Traffic forwarding method and routing controller

Abstract

The present invention relates to a traffic forwarding method and routing controller, comprising: detecting network traffic, and when malicious traffic information is detected, determining the network protocol corresponding to the network address requested by the corresponding malicious traffic, and the traffic packet corresponding to the corresponding malicious traffic; generating forwarding rules, and sending the forwarding rules and the traffic packet to an intranet switch, so that the intranet switch sends the traffic packet to the service environment corresponding to the network protocol in a honeypot environment according to the forwarding rules. The present invention weakens the difference between the honeypot network segment and the office network segment, more accurately forwarding malicious traffic to a honeypot environment that is basically consistent with the network environment to be attacked, increasing the difficulty for attackers to distinguish the honeypot environment, inducing attackers to trigger more derivative attack behaviors, extending the attacker's attack time, capturing more unknown attack behaviors, and obtaining more new threat intelligence.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a traffic forwarding method and a routing controller. Background Art

[0002] At present, most honeypot deployment scenarios are to deploy the honeypot in a network segment isolated from the office network, mainly to prevent the attack traffic captured by the honeypot from flowing into the office network segment. Some also deploy diversion units in the office network to divert malicious traffic to the honeypot environment. However, most of them focus on the identification of malicious traffic before diversion and the triggering of the honeypot environment after diversion, ignoring the refinement of the forwarding rules used for diversion. In addition, the applied honeypot environment is relatively simple, and the environmental authenticity and simulation level are not high enough. Experienced hackers can easily distinguish that they are in a honeypot network segment, making it difficult to induce hackers to further attack and obtain more threat intelligence. Summary of the Invention

[0003] In view of this, the present invention provides a traffic forwarding method and a routing controller. When malicious traffic is detected, forwarding rules are generated according to the network protocol corresponding to the network address requested by the malicious traffic, so as to send the traffic packets corresponding to the malicious traffic to the corresponding service environment in the honeypot environment, thereby creating a more realistic network environment to induce hacker attacks and obtain more high-value threat intelligence information, thereby at least partially solving the problems existing in the prior art.

[0004] The specific content of the invention is as follows:

[0005] A traffic forwarding method, applied to a routing controller, comprising:

[0006] The network traffic is detected, and when malicious traffic information is detected, the network protocol corresponding to the network address requested by the corresponding malicious traffic and the traffic packet corresponding to the corresponding malicious traffic are determined.

[0007] Generate a forwarding rule, and send the forwarding rule and the traffic packet to the intranet switch, so that the intranet switch sends the traffic packet to the service environment corresponding to the network protocol in the honeypot environment according to the forwarding rule.

[0008] Furthermore, the service environment includes an IPV4 service environment and an IPV6 service environment, which are used to respond to network requests of IPV4 and IPV6 protocols respectively.

[0009] The generating of the forwarding rule includes: if the network protocol is the IPV4 protocol, generating a first forwarding rule; if the network protocol is the IPV6 protocol, generating a second forwarding rule.

[0010] Among them, the first forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV4 service environment; the second forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV6 service environment.

[0011] Furthermore, each service environment in the honeypot environment includes several secondary environments, and each secondary environment of each service environment is used to respond to network requests of different network services in the same network protocol.

[0012] When malicious traffic information is detected, the method further includes: determining a network service corresponding to the malicious traffic.

[0013] The generating of forwarding rules includes: determining a service environment for responding to the network request of the malicious traffic according to the network protocol; determining a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment according to the network service; and generating a third forwarding rule.

[0014] The third forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the secondary environment in the corresponding service environment in the honeypot environment.

[0015] Furthermore, each of the secondary environments includes a plurality of tertiary environments, and each tertiary environment of each of the secondary environments is respectively used to respond to network requests with different traffic attributes under the same network service in the same network protocol.

[0016] When malicious traffic information is detected, the method further includes: determining the traffic attribute of the traffic packet.

[0017] The generating of forwarding rules includes: determining a service environment for responding to the network request of the malicious traffic according to the network protocol; determining a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment according to the network service; determining a tertiary environment for responding to the network request of the malicious traffic in the corresponding secondary environment according to the traffic attributes; and generating a fourth forwarding rule.

[0018] The fourth forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the third-level environment in the second-level environment in the corresponding service environment in the honeypot environment.

[0019] Furthermore, a network mapping table of the honeypot environment is included, wherein the network mapping table includes correspondences between each service environment, secondary environment and tertiary environment in the honeypot environment and each network protocol, network service and traffic attribute.

[0020] After determining the traffic attributes of the traffic packet, the network protocol, network service and traffic attributes corresponding to the malicious traffic are used as matching items and matched with the data items in the network mapping table. The service environment, secondary environment and tertiary environment for responding to the network request of the malicious traffic are determined based on the matching results.

[0021] Furthermore, after determining the traffic attribute of the traffic packet, the method further includes:

[0022] The network protocol, network service and traffic attributes are used as matching items and matched with the data items in the network mapping table. If the network service data item fails to match, a secondary environment creation request is sent to the honeypot environment to create a secondary environment corresponding to the network service in the service environment corresponding to the network protocol, and a tertiary environment corresponding to the traffic attributes in the secondary environment.

[0023] If the network service data item matches successfully, but some corresponding matching results fail to match the traffic attribute data item, a third-level environment creation request is sent to the honeypot environment to create a third-level environment corresponding to the traffic attribute in the second-level environment corresponding to the network protocol and network service.

[0024] Furthermore, after creating the third-level environment corresponding to the traffic attribute, the method further includes:

[0025] The correspondence between the network protocol, network service and traffic attributes and the created three-level environment is written into the network mapping table.

[0026] A routing controller, comprising:

[0027] The traffic detection module is used to detect network traffic. When malicious traffic information is detected, the network protocol corresponding to the network address requested by the malicious traffic and the traffic packet corresponding to the malicious traffic are determined.

[0028] The forwarding rule generation module is used to generate a forwarding rule and send the forwarding rule and the traffic packet to the intranet switch, so that the intranet switch sends the traffic packet to the service environment corresponding to the network protocol in the honeypot environment according to the forwarding rule.

[0029] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned traffic forwarding method is implemented.

[0030] A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the aforementioned traffic forwarding method.

[0031] The beneficial effects of the present invention are embodied in:

[0032] The present invention takes into account the differences in network protocols corresponding to the network addresses that malicious traffic is to attack, and generates forwarding rules according to the network protocols corresponding to the network addresses requested by the malicious traffic, so as to send the traffic packets corresponding to the malicious traffic to the corresponding service environment in the honeypot environment. Compared with the prior art that simply forwards the malicious traffic to the honeypot environment according to the malicious traffic detection results without distinguishing the network protocol differences of the forwarded network traffic, the present invention can achieve the effect of weakening the honeypot environment, that is, weakening the difference between the honeypot network segment and the office network segment, and more accurately forwarding the malicious traffic to the honeypot environment that is basically consistent with the network environment to be attacked, thereby increasing the difficulty for attackers to distinguish the honeypot environment, inducing attackers to trigger more derivative attack behaviors, prolonging the attackers' attack time, capturing more unknown attack behaviors, and obtaining more new threat intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0034] Figure 1 This is a flow chart of a traffic forwarding method according to an embodiment of the present invention;

[0035] Figure 2 This is a flow chart of another traffic forwarding method according to an embodiment of the present invention;

[0036] Figure 3 This is a structural diagram of a routing controller according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0038] It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments may be combined with each other; and, based on the embodiments in this disclosure, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of this disclosure.

[0039] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0040] The present invention provides a traffic forwarding method embodiment, which is applied to a routing controller, such as Figure 1 Shown, including:

[0041] S11: Detect network traffic. When malicious traffic information is detected, determine the network protocol corresponding to the network address requested by the corresponding malicious traffic, and the traffic packet corresponding to the corresponding malicious traffic. The detection of network traffic can be implemented based on a detection engine, such as a network IPS. When a malicious network request is detected, such as a SQL injection request, the corresponding network traffic is determined to be malicious traffic, and the traffic packet corresponding to the malicious traffic is determined to be a malicious traffic packet. The network protocol includes the IPV4 protocol and the IPV6 protocol. The network protocol is determined based on the network address requested by the network request contained in the corresponding malicious traffic, that is, the network address to be attacked by the malicious traffic. If the network address conforms to the IPV4 protocol rules, such as "191.255.255.255", the network protocol is determined to be the IPV4 protocol. If the network address conforms to the IPV6 protocol rules, such as "fe80::e584:5884:8007:4a8b", the network protocol is determined to be the IPV6 protocol.

[0042] S12: Generate a forwarding rule and send the forwarding rule and the traffic packet to the intranet switch, so that the intranet switch sends the traffic packet to the service environment corresponding to the network protocol in the honeypot environment according to the forwarding rule. The present invention can be directly applied to a business office network environment, forwarding malicious traffic to the honeypot environment according to the forwarding rule, while normal network traffic flows normally in the office network environment according to the routing forwarding strategy.

[0043] Figure 1The embodiment takes into account the differences in network protocols corresponding to the network addresses that malicious traffic attacks, and generates forwarding rules according to the network protocols corresponding to the network addresses requested by the malicious traffic, so as to send the traffic packets corresponding to the malicious traffic to the corresponding service environment in the honeypot environment. Compared with the prior art that simply forwards the malicious traffic to the honeypot environment based on the malicious traffic detection results without distinguishing the differences in network protocols of the forwarded network traffic, it can achieve the effect of weakening the honeypot environment, that is, using the honeypot environment to create a more realistic network environment to induce hackers' attack behaviors, so as to obtain more high-value threat intelligence information.

[0044] Preferably, the service environment includes an IPV4 service environment and an IPV6 service environment, which are used to respond to network requests of IPV4 and IPV6 protocols respectively.

[0045] The generating of the forwarding rule includes: if the network protocol is the IPV4 protocol, generating a first forwarding rule; if the network protocol is the IPV6 protocol, generating a second forwarding rule.

[0046] Among them, the first forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV4 service environment; the second forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV6 service environment.

[0047] The above preferred solution gives Figure 1 The embodiment provides a method for generating forwarding rules for malicious network traffic corresponding to network requests for IPV4 addresses and network requests for IPV6 addresses, distinguishing between IPV4 service environments and IPV6 service environments in a honeypot environment, and can create a more realistic network environment, increase the difficulty for attackers to distinguish the honeypot environment, and induce attackers to trigger more derivative attack behaviors, thereby capturing more threat intelligence information.

[0048] Preferably, each service environment in the honeypot environment includes several secondary environments, and each secondary environment of the service environment is used to respond to network requests of different network services in the same network protocol. The network services include Tomcat, WebLogic, and WebSphere.

[0049] When malicious traffic information is detected, the method further includes: determining a network service corresponding to the malicious traffic.

[0050] The generating of forwarding rules includes: determining a service environment for responding to the network request of the malicious traffic according to the network protocol; determining a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment according to the network service; and generating a third forwarding rule.

[0051] The third forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the secondary environment in the corresponding service environment in the honeypot environment.

[0052] The above preferred solution further forwards malicious traffic to the honeypot environment according to the network service for responding to the secondary environment of the network request corresponding to the malicious traffic, which can further weaken the difference between the honeypot network segment and the office network segment, and further increase the difficulty for attackers to identify the honeypot environment.

[0053] Preferably, each of the secondary environments includes several tertiary environments, and each tertiary environment of each of the secondary environments is respectively used to respond to network requests with different traffic attributes under the same network service in the same network protocol.

[0054] When malicious traffic information is detected, the method further includes: determining traffic attributes of the traffic packet, wherein the traffic attributes include at least one of the following: traffic type, IP address, network segment information, and port information.

[0055] The generating of forwarding rules includes: determining a service environment for responding to the network request of the malicious traffic according to the network protocol; determining a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment according to the network service; determining a tertiary environment for responding to the network request of the malicious traffic in the corresponding secondary environment according to the traffic attributes; and generating a fourth forwarding rule.

[0056] The fourth forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the third-level environment in the second-level environment in the corresponding service environment in the honeypot environment.

[0057] The above preferred solution further forwards malicious traffic to a honeypot environment based on traffic attributes, which is used to respond to network requests corresponding to the malicious traffic. For example, if the network protocol is IPV4, the network service is tomcat, and the traffic attribute is port number "8090," a forwarding rule is generated to send the traffic packet corresponding to the malicious traffic to the third-level environment corresponding to port number "8090" in the secondary environment corresponding to the tomcat service in the IPV4 service environment of the honeypot environment. This preferred solution can further weaken the concept of the honeypot environment and more accurately forward malicious traffic to a honeypot environment that is basically consistent with the network environment to be attacked, which is conducive to extending the attacker's attack time, capturing more unknown attack behaviors, and obtaining more new threat intelligence.

[0058] Preferably, a network mapping table of the honeypot environment is further included, wherein the network mapping table contains the correspondence between each service environment, secondary environment and tertiary environment in the honeypot environment and each network protocol, network service and traffic attribute.

[0059] After determining the traffic attributes of the traffic packet, the network protocol, network service and traffic attributes corresponding to the malicious traffic are used as matching items and matched with the data items in the network mapping table. The service environment, secondary environment and tertiary environment for responding to the network request of the malicious traffic are determined based on the matching results.

[0060] The above preferred solution provides a method for determining the service environment, secondary environment and tertiary environment for responding to the network request of the malicious traffic. Compared with other determination methods such as scanning the honeypot environment, matching and determination through the network mapping table can effectively improve processing efficiency, minimize processing time, and ensure that traffic forwarding is not delayed by processing time. Malicious traffic can be forwarded to the honeypot environment according to the forwarding rules as soon as possible, avoiding the risk of network attacks on the office network segment.

[0061] Preferably, after determining the traffic attribute of the traffic packet, the method further includes:

[0062] The network protocol, network service and traffic attributes are used as matching items and matched with the data items in the network mapping table. If the network service data item fails to match, a secondary environment creation request is sent to the honeypot environment to create a secondary environment corresponding to the network service in the service environment corresponding to the network protocol, and a tertiary environment corresponding to the traffic attributes in the secondary environment.

[0063] If the network service data item matches successfully, but some corresponding matching results fail to match the traffic attribute data item, a third-level environment creation request is sent to the honeypot environment to create a third-level environment corresponding to the traffic attribute in the second-level environment corresponding to the network protocol and network service.

[0064] When determining the service environment, secondary environment, and tertiary environment for responding to the network request for the malicious traffic, if the corresponding secondary environment or tertiary environment is not obtained, that is, if it is found that the honeypot environment does not have an environment that is closest to the network environment to be attacked by the malicious traffic, the above-mentioned preferred solution can be applied, which can create the corresponding secondary environment and tertiary environment in the honeypot environment as soon as possible, helping to more accurately forward the malicious traffic to the honeypot environment that is basically consistent with the network environment to be attacked. After the honeypot environment receives the creation request, the corresponding API interface is responsible for responding to the corresponding creation request and creating the corresponding environment.

[0065] Preferably, after creating the three-level environment corresponding to the traffic attribute, the method further includes:

[0066] The correspondence between the network protocols, network services and traffic attributes and the created three-level environments is written into the network mapping table. This preferred solution can update the network mapping table in a timely manner, avoid repeated creation of the same environment, effectively reduce the redundancy of the honeypot environment, and improve the robustness of the honeypot environment.

[0067] To further illustrate the present invention, in combination with the above preferred solution, the present invention provides another traffic forwarding method embodiment, which is applied to a routing controller, such as Figure 2 Shown, including:

[0068] S21: Detect network traffic. When malicious traffic information is detected, determine the network protocol corresponding to the network address requested by the malicious traffic, the traffic packet, network service and traffic attributes corresponding to the malicious traffic; the network protocol includes IPV4 protocol and IPV6 protocol, the network service includes Tomcat, WebLogic, WebSphere, and the traffic attributes include traffic type, IP address, network segment information, and port information.

[0069] S22: The network protocol, network service and traffic attributes are used as matching items and matched with the data items in the network mapping table of the honeypot environment. If the match is successful, enter S23, if the match fails, enter S24; the honeypot environment includes an IPV4 service environment and an IPV6 service environment, and the IPV4 service environment and the IPV6 service environment respectively include several secondary environments, and each secondary environment of the service environment is used to respond to network requests of different network services in the same network protocol, and each secondary environment includes several tertiary environments, and each tertiary environment of the secondary environment is used to respond to network requests of different traffic attributes under the same network service in the same network protocol.

[0070] S23: Determine a third-level environment for responding to the network request of the malicious traffic according to the matching result.

[0071] S24: Determine the matching failure result. If the network service data item fails to match, enter S25. If the network service data item matches successfully, but the corresponding matching results fail to match the traffic attribute data item, enter S26.

[0072] S25: Sending a secondary environment creation request to the honeypot environment to create a secondary environment corresponding to the network service in the service environment corresponding to the network protocol, and a tertiary environment corresponding to the traffic attribute in the secondary environment;

[0073] S26: Sending a third-level environment creation request to the honeypot environment to create a third-level environment corresponding to the traffic attribute in the second-level environment corresponding to the network protocol and network service.

[0074] S27: Generate forwarding rules to send the corresponding traffic packet to the corresponding third-level environment in the honeypot environment, and send the forwarding rules and the traffic packet to the intranet switch; the intranet switch is used to send the traffic packet to the third-level environment corresponding to the network protocol, network service and traffic attributes in the honeypot environment according to the forwarding rules.

[0075] S28: Writing the correspondence between the network protocol, network service and traffic attributes and the created three-level environment into the network mapping table.

[0076] Figure 2 The embodiment supports forwarding malicious traffic that attacks IPV6 addresses, and at the same time can minimize the concept of the honeypot environment and more accurately forward malicious traffic to a honeypot environment that is basically consistent with the network environment to be attacked, which is conducive to extending the attacker's attack time, capturing more unknown attack behaviors, and obtaining more new threat intelligence. Figure 2 The embodiment is based on Figure 1 The preferred embodiment of the present invention is obtained, so Figure 2 The description of the embodiment is relatively simple. Please refer to the relevant Figure 1 The embodiment described.

[0077] The present invention also provides a routing controller embodiment, such as Figure 3 Shown, including:

[0078] The traffic detection module 31 is used to detect network traffic. When malicious traffic information is detected, it determines the network protocol corresponding to the network address requested by the malicious traffic and the traffic packet corresponding to the malicious traffic.

[0079] The forwarding rule generation module 32 is used to generate a forwarding rule and send the forwarding rule and the traffic packet to the intranet switch, so that the intranet switch sends the traffic packet to the service environment corresponding to the network protocol in the honeypot environment according to the forwarding rule.

[0080] Figure 3 The routing controller of the embodiment can be deployed at key locations of network ports in an office network environment, such as gateways, firewalls, etc., according to scenario requirements. Figure 3The embodiment combines the two functions of traffic detection and forwarding rule generation, so that services exposed to the outside do not need to distinguish between office network segments and honeypot network segments. All traffic is forwarded by the routing controller to formulate forwarding rules, and then flows through the intranet switch. Malicious traffic is forwarded to the honeypot environment, and non-malicious traffic is forwarded to the office network environment for normal flow. Taking into account the differences in network protocols corresponding to the network addresses that malicious traffic attacks, forwarding rules are generated according to the network protocols corresponding to the network addresses requested by the malicious traffic, so as to send the traffic packets corresponding to the malicious traffic to the corresponding service environment in the honeypot environment. Compared with the prior art that simply forwards malicious traffic to the honeypot environment based on the malicious traffic detection results without distinguishing the differences in network protocols of the forwarded network traffic, it can achieve the effect of weakening the honeypot environment, that is, using the honeypot environment to create a more realistic network environment to induce hacker attacks in order to obtain more high-value threat intelligence information.

[0081] Preferably, the service environment includes an IPV4 service environment and an IPV6 service environment, which are used to respond to network requests of IPV4 and IPV6 protocols respectively.

[0082] The generating of the forwarding rule includes: if the network protocol is the IPV4 protocol, generating a first forwarding rule; if the network protocol is the IPV6 protocol, generating a second forwarding rule.

[0083] Among them, the first forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV4 service environment; the second forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV6 service environment.

[0084] Preferably, each service environment in the honeypot environment includes several secondary environments, and each secondary environment of each service environment is used to respond to network requests of different network services in the same network protocol.

[0085] When malicious traffic information is detected, the traffic detection module 31 is further configured to determine the network service corresponding to the malicious traffic.

[0086] The generating of forwarding rules includes: determining a service environment for responding to the network request of the malicious traffic according to the network protocol; determining a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment according to the network service; and generating a third forwarding rule.

[0087] The third forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the secondary environment in the corresponding service environment in the honeypot environment.

[0088] Preferably, each of the secondary environments includes several tertiary environments, and each tertiary environment of each of the secondary environments is respectively used to respond to network requests with different traffic attributes under the same network service in the same network protocol.

[0089] When malicious traffic information is detected, the traffic detection module 31 is further configured to determine the traffic attribute of the traffic packet.

[0090] The generating of forwarding rules includes: determining a service environment for responding to the network request of the malicious traffic according to the network protocol; determining a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment according to the network service; determining a tertiary environment for responding to the network request of the malicious traffic in the corresponding secondary environment according to the traffic attributes; and generating a fourth forwarding rule.

[0091] The fourth forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the third-level environment in the second-level environment in the corresponding service environment in the honeypot environment.

[0092] Preferably, a network mapping table of the honeypot environment is further included, wherein the network mapping table contains the correspondence between each service environment, secondary environment and tertiary environment in the honeypot environment and each network protocol, network service and traffic attribute.

[0093] The traffic detection module 31 is also used to, after determining the traffic attributes of the traffic packet, use the determined network protocol, network service and traffic attributes corresponding to the malicious traffic as matching items, match them with the data items in the network mapping table, and determine the service environment, secondary environment and tertiary environment for responding to the network request of the malicious traffic based on the matching results.

[0094] Preferably, after determining the traffic attribute of the traffic packet, the traffic detection module 31 is further configured to:

[0095] The network protocol, network service and traffic attributes are used as matching items and matched with the data items in the network mapping table. If the network service data item fails to match, a secondary environment creation request is sent to the honeypot environment to create a secondary environment corresponding to the network service in the service environment corresponding to the network protocol, and a tertiary environment corresponding to the traffic attributes in the secondary environment.

[0096] If the network service data item matches successfully, but some corresponding matching results fail to match the traffic attribute data item, a third-level environment creation request is sent to the honeypot environment to create a third-level environment corresponding to the traffic attribute in the second-level environment corresponding to the network protocol and network service.

[0097] Preferably, after creating the third-level environment corresponding to the traffic attribute, the traffic detection module 31 is further used to write the correspondence between the network protocol, network service and traffic attribute and the created third-level environment into the network mapping table.

[0098] Figure 3 The embodiment is Figure 1 、 Figure 2 The routing controller embodiment corresponding to the method embodiment, Figure 3 Part of the implementation process of the embodiment is Figure 1 、 Figure 2 The embodiments are similar, so Figure 3 The description of the embodiment is relatively simple. Please refer to Figure 1 、 Figure 2 The embodiment described.

[0099] The present invention also provides an embodiment of a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method described in the aforementioned embodiment is implemented. The method can be found in Figure 1 、 Figure 2 The description of the embodiment will not be repeated here.

[0100] An embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the method described in the above embodiment.

[0101] The present invention takes into account the differences in network protocols corresponding to the network addresses to be attacked by malicious traffic, and generates forwarding rules based on the network protocols corresponding to the network addresses requested by the malicious traffic, so as to send the traffic packets corresponding to the malicious traffic to the corresponding service environment in the honeypot environment. Compared with the prior art that simply forwards the malicious traffic to the honeypot environment based on the malicious traffic detection results without distinguishing the network protocol differences of the forwarded network traffic, the present invention can achieve the effect of weakening the honeypot environment, that is, weakening the difference between the honeypot network segment and the office network segment, and more accurately forwarding the malicious traffic to the honeypot environment that is basically consistent with the network environment to be attacked, thereby increasing the difficulty for attackers to distinguish the honeypot environment, inducing attackers to trigger more derivative attack behaviors, prolonging the attackers' attack time, capturing more unknown attack behaviors, and obtaining more new threat intelligence. The present invention supports the forwarding of malicious traffic that attacks IPV6 addresses.

[0102] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A traffic forwarding method, characterized in that: Applied to a routing controller, the method includes: Detecting network traffic, and when malicious traffic information is detected, determining the network protocol corresponding to the network address requested by the malicious traffic, and the traffic packet corresponding to the malicious traffic; Generate a forwarding rule, and send the forwarding rule and the traffic packet to the intranet switch, so that the intranet switch sends the traffic packet to the service environment corresponding to the network protocol in the honeypot environment according to the forwarding rule; Each service environment in the honeypot environment includes several secondary environments, and each secondary environment of the service environment is used to respond to network requests of different network services in the same network protocol; Each of the secondary environments includes a plurality of third-level environments, and each of the third-level environments of the secondary environment is respectively used to respond to network requests with different traffic attributes under the same network service in the same network protocol; When malicious traffic information is detected, the method further includes: determining the traffic attribute of the traffic packet; After determining the traffic attributes of the traffic packet, the network protocol, network service, and traffic attributes corresponding to the determined malicious traffic are used as matching items, matched with data items in the network mapping table, and the service environment, secondary environment, and tertiary environment for responding to the network request of the malicious traffic are determined based on the matching results; The network mapping table includes the correspondence between each service environment, secondary environment and tertiary environment in the honeypot environment and each network protocol, network service and traffic attribute.

2. The method according to claim 1, characterized in that The service environment includes an IPV4 service environment and an IPV6 service environment, which are used to respond to network requests of the IPV4 and IPV6 protocols respectively; The generating of the forwarding rule comprises: if the network protocol is the IPV4 protocol, generating a first forwarding rule; if the network protocol is the IPV6 protocol, generating a second forwarding rule; Among them, the first forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV4 service environment; the second forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the IPV6 service environment.

3. The method according to claim 2, characterized in that When malicious traffic information is detected, the method further includes: determining a network service corresponding to the malicious traffic; Generating the forwarding rule includes: determining, according to the network protocol, a service environment for responding to the network request of the malicious traffic; determining, according to the network service, a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment; and generating a third forwarding rule; The third forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the secondary environment in the corresponding service environment in the honeypot environment.

4. The method according to claim 3, characterized in that Generating the forwarding rule includes: determining, according to the network protocol, a service environment for responding to the network request of the malicious traffic; determining, according to the network service, a secondary environment for responding to the network request of the malicious traffic in the corresponding service environment; determining, according to the traffic attribute, a tertiary environment for responding to the network request of the malicious traffic in the corresponding secondary environment; and generating a fourth forwarding rule; The fourth forwarding rule is used to instruct the intranet switch to send the corresponding traffic packet to the third-level environment in the second-level environment in the corresponding service environment in the honeypot environment.

5. The method according to claim 4, characterized in that After determining the traffic attribute of the traffic packet, the method further includes: The network protocol, network service and traffic attribute are used as matching items to match the data items in the network mapping table. If the network service data item fails to match, a secondary environment creation request is sent to the honeypot environment to create a secondary environment corresponding to the network service in the service environment corresponding to the network protocol, and a tertiary environment corresponding to the traffic attribute in the secondary environment; If the network service data item matches successfully, but some corresponding matching results fail to match the traffic attribute data item, a third-level environment creation request is sent to the honeypot environment to create a third-level environment corresponding to the traffic attribute in the second-level environment corresponding to the network protocol and network service.

6. The method according to claim 5, characterized in that After creating the three-level environment corresponding to the traffic attribute, the method further includes: The correspondence between the network protocol, network service and traffic attributes and the created three-level environment is written into the network mapping table.

7. A routing controller, characterized in that: include: The traffic detection module is used to detect network traffic and, when malicious traffic information is detected, determine the network protocol corresponding to the network address requested by the malicious traffic and the traffic packet corresponding to the malicious traffic; A forwarding rule generation module, configured to generate a forwarding rule and send the forwarding rule and the traffic packet to an intranet switch, so that the intranet switch sends the traffic packet to a service environment corresponding to the network protocol in a honeypot environment according to the forwarding rule; Each service environment in the honeypot environment includes several secondary environments, and each secondary environment of the service environment is used to respond to network requests of different network services in the same network protocol; Each of the secondary environments includes a plurality of third-level environments, and each of the third-level environments of the secondary environment is respectively used to respond to network requests with different traffic attributes under the same network service in the same network protocol; When malicious traffic information is detected, the traffic detection module is further configured to: determine the traffic attribute of the traffic packet; The traffic detection module is also used to: after determining the traffic attributes of the traffic packet, use the determined network protocol, network service and traffic attributes corresponding to the malicious traffic as matching items, match them with the data items in the network mapping table, and determine the service environment, secondary environment and tertiary environment for responding to the network request of the malicious traffic based on the matching results; the network mapping table contains the correspondence between each service environment, secondary environment and tertiary environment in the honeypot environment and each network protocol, network service and traffic attribute.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the traffic forwarding method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the traffic forwarding method according to any one of claims 1 to 6.

Images