtain the identification result.

[0033] Furthermore, the establishment of the Markov process learning model for the attack target's source IP specifically includes:

[0034] 1) The number of hidden states N, and the state set S = {s1, s2, s3}, which correspond to alarm time, alarm type and alarm time limit respectively;

[0035] 2) The number of observed sequences M, and the set of observed sequences V = {v1, v2, ..., v...} m}, m≥1, for the Markov process learning model of alarm information, the observation sequence set is the feature value obtained by the information sampling window;

[0036] 3) State transition matrix A, A = {a ij}, aij=P[q t+1 =s j |q t =s i ], 1≤i,j≤N, where q t Let A be the state at time t, and let A be an N×N square matrix where rows and columns correspond to all states, and let A represent the probability of transitions between states.

[0037] 4) Observe the sequence probability matrix B, B = {b j (k)},b j (k)=P[v t at t|q t =s j ], 1≤j≤N, 1≤k≤M, which means that at time t, the hidden state is s. j The next observation value is v t The probability; the B of a continuous HMM obtains the relationship between the observation sequence and the state through a continuous function, commonly the Gaussian mixture probability density function.

[0038] 5) Initial state probability distribution ∏={π i}, π i =P{s1=q i}, where 1≤i≤N, then for the Markov process learning model of alarm information, π1=1.

[0039] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the defense method based on dynamic networks.

[0040] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the defense method based on dynamic networks.

[0041] Another objective of this invention is to provide a dynamic network-based defense system that applies the aforementioned dynamic network-based defense method, wherein the dynamic network-based defense system specifically includes:

[0042] The system includes a perception processing module, a virtual node processing module, a database, a virtual node generation module, a virtual node pool, a feature analysis module, and a rule base.

[0043] The perception and processing module is used to continuously identify and process access data packets in real time. If it is determined that the target source IP is a virtual node, the access data packet is sent to the virtual node processing module. Otherwise, it is considered normal communication and is allowed. If it is determined to be an attack target source IP, the target source IP is blocked and the attack target source IP is recorded in the database.

[0044] The virtual node processing module is used to construct fake response data packets, and when the target source IP is a virtual node, it calls the virtual nodes in the virtual node pool to respond.

[0045] The virtual node generation module uses time as its axis and adjusts the virtual node generation based on the configured dynamic time interval T. next Virtual nodes are generated periodically to create a dynamic network environment.

[0046] The feature analysis module performs relevant feature analysis on the source IPs of attack targets in the database based on the Markov process learning model, constructs a suitable rule base, and automatically updates the rule base, thereby enabling the perception and processing module to detect the source IPs of attack targets in real time and accurately.

[0047] Another objective of this invention is to provide a defense terminal based on a dynamic network, which is used to implement the aforementioned defense system based on a dynamic network.

[0048] Based on the above technical solutions and the technical problems solved, please analyze the advantages and positive effects of the technical solution to be protected by this invention from the following aspects:

[0049] First, addressing the technical problems existing in the prior art and the difficulty in solving them, this paper closely analyzes, in conjunction with the technical solution to be protected by this invention and the results and data obtained during the research and development process, how the technical solution of this invention solves the technical problems, and the inventive technical effects brought about by solving these problems. The specific description is as follows:

[0050] This application addresses the shortcomings of current network elements, namely their static nature, determinism, and similarity, through dynamic, virtualized, and randomized methods. This increases the difficulty for attackers to probe the network and penetrate network nodes, effectively resisting malicious attacks against the target network and improving its survivability.

[0051] This application uses time as a timeline to dynamically and randomly insert false information into real information. It continuously changes network information between configurable time points to counter external attacks.

[0052] This invention uses a Markov process learning model to perform relevant feature analysis on the source IPs of attack targets in the database, constructs a suitable rule base, and automatically updates the rule base, thereby enabling the perception and processing module to detect the source IPs of attack targets in real time and accurately.

[0053] Second, considering the technical solution as a whole or from a product perspective, the technical effects and advantages of the technical solution to be protected by this invention are specifically described as follows:

[0054] The defense method based on dynamic networks proposed in this invention dynamically constructs a large number of virtual nodes in the network, thereby effectively confusing attackers, disrupting their decision-making, and preventing them from accurately obtaining information such as network topology, server type, and system vulnerabilities. This renders the attacker's network penetration ineffective, while also effectively blocking the lateral spread of new viruses within the network, greatly improving the security and stability of the target network.

[0055] The detection process described in this invention involves the following steps: For an updated rule base, a vulnerability detection method is used to approximate the attack result; the approximate result of the detection matrix obtained from the rule base is substituted into the vulnerability detection method, and the received estimate is calculated using the vulnerability detection method formula; the performance of the variable vulnerability detection method is verified by analyzing the attack rate; and the approximate detection value X of the rule base detection matrix is ​​obtained after the k-th iteration. k The received estimate of the transmitted signal vector X is obtained using the vulnerability detection method. Based on the estimated values, accurate data on the source IP of the attack target is obtained, providing technical assurance for network defense. Attached Figure Description

[0056] Figure 1 This is a flowchart of a defense method based on dynamic networks provided in an embodiment of the present invention;

[0057] Figure 2 This is a flowchart of the method for generating virtual nodes provided in an embodiment of the present invention;

[0058] Figure 3 This is a structural diagram of a defense system based on a dynamic network provided in an embodiment of the present invention;

[0059] In the diagram: 1. Perception processing module; 2. Virtual node processing module; 3. Database; 4. Virtual node generation module; 5. Virtual node pool; 6. Feature analysis module; 7. Rule base. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0061] I. Explanatory and Illustrative Embodiments. To enable those skilled in the art to fully understand how the present invention is specifically implemented, this section provides an explanatory and illustrative description of the embodiments described in the claims.

[0062] like Figure 1 As shown, a defense method based on dynamic networks includes:

[0063] S101: The perception and processing module continuously identifies and processes access data packets in real time. If it determines that the target source IP is a virtual node, it sends the access data packet to the virtual node processing module. Otherwise, it considers it as normal communication and allows it to pass. If it determines that it is an attack target source IP, it blocks the target source IP and records the attack target source IP into the database.

[0064] S102: Virtual node processing module, used to construct fake response data packets. If the target source IP is a virtual node, it calls the virtual nodes in the virtual node pool to respond.

[0065] S103: The virtual node generation module uses time as its axis and adjusts the virtual node generation based on the configured dynamic time interval T. next Virtual nodes are generated periodically to create a dynamic network environment.

[0066] S104: The feature analysis module performs relevant feature analysis on the source IPs of attack targets in the database based on the Markov process learning model, constructs a suitable rule base, and automatically updates the rule base to detect the source IPs of attack targets in real time and accurately.

[0067] In step S104, the detection is performed as follows:

[0068] For the updated rule base, vulnerability detection methods are used to approximate the attack results;

[0069] The approximate detection result of the detection matrix obtained from the rule base is substituted into the vulnerability detection method, and the received estimate is calculated using the vulnerability detection method formula.

[0070] The performance of the variable vulnerability detection method was verified by analyzing the attack rate.

[0071] For the updated rule base A=H H H+σ 2 I, whereσ 2Let X be the noise variance, and I be the identity matrix. An iterative vulnerability detection method is used to approximate the detection matrix A of the rule base. The iterative formula for the vulnerability detection method is X. k+1 =X k -h k X k (AX k -I), where X k h is the approximate value of the matrix detection obtained in the k-th iteration. k Step size factor;

[0072] In the iterative formula of the vulnerability detection method, a larger step size is selected in the initial iteration. As the number of iterations increases, the step size gradually decreases, eventually approaching 1. Specifically, the optimal update formula is:

[0073] h k =1 / (1-θ·trace(E) k ) / N)

[0074] Among them, E k Let N be the error matrix, N be the order of the matrix, and θ be the adjustment factor. The adjustment factor θ ranges from [0,1]. The larger the value of θ, the larger the initial iteration step size and the worse the algorithm stability. The smaller the value of θ, the smaller the initial iteration step size and the better the algorithm stability. To meet the trade-off between performance and stability, the value of θ is taken as 0.8.

[0075] The approximate detection value X of the detection matrix of the rule base obtained after the k-th iteration is... k The received estimate of the transmitted signal vector X is obtained using the vulnerability detection method. Based on the estimated value, accurate data of the source IP of the attack target is obtained.

[0076] The fake response data packets include fake MAC addresses, fake operating system types and versions, fake IP addresses, and fake open ports.

[0077] like Figure 2 As shown, the generation of virtual nodes specifically includes:

[0078] S201: Based on the IP range configured by the user, randomly select several IP addresses to generate virtual nodes, requiring that the IP range configured by the user does not conflict with the IP addresses currently in use in the target network;

[0079] S202: No user configuration is required. Based on the received ARP request information and / or routing information, it automatically learns and records the IP addresses currently in use in the network, searches the logical subnets where the IP addresses in use are located, and randomly selects unused IP addresses to generate virtual nodes.

[0080] The dynamic change time interval T next It will dynamically adjust based on the attack intensity and duration, as detailed below:

[0081]

[0082] Where: p attack For attack strength, t hold The duration of the attack intensity, t period t represents the average duration of a single network access between real nodes. mix This represents the minimum acceptable duration for a single network access between real nodes.

[0083] The feature analysis module performs relevant feature analysis on the source IPs of attack targets in the database, specifically including:

[0084] (1) Establish a Markov process learning model of the attack target source IP;

[0085] (2) Sample the source IP of the attack target to obtain the feature vector and determine the initial parameters of the model;

[0086] (3) Iteratively train the Markov process learning model. Based on the given number of samples, generate a Markov process learning model with different parameters for each attack target source IP. There are a total of m models, where m≥1.

[0087] (4) Sample the source IP of the target to be attacked to obtain the feature vector;

[0088] (5) Segment the feature vector of the target IP to be detected, progressively calculate the maximum similarity for all Markov process learning models, and exclude the Markov process learning model with the smallest similarity, and finally obtain the identification result.

[0089] The establishment of the Markov process learning model for the attack target's source IP specifically includes:

[0090] 1) The number of hidden states N, and the state set S = {s1, s2, s3}, which correspond to alarm time, alarm type and alarm time limit respectively;

[0091] 2) The number of observed sequences M, and the set of observed sequences V = {v1, v2, ..., v...} m}, m≥1, for the Markov process learning model of alarm information, the observation sequence set is the feature value obtained by the information sampling window;

[0092] 3) State transition matrix A, A = {a ij}, aij=P[q t+1 =s j |q t =s i], 1≤i,j≤N, where q t Let A be the state at time t, and let A be an N×N square matrix where rows and columns correspond to all states, and let A represent the probability of transitions between states.

[0093] 4) Observe the sequence probability matrix B, B = {b j (k)},b j (k)=P[v t at t|q t =s j ], 1≤j≤N, 1≤k≤M, which means that at time t, the hidden state is s. j The next observation value is v t The probability; the B of a continuous HMM obtains the relationship between the observation sequence and the state through a continuous function, commonly the Gaussian mixture probability density function.

[0094] 5) Initial state probability distribution ∏={π i}, π i =P{s1=q i}, where 1≤i≤N, then for the Markov process learning model of alarm information, π1=1.

[0095] II. Application Examples. To demonstrate the inventiveness and technical value of the technical solution of this invention, this section provides application examples of the technical solution of the claims on specific products or related technologies.

[0096] This invention applies a dynamic network-based defense method to a computer device, the computer device including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor performs the dynamic network-based defense method.

[0097] This invention applies a dynamic network-based defense method to a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the dynamic network-based defense method.

[0098] like Figure 3 As shown, the present invention applies a dynamic network-based defense method to a dynamic network-based defense system that applies the described dynamic network-based defense method, specifically including:

[0099] Perception processing module 1, virtual node processing module 2, database 3, virtual node generation module 4, virtual node pool 5, feature analysis module 6, rule base 7;

[0100] The perception processing module 1 is used to continuously identify and process access data packets in real time. If it is determined that the target source IP is a virtual node, the access data packet is sent to the virtual node processing module 2. Otherwise, it is considered to be normal communication and is allowed. If it is determined to be an attack target source IP, the target source IP is blocked and the attack target source IP is recorded in the database 3.

[0101] The virtual node processing module 4 is used to construct a fake response data packet. If the target source IP is a virtual node, it calls the virtual node in the virtual node pool 5 to respond.

[0102] The virtual node generation module 4, with time as the axis, generates nodes according to the configured dynamic time interval T. next Virtual nodes are generated periodically to create a dynamic network environment.

[0103] The feature analysis module 6 performs relevant feature analysis on the attack target source IP in the database based on the Markov process learning model, constructs a suitable rule base 7, and automatically updates the rule base 7, so that the perception and processing module can detect the attack target source IP in real time and accurately.

[0104] The present invention relates to a dynamic network-based defense system applied to a dynamic network-based defense terminal, wherein the dynamic network-based defense terminal is used to implement the dynamic network-based defense system.

[0105] The working principle of this invention is as follows: The perception processing module 1 continuously identifies and processes access data packets in real time. If it determines that the target source IP is a virtual node, it sends the access data packet to the virtual node processing module 2; otherwise, it considers it normal communication and allows it to pass. If it determines that the target source IP is an attack target, it blocks the target source IP and records the attack target source IP in the database 3. The virtual node processing module 4 constructs a fake response data packet. If the target source IP is a virtual node, it calls the virtual nodes in the virtual node pool 5 to respond. The virtual node generation module 4 generates virtual nodes based on the configured dynamic time interval T, with time as the axis. next Virtual nodes are generated periodically to achieve a dynamic network environment; the feature analysis module 6 performs relevant feature analysis on the source IPs of attack targets in the database based on the Markov process learning model, constructs a suitable rule base 7, and automatically updates the rule base 7, so that the perception and processing module can detect the source IPs of attack targets in real time and accurately.

[0106] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0107] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A defense method based on dynamic networks, characterized in that, This dynamic network-based defense method specifically includes: Step 1: The perception and processing module continuously identifies and processes access data packets in real time. If it determines that the target source IP is a virtual node, it sends the access data packet to the virtual node processing module. Otherwise, it considers it as normal communication and allows it to pass. If it determines that it is an attack target source IP, it blocks the target source IP and records the attack target source IP into the database. Step 2: The virtual node processing module is used to construct fake response packets. If the target source IP is a virtual node, it calls the virtual nodes in the virtual node pool to respond. Step 3: The virtual node generation module uses time as the axis and adjusts the virtual node generation according to the configured dynamic time interval T. next Virtual nodes are generated periodically to create a dynamic network environment. Step 4: The feature analysis module performs relevant feature analysis on the attack target source IPs in the database based on the Markov process learning model, constructs a suitable rule base, and automatically updates the rule base to achieve real-time and accurate detection of attack target source IPs; the detection process involves the following steps: For the updated rule base, vulnerability detection methods are used to approximate the attack results; The approximate detection result of the detection matrix obtained from the rule base is substituted into the vulnerability detection method, and the received estimate is calculated using the vulnerability detection method formula. The performance of the variable vulnerability detection method was verified by analyzing the attack rate. For the updated rule base A=H H H+σ 2 I, whereσ 2 Let X be the noise variance and I be the identity matrix. An iterative vulnerability detection method is used to approximate the detection matrix A of the rule base. The iterative formula for the vulnerability detection method is X. k+1 =X k -h k X k (AX k -I), where X k h is the approximate value of the matrix detection obtained in the k-th iteration. k Step size factor; In the iterative formula of the vulnerability detection method, a larger step size is selected in the initial iteration. As the number of iterations increases, the step size gradually decreases, eventually approaching 1. Specifically, the optimal update formula is: h k =1 / (1-θ·trace(E k ) / N) Among them, E k Let N be the error matrix, N be the order of the matrix, and θ be the adjustment factor. The adjustment factor θ ranges from [0,1]. The larger the value of θ, the larger the initial iteration step size and the worse the algorithm stability. The smaller the value of θ, the smaller the initial iteration step size and the better the algorithm stability. To meet the trade-off between performance and stability, the value of θ is taken as 0.

8. The approximate detection value X of the detection matrix of the rule base obtained after the k-th iteration is... k The received estimate of the transmitted signal vector X is obtained using the vulnerability detection method. Based on the estimated value, accurate data of the source IP of the attack target is obtained.

2. The defense method based on dynamic networks as described in claim 1, characterized in that, The fake response data packet includes a fake MAC address, a fake operating system type and version, a fake IP address, and a fake open port.

3. The defense method based on dynamic networks as described in claim 1, characterized in that, The generation of virtual nodes specifically includes: (1) Based on the IP range configured by the user, randomly select several IP addresses to generate virtual nodes, and require that the IP range configured by the user does not conflict with the IP addresses currently in use in the target network. (2) No user configuration is required. Based on the received ARP request information and / or routing information, it automatically learns and records the IP addresses currently in use in the network, searches the logical subnets where the IP addresses in use are located, and randomly selects unused IP addresses to generate virtual nodes.

4. The defense method based on dynamic networks as described in claim 1, characterized in that, The dynamic change time interval T next It will dynamically adjust based on the attack intensity and duration, as detailed below: Where: p attack For attack strength, t hold The duration of the attack intensity, t period t represents the average duration of a single network access between real nodes. mix This represents the minimum acceptable duration for a single network access between real nodes.

5. The defense method based on dynamic networks as described in claim 1, characterized in that, The feature analysis module performs relevant feature analysis on the source IPs of attack targets in the database based on the Markov process learning model, specifically including: (1) Establish a Markov process learning model of the attack target source IP; (2) Sample the source IP of the attack target to obtain the feature vector and determine the initial parameters of the model; (3) Iteratively train the Markov process learning model. Based on the given number of samples, generate a Markov process learning model with different parameters for each attack target source IP. There are a total of m models, where m≥1. (4) Sample the source IP of the target to be attacked to obtain the feature vector; (5) Segment the feature vector of the target IP to be detected, progressively calculate the maximum similarity for all Markov process learning models, and exclude the Markov process learning model with the smallest similarity, and finally obtain the identification result.

6. The defense method based on dynamic networks as described in claim 1, characterized in that, The establishment of the Markov process learning model for the attack target's source IP specifically includes: 1) The number of hidden states N, and the state set S = {s1, s2, s3}, which correspond to alarm time, alarm type and alarm time limit respectively; 2) The number of observed sequences M, and the set of observed sequences V = {v1, v2, ..., v...} m }, m≥1, for the Markov process learning model of alarm information, the observation sequence set is the feature value obtained by the information sampling window; 3) State transition matrix A, A = {a ij }, aij=P[q t+1 =s j |q t =s i ], 1≤i,j≤N, where q t Let A be the state at time t, and let A be an N×N square matrix where rows and columns correspond to all states, and let A represent the probability of transitions between states. 4) Observe the sequence probability matrix B, B = {b j (k)},b j (k)=P[v t at t|q t =s j ], 1≤j≤N, 1≤k≤M, which means that at time t, the hidden state is s. j The next observation value is v t The probability; the B of a continuous HMM obtains the relationship between the observation sequence and the state through a continuous function, commonly the Gaussian mixture probability density function. 5) Initial state probability distribution ∏={π i }, π i =P{s1=q i }, where 1≤i≤N, then for the Markov process learning model of alarm information, π1=1.

7. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, causes the processor to perform the dynamic network-based defense method.

8. A computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the dynamic network-based defense method.

9. A dynamic network-based defense system applying the dynamic network-based defense method as described in any one of claims 1 to 6, characterized in that, The dynamic network-based defense system specifically includes: The system includes a perception processing module, a virtual node processing module, a database, a virtual node generation module, a virtual node pool, a feature analysis module, and a rule base. The perception and processing module is used to continuously identify and process access data packets in real time. If it is determined that the target source IP is a virtual node, the access data packet is sent to the virtual node processing module. Otherwise, it is considered normal communication and is allowed. If it is determined to be an attack target source IP, the target source IP is blocked and the attack target source IP is entered into the database. The virtual node processing module is used to construct fake response data packets, and when the target source IP is a virtual node, it calls the virtual nodes in the virtual node pool to respond. The virtual node generation module uses time as its axis and adjusts the virtual node generation based on the configured dynamic time interval T. next Virtual nodes are generated periodically to create a dynamic network environment. The feature analysis module performs relevant feature analysis on the source IPs of attack targets in the database based on the Markov process learning model, constructs a suitable rule base, and automatically updates the rule base, thereby enabling the perception and processing module to detect the source IPs of attack targets in real time and accurately.

10. A defense terminal based on a dynamic network, characterized in that, The dynamic network-based defense terminal is used to implement the functions of the dynamic network-based defense system as described in claim 9.

Images