Method, device, and computer readable storage medium for preventing malicious scanning
By extracting network layer, transport layer, and application layer attribute features of target traffic, and using anti-scanning rule sets and feature libraries to match and spoof response packets, the problem of insufficient accuracy in preventing malicious scanning in existing technologies is solved, and the ability to prevent malicious scanning is improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- QI-ANXIN LEGENDSEC INFORMATION TECH (BEIJING) INC
- Filing Date
- 2022-11-18
- Publication Date
- 2026-07-31
AI Technical Summary
Existing methods for preventing malicious scanning rely on counting the number of times a port is scanned, which causes the anti-scanning scheme to fail when the target device has few open ports, and it cannot accurately identify malicious scanning traffic.
By extracting the network layer, transport layer, and application layer attribute features of target traffic, and matching them with a predefined anti-scanning rule set and a feature library, the system can disguise response packets to deceive scanning tools, thereby improving the accuracy and capability of preventing malicious scanning.
It enables accurate identification and prevention of malicious scanning traffic, improves the ability to prevent malicious scanning, and reduces the risk of unauthorized intrusion.
Smart Images
Figure CN115834180B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer network security, and in particular to methods, devices and computer-readable storage media for preventing malicious scanning. Background Technology
[0002] In the field of computer network security, the first step for hackers initiating intrusion detection is malicious probing. The most common approach is to use scanning tools to scan the target network for ports and vulnerabilities, checking the running service processes. Once a vulnerability is discovered, an attack is launched, ultimately achieving the goal of illegal intrusion. Anti-scanning products can detect and block malicious scans in a timely manner, increasing the cost of attacks and reducing the risk of intrusion. One method to prevent malicious scanning is to detect the number of times a particular IP address or URL scans different ports within a certain period. When the number reaches a threshold, it is considered a malicious scan, and access to services by that IP address is blocked. However, the above methods require maintaining a large number of port configurations on the target device. Furthermore, if the target device has few open ports, this anti-scanning scheme, which mainly relies on counting the number of port scans, is likely to fail. Summary of the Invention
[0003] To address or partially address the problems existing in related technologies, this application provides a method, apparatus, and computer-readable storage medium for preventing malicious scanning, which can improve the accuracy and capability of preventing malicious scanning.
[0004] The first aspect of this application provides a method for preventing malicious scanning, applied to a pre-deployed anti-scanning engine, comprising:
[0005] Receive target traffic, which is traffic to be detected that is redirected to the anti-scanning engine, including service request messages from the scanning tool to the target device;
[0006] Extract attribute features from at least two of the network layer, transport layer, and application layer of the target traffic;
[0007] According to the predefined anti-scanning rule set, the attribute features of the at least two layers are matched with the preset features of the anti-scanning feature library;
[0008] If the attribute features of at least two layers successfully match the preset features of the anti-scanning feature library, the response message of the service request message is disguised, and the disguised response message is returned to the scanning tool.
[0009] A second aspect of this application provides an apparatus for preventing malicious scanning, the apparatus being applied to a pre-deployed anti-scanning engine, the apparatus comprising a receiving module, an extraction module, a matching module, and a spoofing module;
[0010] The receiving module is used to receive target traffic, which is traffic to be detected that is redirected to the anti-scanning engine, including service request messages from the scanning tool to the target device;
[0011] The extraction module is used to extract attribute features of at least two of the network layer, transport layer, and application layer of the target traffic.
[0012] The matching module is used to match the attribute features of the at least two layers with preset features of the anti-scanning feature library according to a predefined anti-scanning rule set;
[0013] The camouflage module is used to camouflage the response message of the service request message and return the camouflaged response message to the scanning tool if the attribute features of the at least two layers successfully match the preset features of the anti-scanning feature library.
[0014] A third aspect of this application provides an electronic device, comprising:
[0015] Processor; and
[0016] A memory that stores executable code, which, when executed by the processor, causes the processor to perform the method described above.
[0017] A fourth aspect of this application provides a computer-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to perform the method described above.
[0018] The technical solution provided in this application can include the following beneficial effects: On the one hand, since the attribute features of at least two of the network layer, transport layer and application layer of the target traffic are extracted, and not just port feature data, it can accurately determine whether the target traffic is malicious scanning traffic from the scanning tool compared with related technologies; on the other hand, after the attribute features of at least two layers are successfully matched with the preset features of the anti-scanning feature library, and the target traffic is determined to be malicious scanning traffic from the scanning tool, a disguised response message is returned to the scanning tool to deceive the scanning tool into malicious scanning, thereby improving the ability to prevent malicious scanning.
[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description
[0020] The above and other objects, features and advantages of this application will become more apparent from the description of exemplary embodiments of this application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of this application.
[0021] Figure 1 This is a flowchart illustrating a method for preventing malicious scanning as shown in an embodiment of this application;
[0022] Figure 2 This is a schematic diagram of the structure of a device for preventing malicious scanning as shown in an embodiment of this application;
[0023] Figure 3 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. Detailed Implementation
[0024] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to make this application more thorough and complete, and to fully convey the scope of this application to those skilled in the art.
[0025] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.
[0026] It should be understood that although the terms "first," "second," "third," etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.
[0027] In the field of computer network security, the first step for hackers initiating intrusion detection is malicious probing. The most common approach is to use scanning tools to scan the target network for ports and vulnerabilities, checking the running service processes. Once a vulnerability is discovered, an attack is launched, ultimately achieving the goal of illegal intrusion. Anti-scanning products can detect and block malicious scans in a timely manner, increasing the cost of attacks and reducing the risk of intrusion. One method to prevent malicious scanning is to detect the number of times a particular IP address or URL scans different ports within a certain period. When the number reaches a threshold, it is considered a malicious scan, and access to services by that IP address is blocked. However, the above methods require maintaining a large number of port configurations on the target device. Furthermore, if the target device has few open ports, this anti-scanning scheme, which mainly relies on counting the number of port scans, is likely to fail.
[0028] To address the aforementioned issues, this application provides a method for preventing malicious scanning, which can improve the accuracy and capability of preventing malicious scanning.
[0029] The technical solutions of the embodiments of this application are described in detail below with reference to the accompanying drawings.
[0030] See Figure 1 This is a flowchart illustrating a method for preventing malicious scanning according to an embodiment of this application. This method can be applied to a pre-deployed anti-scanning engine, i.e. Figure 1 The execution entity of the example method can be a pre-deployed anti-scanning engine. Figure 1 The example method mainly includes steps S101 to S104, as explained below:
[0031] Step S101: Receive target traffic, wherein the target traffic is the traffic to be detected that is redirected to the anti-scanning engine, including the service request messages from the scanning tool to the target device.
[0032] In this embodiment, the target traffic includes service request messages from scanning tools to target devices. The target device can be a physical server or a virtual machine, and the service request message to the target device can be a message requesting access to a service (e.g., a web server) deployed on the physical server or virtual machine. The anti-scanning engine is deployed on the physical server or virtual machine along with these services. Normally, the service request messages from scanning tools to target devices are sent to the physical server or virtual machine, and the physical server or virtual machine returns a corresponding response message accordingly. In this embodiment, the anti-scanning engine is deployed on the physical server or virtual machine. Thus, the target traffic originally sent to the physical server or virtual machine, or other target devices, is now the service request messages from scanning tools to the target devices. After this target traffic is received, it is redirected by the physical server's system kernel to the anti-scanning engine.
[0033] As one embodiment of this application, target traffic is redirected to the anti-scanning engine in the following manner: the target traffic is intercepted using a hook function, and then the destination address of the target traffic is modified to the address of the anti-scanning engine before redirection to the anti-scanning engine. Taking a physical server based on a Linux system as an example, the netfilter framework integrated in the Linux kernel has hook functions capable of intercepting data. This application uses hook functions to intercept target traffic. On the other hand, iptables under the netfilter framework is a packet filtering firewall service. Hook functions for redirection can be defined in the Linux kernel object (KO) that implements anti-scanning, and the hook functions can be registered in the netfilter framework. When the anti-scanning service starts, the KO is loaded via a script. After successful loading, the hook functions are also successfully registered in the netfilter framework. When the target traffic passes through the Linux kernel protocol stack, it passes through the hook functions successfully registered in netfilter, and the hook functions redirect the target traffic to the anti-scanning engine.
[0034] To avoid errors caused by exceeding the redirection limit, the process of redirecting target traffic to the anti-scanning engine can also determine the redirection count corresponding to the service request packet and check if the redirection count has reached a preset threshold. If the redirection count reaches the preset threshold, the redirection of the service request packet is interrupted, and after the interruption, the service request packet is redirected to the address of the anti-scanning engine again. Furthermore, the correspondence between the service identifier corresponding to the service request packet and the redirection count can be stored in memory; the initial value of the redirection count is 0; each time a service request packet is successfully redirected to the anti-scanning engine, the service identifier corresponding to the service request packet is determined, and the redirection count corresponding to that service identifier is incremented by 1 in memory; when the redirection of a service request packet is interrupted, the service identifier corresponding to the interrupted redirection is determined, and the redirection count corresponding to that service identifier is cleared to zero in memory. If an error occurs when the number of redirects exceeds the preset threshold, and a business request message causes an error due to the number of redirects exceeding the preset threshold, then the business identifier corresponding to the business request message is determined, and the number of redirects corresponding to that business identifier is queried in memory; the preset threshold is adjusted to the number of redirects corresponding to that business identifier, and the number of redirects corresponding to that business identifier is cleared to zero in memory.
[0035] Step S102: Extract attribute features from at least two of the target traffic's network layer, transport layer, and application layer.
[0036] Specifically, step S102 can be implemented by extracting source IP address feature data and destination IP address feature data from the service request message as network layer attribute features, extracting source port feature data and destination port feature data from the service request message as transport layer attribute features, and extracting payload features, HTTP header, HTTP body, and transmission direction of the service request message as application layer attribute features. At least two of the attribute features from the network layer, transport layer, and application layer are combined to obtain a combined attribute feature vector. The aforementioned network layer and transport layer attribute features include feature data obtained based on statistical values of IP addresses and ports in the service request message, including the number of different destination IPs, the number of different destination ports, the number of combinations of destination IPs and destination ports in the same traffic, and the number of requests initiated, etc. The application layer attribute features include the protocol used by the target traffic, whether it is an uplink or downlink message, and the presence, weight, and port matching coefficient of some features extracted from the target traffic in the payload, etc. By combining and quantizing the attribute features of at least two of the following layers—the network layer attribute features, the transport layer attribute features, and the application layer attribute features—a combined attribute feature vector can be obtained.
[0037] Step S103: Match the attribute features of at least two layers with the preset features of the anti-scanning feature library according to the predefined anti-scanning rule set.
[0038] In this embodiment, the preset features of the feature library include malicious scanning sample feature vectors output by the trained anti-scanning detection model after inputting sample traffic from both malicious and non-malicious scanning tools into the model. After obtaining these preset features, they are stored in the anti-scanning feature library. Subsequently, based on a predefined anti-scanning rule set, the anti-scanning engine matches the attribute features of at least two layers with the preset features of the anti-scanning feature library. The anti-scanning rule set comprises rules for determining whether the attribute features of at least two layers extracted in step S102 match the preset features of the anti-scanning feature library. As an embodiment of this application, matching the attribute features of at least two layers with the preset features of the anti-scanning feature library according to a predefined anti-scanning rule set can be achieved by: determining the relative positional relationship between the combined attribute feature vector and the first cluster center corresponding to the malicious scanning tool, and the combined attribute feature vector and the second cluster center corresponding to the non-malicious scanning tool; and determining whether the attribute features of at least two layers are successfully matched with the preset features of the feature library based on the relative positional relationship, wherein the first cluster center and the second cluster center are obtained by performing cluster analysis on the sample feature vector, and the sample feature vector is obtained based on the sample traffic sent by the malicious scanning tool and the non-malicious scanning tool. As for the specific methods of obtaining the first and second cluster centers, the sample feature vectors can be randomly divided into training and test sets according to a preset ratio; cluster analysis can be performed on the sample feature vectors in the training set using a clustering algorithm to obtain the first candidate cluster center corresponding to the malicious scanning tool and the second candidate cluster center corresponding to the non-malicious scanning tool; based on the pre-determined identification results of the sample feature vectors in the test set, the first and second candidate cluster centers can be evaluated; when the evaluation results meet the preset standards, the first and second candidate cluster centers can be determined as the training results of the anti-scanning detection model.
[0039] In one embodiment of this application, determining whether the attribute features of at least two layers match the preset features of the feature library based on the relative positional relationship between the combined attribute feature vector and the first cluster center corresponding to a malicious scanning tool, and between the combined attribute feature vector and the second cluster center corresponding to a non-malicious scanning tool, can be achieved by: determining a first distance between the combined attribute feature vector and the first cluster center, and a second distance between the combined attribute feature vector and the second cluster center; if the first distance is less than the second distance, then it is determined that the attribute features of at least two layers match the preset features of the feature library. The first distance between the combined attribute feature vector and the first cluster center, or the second distance between the combined attribute feature vector and the second cluster center, can be Euclidean distance, Manhattan distance, Chebyshev distance, or cosine distance, etc., and this application does not limit this. As mentioned earlier, since the first cluster center corresponds to a malicious scanning tool (i.e., the first cluster center is obtained by clustering analysis based on sample traffic sent by a malicious scanning tool), and the second cluster center corresponds to a non-malicious scanning tool (i.e., the second cluster center is obtained by clustering analysis based on sample traffic sent by a non-malicious scanning tool), when the first distance (i.e., the distance between the combined attribute feature vector and the first cluster center) is less than the second distance (i.e., the distance between the combined attribute feature vector and the second cluster center), that is, the combined attribute feature vector is closer to the first cluster center than the combined attribute feature vector is to the second cluster center, then there is reason to believe that the target traffic is malicious scanning traffic from a scanning tool, that is, it is determined that the attribute features of at least two layers match the preset features of the anti-scanning feature library successfully.
[0040] In another embodiment of this application, determining whether the attribute features of at least two layers match the preset features of the feature library based on the relative positional relationship between the combined attribute feature vector and the first cluster center corresponding to the malicious scanning tool, and between the combined attribute feature vector and the second cluster center corresponding to the non-malicious scanning tool, can also involve: determining the distance between the endpoint of the combined attribute feature vector and the first cluster center; if the distance is less than a preset threshold distance, then it is determined that the attribute features of at least two layers match the preset features of the anti-scanning feature library. Similar to the aforementioned embodiment, since the first cluster center corresponds to the malicious scanning tool, that is, the first cluster center is obtained by cluster analysis based on the sample traffic sent by the malicious scanning tool, therefore, when the distance between the endpoint of the combined attribute feature vector and the first cluster center is less than the preset threshold distance, it is reasonable to consider that the target traffic is malicious scanning traffic from the scanning tool, that is, it is determined that the attribute features of at least two layers match the preset features of the anti-scanning feature library.
[0041] Step S104: If the attribute features of at least two layers match the preset features in the anti-scanning feature library, then the response message of the business request message is disguised and the disguised response message is returned to the scanning tool.
[0042] As described in the preceding embodiments, if the attribute characteristics of at least two layers of the target traffic—the network layer, transport layer, and application layer—match the preset characteristics of the anti-scanning signature library, the target traffic is identified as malicious scanning traffic from the scanning tool. To deceive the anti-scanning engine into ceasing scanning of the target device, the anti-scanning engine can disguise the response message of a service request message and then return the disguised response message to the scanning tool. Disguising the response message of a service request message means modifying some or all of the real information in the response message to make it false or erroneous. For example, a business request message might request the version number (e.g., 1.5.0) of a certain service (e.g., a web service). Since this version of the web service is vulnerable, scanning it would pose a security risk. Therefore, after determining that the business request message from the scanning tool is malicious scanning traffic (i.e., the scanning of the target device is malicious), the version information of the actual web service requested by the business request message (i.e., version 1.5.0) is modified in the response message of the business request message to the vulnerability-free version 3.0.0. In this way, when the scanning tool receives the forged response message, it assumes that the web service is not vulnerable and abandons further probing and attacking of that web service, thus achieving the goal of deceiving the scanning tool.
[0043] From the above Figure 1 As can be seen from the example of the method to prevent malicious scanning, on the one hand, since it extracts attribute features of at least two of the target traffic's network layer, transport layer, and application layer, rather than just port feature data, it can more accurately determine whether the target traffic is malicious scanning traffic from the scanning tool compared to related technologies. On the other hand, after the attribute features of at least two layers are successfully matched with the preset features in the anti-scanning feature library, thus determining that the target traffic is malicious scanning traffic from the scanning tool, a disguised response message is returned to the scanning tool to deceive the scanning tool into malicious scanning, thereby improving the ability to prevent malicious scanning.
[0044] Corresponding to the aforementioned application function implementation method embodiments, this application also provides a device, electronic device, and corresponding embodiments for preventing malicious scanning.
[0045] See Figure 2 This is a schematic diagram of a device for preventing malicious scanning, as shown in an embodiment of this application. For ease of explanation, only the parts relevant to the embodiments of this application are shown. Figure 2 The example device for preventing malicious scanning can be applied to a pre-deployed anti-scanning engine. This device mainly includes a receiving module 201, an extraction module 202, a matching module 203, and a spoofing module 204, wherein:
[0046] The receiving module 201 is used to receive target traffic, wherein the target traffic is the traffic to be detected that is redirected to the anti-scanning engine, including the service request messages of the scanning tool to the target device;
[0047] Extraction module 202 is used to extract attribute features of at least two of the network layer, transport layer and application layer of the target traffic;
[0048] The matching module 203 is used to match the attribute features of at least two layers with the preset features of the anti-scanning feature library according to the predefined anti-scanning rule set;
[0049] The camouflage module 204 is used to camouflage the response message of the business request message if the attribute features of at least two layers successfully match the preset features of the anti-scanning feature library, and then return the camouflaged response message to the scanning tool.
[0050] From the above Figure 2 The example method for preventing malicious scanning, on the one hand, extracts attribute features from at least two of the target traffic's network layer, transport layer, and application layer, rather than just port feature data. Therefore, compared to related technologies, it can accurately determine whether the target traffic is malicious scanning traffic from a scanning tool. On the other hand, after successfully matching the attribute features of at least two layers with preset features in the anti-scanning feature library, thus determining that the target traffic is malicious scanning traffic from a scanning tool, a disguised response message is returned to the scanning tool to deceive it into malicious scanning, thereby improving the ability to prevent malicious scanning.
[0051] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated further here.
[0052] Figure 3 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application.
[0053] See Figure 3 The electronic device 300 includes a memory 310 and a processor 320.
[0054] The processor 320 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.
[0055] Memory 310 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. ROM may store static data or instructions required by processor 320 or other modules of the computer. Permanent storage devices may be read-write storage devices. Permanent storage devices may be non-volatile storage devices that retain stored instructions and data even when the computer is powered off. In some embodiments, permanent storage devices use mass storage devices (e.g., magnetic or optical disks, flash memory) as permanent storage devices. In other embodiments, permanent storage devices may be removable storage devices (e.g., floppy disks, optical drives). System memory may be a read-write storage device or a volatile read-write storage device, such as dynamic random access memory. System memory may store some or all of the instructions and data required by the processor during operation. Furthermore, memory 310 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (e.g., DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and disks and / or optical disks may also be used. In some embodiments, memory 310 may include a removable storage device that is readable and / or writable, such as a laser disc (CD), a read-only digital multifunction optical disc (e.g., DVD-ROM, dual-layer DVD-ROM), a read-only Blu-ray disc, an ultra-high-density optical disc, a flash memory card (e.g., SD card, mini SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not contain carrier waves or transient electronic signals transmitted wirelessly or via wired connections.
[0056] The memory 310 stores executable code, which, when processed by the processor 320, can cause the processor 320 to execute part or all of the methods described above.
[0057] Furthermore, the method according to this application can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing some or all of the steps in the method described above.
[0058] Alternatively, this application may be implemented as a computer-readable storage medium (or a non-transitory machine-readable storage medium or a machine-readable storage medium) storing executable code (or computer program or computer instruction code) thereon, which, when executed by a processor of an electronic device (or server, etc.), causes the processor to perform part or all of the steps of the methods described above according to this application.
[0059] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.
Claims
1. A method for preventing malicious scanning, characterized in that, The method, applied to a pre-deployed anti-scanning engine, includes: Receive target traffic, which is traffic to be detected that is redirected to the anti-scanning engine, including service request messages from the scanning tool to the target device; Extract attribute features from at least two of the network layer, transport layer, and application layer of the target traffic; According to the predefined anti-scanning rule set, the attribute features of the at least two layers are matched with the preset features of the anti-scanning feature library; If the attribute features of at least two layers successfully match the preset features of the anti-scanning feature library, then the response message of the service request message is disguised, and the disguised response message is returned to the scanning tool. The extraction of attribute features from at least two of the network layer, transport layer, and application layer of the target traffic includes: Extract the source IP address feature data and destination IP address feature data from the service request message as attribute features of the network layer; Extract the source port feature data and destination port feature data from the service request message as the attribute features of the transport layer; The payload features, hypertext protocol header, hypertext protocol body, and transmission direction of the service request message are extracted as attribute features of the application layer. The attribute features of at least two of the network layer, transport layer, and application layer are combined to obtain a combined attribute feature vector.
2. The method of preventing malicious scanning of claim 1, wherein, Redirect target traffic to the anti-scanning engine using the following method: Use hook functions to intercept the target traffic; The destination address of the target traffic is modified to the address of the anti-scanning engine and then redirected to the anti-scanning engine.
3. The method of preventing malicious scanning of claim 2, wherein, The process of redirecting target traffic to the anti-scanning engine also includes: Determine the number of redirections corresponding to the service request message, and determine whether the number of redirections has reached a preset threshold; If the number of redirections reaches the preset threshold, the redirection of the service request message is interrupted, and after the redirection of the service request message is interrupted, the service request message is redirected to the address of the anti-scanning engine.
4. The method of preventing malicious scanning of claim 1, wherein, The step of matching the attribute features of the at least two layers with preset features of the anti-scanning feature library according to a predefined anti-scanning rule set includes: The relative positional relationship between the combined attribute feature vector and the first cluster center corresponding to the malicious scanning tool, and between the combined attribute feature vector and the second cluster center corresponding to the non-malicious scanning tool, is determined. The first cluster center and the second cluster center are obtained by performing cluster analysis on the sample feature vector, which is based on the sample traffic sent by the malicious scanning tool and the non-malicious scanning tool. Based on the relative positional relationship, determine whether the attribute features of the at least two layers match the preset features of the feature library.
5. The method for preventing malicious scanning according to claim 4, characterized in that, The step of determining whether the attribute features of the at least two layers match the preset features of the feature library based on the relative positional relationship includes: Determine the first distance between the combined attribute feature vector and the first cluster center, and the second distance between the combined attribute feature vector and the second cluster center; If the first distance is less than the second distance, then it is determined that the attribute features of the at least two layers successfully match the preset features of the anti-scanning feature library.
6. The method of preventing malicious scanning of claim 4, wherein, The step of determining whether the attribute features of the at least two layers match the preset features of the feature library based on the relative positional relationship includes: Determine the distance between the endpoints of the combined attribute feature vector and the first cluster center; If the distance is less than a preset threshold distance, then it is determined that the attribute features of the at least two layers successfully match the preset features of the anti-scanning feature library.
7. An apparatus for preventing malicious scanning, the apparatus comprising: The device is applied to a pre-deployed anti-scanning engine, and the device includes a receiving module, an extraction module, a matching module, and a camouflage module; The receiving module is used to receive target traffic, which is traffic to be detected that is redirected to the anti-scanning engine, including service request messages from the scanning tool to the target device; The extraction module is used to extract attribute features of at least two of the network layer, transport layer, and application layer of the target traffic. The matching module is used to match the attribute features of the at least two layers with preset features of the anti-scanning feature library according to a predefined anti-scanning rule set; The camouflage module is used to camouflage the response message of the service request message and return the camouflaged response message to the scanning tool if the attribute features of the at least two layers successfully match the preset features of the anti-scanning feature library. The extraction module is specifically used for: Extract the source IP address feature data and destination IP address feature data from the service request message as attribute features of the network layer; Extract the source port feature data and destination port feature data from the service request message as the attribute features of the transport layer; The payload features, hypertext protocol header, hypertext protocol body, and transmission direction of the service request message are extracted as attribute features of the application layer. The attribute features of at least two of the network layer, transport layer, and application layer are combined to obtain a combined attribute feature vector.
8. An electronic device, comprising: include: processor; as well as A memory having executable code stored thereon, which, when executed by the processor, causes the processor to perform the method as described in any one of claims 1 to 6.
9. A computer-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to perform the method as claimed in any one of claims 1 to 6.