A defense method, device and processing equipment for intranet segment detection

Abstract

The present application provides a defense method, device, and processing equipment for intranet segment detection, which is used to provide a more refined identification scheme for intranet segment detection, thereby achieving an effective and stable defense effect and ensuring network security. The defense method for intranet segment detection provided by the present application includes: obtaining target network traffic with a traffic direction of a preset intranet segment from different network traffic; for the target network traffic, based on the three dimensions of the number of session packets, the load length, and the number of target segments, analyzing whether the target network traffic has intranet segment detection behavior; if so, responding to the target network traffic.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically to a defense method, device, and processing equipment for detecting intranet segments. Background Art

[0002] In a network attack, intranet segment scanning usually belongs to the initial stage, that is, the information collection stage. By understanding the target network's topology, IP address range, host and service types and versions, etc., it helps to prepare for subsequent specific attack lines. Therefore, before the real network attack arrives, the protection plan for intranet segment scanning is also one of the major network security tasks.

[0003] Traditional protection solutions based on port scanning and IP scanning mainly detect attack behaviors by detecting scanning behaviors and abnormal traffic in network traffic, relying on several DoS defense modules: 1) SYN Flood: If the number of TCP SYN packets sent to the target host (DST_IP) reaches or exceeds the threshold during the detection period, an alarm log is sent; 2) UDP Flood: If the number of UDP packets sent to the target host (DST_IP) reaches or exceeds the threshold during the detection period, an alarm log is sent; 3) ICMP Flood: If the number of ICMP Request packets sent to the target host (DST_IP) reaches or exceeds the threshold during the detection period, an alarm log is sent; 4) IP Scan: If the number of ICMP request packets exceeding the threshold is detected during the detection period, an address scan is determined to determine whether an address scan has occurred (the source IP remains unchanged, but the number of target IPs exceeds the threshold).

[0004] However, the above-mentioned existing protection solutions for intranet segment scanning still have the problem of limited recognition accuracy in specific applications. This is because, on the one hand, segment detection behavior is difficult to identify. The purpose of segment detection is to discover hosts and services in the target network, not to attack the target. Therefore, the traffic of segment detection may be very similar to normal traffic, which is difficult to identify through simple protection solutions based on port scanning and IP scanning; on the other hand, the traffic and target hosts of segment detection are not single, which is also difficult to identify effectively. Summary of the Invention

[0005] The present application provides a defense method, device and processing equipment for intranet segment detection, which is used to provide a more refined identification scheme for intranet segment detection, thereby achieving an effective and stable defense effect and ensuring network security.

[0006] In a first aspect, the present application provides a method for defending against intranet segment detection, the method comprising:

[0007] Obtain target network traffic with a traffic direction of a preset intranet segment from different network traffic;

[0008] Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to see if there is any intranet segment detection behavior.

[0009] If it exists, respond to the target network traffic.

[0010] In conjunction with the first aspect of the present application, in a first possible implementation of the first aspect of the present application, for the target network traffic, based on the dimension of the number of session packets, analyzing whether the target network traffic contains intranet segment detection behavior, including:

[0011] Count the number of one-way sessions of the target network traffic based on the source IP within a preset time range to see if it exceeds the corresponding threshold;

[0012] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0013] In conjunction with the first aspect of the present application, in a second possible implementation of the first aspect of the present application, for the target network traffic, based on the dimension of payload length, analyzing whether the target network traffic has intranet segment detection behavior, including:

[0014] Count the proportion of target network traffic with the same payload length within a preset time range to see if it exceeds the corresponding threshold;

[0015] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0016] In combination with the first aspect of the present application, in a third possible implementation of the first aspect of the present application, for the target network traffic, based on the dimension of the number of target network segments, analyzing whether the target network traffic has intranet segment detection behavior includes:

[0017] Count the number of C segments to which the target IP belongs within the preset time range of the target network traffic to see if it exceeds the corresponding threshold;

[0018] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0019] In conjunction with the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, for the target network traffic, based on the three dimensions of the number of session packets, payload length, and the number of target network segments, the target network traffic is analyzed to determine whether there is intranet segment detection behavior, including:

[0020] Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to see if there is any intranet segment detection behavior.

[0021] If the analysis result of the dimension of the number of target network segments contains the behavioral characteristics of the intranet network segment detection behavior, it is determined that the target network traffic contains the intranet network segment detection behavior.

[0022] In conjunction with the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, responding to target network traffic includes:

[0023] The relevant logs of the target network traffic within the preset time range are aggregated and displayed centrally to output alarm events.

[0024] In conjunction with the first aspect of the present application, in a sixth possible implementation of the first aspect of the present application, responding to target network traffic includes:

[0025] Dynamically generates and executes a scheduled DNAT policy for target network traffic to provide proactive defense through destination address translation.

[0026] In a second aspect, the present application provides a defense device for intranet segment detection, the device comprising:

[0027] An acquisition unit, configured to acquire target network traffic whose traffic direction is a preset intranet segment from different network traffic;

[0028] The analysis unit is used to analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to determine whether there is any intranet segment detection behavior in the target network traffic. If so, the response unit is triggered.

[0029] The response unit is used to respond to target network traffic.

[0030] In conjunction with the second aspect of the present application, in a first possible implementation of the second aspect of the present application, the analysis unit is specifically configured to:

[0031] Count the number of one-way sessions of the target network traffic based on the source IP within a preset time range to see if it exceeds the corresponding threshold;

[0032] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0033] In conjunction with the second aspect of the present application, in a second possible implementation of the second aspect of the present application, the analysis unit is specifically configured to:

[0034] Count the proportion of target network traffic with the same payload length within a preset time range to see if it exceeds the corresponding threshold;

[0035] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0036] In conjunction with the second aspect of the present application, in a third possible implementation of the second aspect of the present application, the analysis unit is specifically configured to:

[0037] Count the number of C segments to which the target IP belongs within the preset time range of the target network traffic to see if it exceeds the corresponding threshold;

[0038] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0039] In conjunction with the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the analysis unit is specifically configured to:

[0040] Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to see if there is any intranet segment detection behavior.

[0041] If the analysis result of the dimension of the number of target network segments contains the behavioral characteristics of the intranet network segment detection behavior, it is determined that the target network traffic contains the intranet network segment detection behavior.

[0042] In conjunction with the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, the response unit is specifically configured to:

[0043] The relevant logs of the target network traffic within the preset time range are aggregated and displayed centrally to output alarm events.

[0044] In conjunction with the second aspect of the present application, in a sixth possible implementation of the second aspect of the present application, the response unit is specifically configured to:

[0045] Dynamically generates and executes a scheduled DNAT policy for target network traffic to provide proactive defense through destination address translation.

[0046] In a third aspect, the present application provides a processing device comprising a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation of the first aspect of the present application is executed.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided in the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0048] From the above content, it can be concluded that this application has the following beneficial effects:

[0049] For the defense target of intranet segment detection, after obtaining the target network traffic with the traffic direction of the preset intranet segment from different network traffic, this application analyzes whether the target network traffic has intranet segment detection behavior based on the three dimensions of the number of session packets, load length and the number of target segments. If so, the target network traffic is responded to. In this process, compared with the existing technology that simply determines the intranet segment detection behavior based on the number of requests / messages, this application proposes an identification scheme with three specific dimensions, which can more finely and effectively identify the intranet segment detection behavior, and then accurately respond to the target network traffic with intranet segment detection behavior in the first time, thereby achieving an effective and stable defense effect and ensuring network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 A flowchart of the defense method for intranet segment detection in this application;

[0052] Figure 2 A schematic diagram of a scenario for analyzing intranet segment detection behavior for this application;

[0053] Figure 3 A schematic diagram of the analysis architecture for this application;

[0054] Figure 4 This is a schematic diagram of a scenario for applying the DNAT strategy;

[0055] Figure 5 This is a schematic diagram of a scenario in which the DNAT strategy is enabled for this application.

[0056] Figure 6 This is an overall architecture diagram of the defense method for intranet segment detection in this application;

[0057] Figure 7 A schematic diagram of the structure of a defense device for detecting intranet segments in this application;

[0058] Figure 8 This is a structural diagram of the processing equipment for this application. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0060] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or that are inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can be changed in the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0061] The division of modules in this application is a logical division. In actual application, there may be other division methods. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. Moreover, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed into multiple circuit modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this application.

[0062] Before introducing the defense method for intranet segment detection provided by this application, the background content involved in this application is first introduced.

[0063] The defense method, device and computer-readable storage medium for intranet segment detection provided in this application can be applied to processing equipment to provide a more refined identification solution for intranet segment detection, thereby achieving an effective and stable defense effect and ensuring network security.

[0064] The defense method for intranet segment detection mentioned in this application can be executed by a defense device for intranet segment detection, or a processing device that integrates the defense device for intranet segment detection. The defense device for intranet segment detection can be implemented in hardware or software, and the processing device can be a network node involved in the network architecture, such as a gateway, server, or physical host, or even a server, physical host, or even user equipment (UE) outside the network architecture. It can provide the network security services involved in the defense method for intranet segment detection in this application for the relevant nodes in the network architecture, and the UE can specifically be a terminal device such as a smart phone, tablet computer, laptop computer, desktop computer, or personal digital assistant (PDA). In addition, the processing device itself can also be set up in the form of a device cluster.

[0065] Next, we will introduce the defense method for intranet segment detection provided by this application.

[0066] First, see Figure 1 , Figure 1 A flowchart of the method for defending against intranet segment detection provided by the present application is shown. The method for defending against intranet segment detection provided by the present application may specifically include the following steps S101 to S103:

[0067] Step S101, obtaining target network traffic with a traffic direction of a preset intranet segment from different network traffic;

[0068] It can be understood that in order to determine whether the network traffic is for intranet segment detection, or to determine whether the network traffic has intranet segment detection behavior / characteristics, the first thing this application needs to do is to obtain the target network traffic with the traffic direction being the preset intranet segment from the different network traffic within the initial judgment range, because in order to realize intranet segment detection, the network traffic will inevitably point to the intranet segment.

[0069] For the different network traffic involved here and the acquisition of the target network traffic, the acquisition means involved are adaptively adjusted according to the relationship between the processing device and the network node where the traffic is located. If the processing device is directly a network node, it is obviously sufficient to directly analyze the traffic that will pass through its own node. If the processing device is a device other than a network node, the cooperation of the network node is required.

[0070] Network traffic is composed of related requests / messages, and its traffic direction can be determined by the destination IP. If the destination IP is an IP of the intranet segment, it can be determined as the target network traffic with the traffic direction of the intranet segment.

[0071] In specific applications, different network flows used to obtain target network flows can be determined based on a time window with a preset span (which can also be dynamically adjusted), such as continuously monitoring the flow within the current time window with a span of 5 minutes; or, network flows of a preset scale can be determined as different network flows used to obtain target network flows. This setting is suitable for situations where the network flow is large, and it is convenient to split network flows of the same scale for separate processing.

[0072] As an example, the network segments 192.168.0.0 / 16, 172.16.0.0 / 12, and 10.0.0.0 / 8 can be defined as intranet segments. The traffic pointing to the network segment is targeted by the traffic monitoring module, which is the target network traffic to be analyzed in this application. The session statistics module obtains the session traffic within a time window with a span of 5 minutes as a unit to trigger the subsequent behavior determination module to perform behavioral analysis on the session traffic.

[0073] As for the intranet segment itself, it can be understood that it can be a built-in defined segment, a manually configured segment, or a segment automatically generated by the server based on the message in the response direction. How to configure the intranet segment is not the focus of this application, so this application will not elaborate on it.

[0074] Step S102: Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to determine whether there is any intranet segment detection behavior.

[0075] After determining the target network traffic that needs to be analyzed and points to the intranet segment, specific analysis work can be carried out to determine whether there is intranet segment detection behavior and whether it is traffic for intranet segment detection.

[0076] In the process of analyzing the target network traffic, it should be mentioned that in the prior art, the inventors of the present application found that the analysis was mainly based on the number of requests / messages pointing to the intranet segment, which would have the problem of limited recognition accuracy in a complex and changeable network environment. Therefore, the inventors of the present application focused on more delicate traffic analysis targets, namely the three dimensions mentioned here: the number of session packets, the payload length, and the number of target segments.

[0077] It can be understood that the three dimensions of the number of session packets, payload length, and number of target network segments take into account both the external and internal characteristics of network traffic, involving both the overall and local levels. Therefore, it is possible to more effectively and delicately analyze whether the target network traffic contains intranet segment detection behavior, and can effectively identify intranet segment detection methods such as ICMP detection, TCP detection, and UDP detection.

[0078] Correspondingly, for this analysis and processing, it is necessary to pre-configure a specific analysis strategy adapted to each dimension, and then call the strategy later.

[0079] Taking the intranet segments 192.168.0.0 / 16, 172.16.0.0 / 12, and 10.0.0.0 / 8 mentioned above as an example, the inventors of the present application found in actual applications that common intranet scanning tools such as fscan and netspy all support multi-protocol detection such as ICMP, TCP, and UDP. When automatically detecting multiple segments such as 10.0.0.0 / 8, 172.16.0.0 / 12, and 192.168.0.0 / 16, the target IP is not fixed. The solution using the existing technology cannot effectively monitor intranet segment scanning behavior events. However, after applying the solution of the present application, the intranet segment scanning behavior events can be captured in a retroactive manner.

[0080] Step S103: If it exists, respond to the target network traffic.

[0081] After determining that the current target network traffic has intranet segment detection behavior and is the traffic for intranet segment detection, it can be responded to according to the preset response strategy (also called security response or defense response) to defend against related network attacks after the intranet segment detection.

[0082] It can be understood that for network traffic that has been determined to be detected in the intranet segment, how to respond can be directly adopted by the response plan of the existing technology. Of course, in specific applications, further optimization design can be carried out in this response link, and it can be configured according to actual conditions / actual needs.

[0083] As an example, the configured result handling module can be used to load the preset response strategy and carry out specific response processing on the target network traffic.

[0084] From the above solution content, it can be seen that for the defense target of intranet segment detection, this application obtains the target network traffic with the traffic direction of the preset intranet segment from different network traffic, and then analyzes whether the target network traffic has intranet segment detection behavior based on the three dimensions of the number of session packets, load length and the number of target segments. If so, the target network traffic is responded to. In this process, compared with the existing technology that simply determines the intranet segment detection behavior based on the number of requests / messages, this application proposes an identification solution with three specific dimensions, which can more finely and effectively identify the intranet segment detection behavior, and then accurately respond to the target network traffic with intranet segment detection behavior in the first time, thereby achieving an effective and stable defense effect and ensuring network security.

[0085] Continue to the above Figure 1 Each step of the illustrated embodiment and its possible implementation in practical applications are described in detail.

[0086] For the analysis and processing of the above three dimensions, this application also provides a specific implementation plan, which is detailed below.

[0087] 1. Dimension of Session Packet Quantity

[0088] As a specific implementation method, in the above step S102, the target network traffic is analyzed based on the dimension of the number of session packets to determine whether the target network traffic contains intranet segment detection behavior, which may specifically include the following:

[0089] Count the number of one-way sessions of the target network traffic based on the source IP within a preset time range to see if it exceeds the corresponding threshold;

[0090] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0091] It can be understood that the intranet segment detection behavior here is judged based on the overall behavioral characteristics, focusing on the number of one-way sessions with the same source IP, and dividing them based on the preset one-way session number threshold.

[0092] As an example, combining Figure 2 The following is a schematic diagram of a scenario in which the present application analyzes intranet segment detection behavior. Within 5 minutes, the source IP is 192.168.225.145, the destination IP is the intranet (default intranet segment: 192.168.0.0 / 16, 172.16.0.0 / 16, 10.0.0.0\8), and the number of sessions with only one-way data (that is, only sending data packets and no receiving data packets) exceeds 5,000, then it can be determined that it is an intranet segment detection behavior.

[0093] 2. Dimension of Payload Length

[0094] As another specific implementation, in the above step S102, the target network traffic is analyzed based on the dimension of payload length to determine whether the target network traffic contains intranet segment detection behavior, which may specifically include the following:

[0095] Count the proportion of target network traffic with the same payload length within a preset time range to see if it exceeds the corresponding threshold;

[0096] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0097] It can be understood that the intranet segment detection behavior is judged here based on the behavioral characteristics within the traffic, focusing on the payload length, and then extracting the proportion of the same payload length, and dividing it with the preset ratio threshold as the boundary.

[0098] 3. Dimension of the number of target network segments

[0099] As another specific implementation, in the above step S102, the target network traffic is analyzed based on the dimension of the number of target network segments to determine whether the target network traffic has intranet segment detection behavior, which may specifically include the following:

[0100] Count the number of C segments to which the target IP belongs within the preset time range of the target network traffic to see if it exceeds the corresponding threshold;

[0101] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0102] It can be understood that here the intranet segment detection behavior is also judged from the behavioral characteristics within the traffic, focusing on the number of C segments (C-level IP segments) to which the target IP belongs, and dividing them based on the preset number threshold.

[0103] As an example, when the source IP is 192.168.225.148, the C segment to which the target IP belongs exceeds 50 (e.g. Figure 2 Correspondingly, the C segment of the target IP 10.255.237.154 is 10.255.237.0 / 24, and the C segment of the target IP 10.255.236.69 is 10.255.236.0 / 24), which can be determined as an intranet scanning event.

[0104] It can be understood that the above are three analysis solutions for intranet segment detection / intranet scanning events. In more specific practical applications, this application can also integrate the three to build a multi-layer analysis architecture to obtain more accurate and efficient analysis results.

[0105] Specifically, as another specific implementation scheme, combined with Figure 3 The following is a schematic diagram of the analysis architecture of the present application. In step S102, the target network traffic is analyzed based on the three dimensions of the number of session packets, payload length, and number of target network segments to determine whether the target network traffic has intranet segment detection behavior. Specifically, the following may be included:

[0106] Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to see if there is any intranet segment detection behavior.

[0107] If the analysis result of the dimension of the number of target network segments contains the behavioral characteristics of the intranet network segment detection behavior, it is determined that the target network traffic contains the intranet network segment detection behavior.

[0108] from Figure 3 It can be clearly seen that the first analysis link of the session packet quantity dimension is executed first. When the first analysis link preliminarily determines that there is intranet segment detection behavior, the second analysis and mitigation of the load length is continued. When the second analysis link determines that there is intranet segment detection behavior, the third analysis link of the target segment quantity is continued.

[0109] In this way, the analysis and processing of the three dimensions of the number of session packets, payload length, and number of target network segments are nested to form a three-layer analysis architecture. From the global to the local, from the overall to the details, the final analysis results of the intranet segment detection behavior are comprehensively and efficiently determined.

[0110] Among them, the specific analysis strategy adopted in the three-layer analysis architecture here can specifically adopt the exemplary implementation plan mentioned above.

[0111] In addition, it should be understood that for the analysis and processing of the three dimensions of the number of session packets, payload length, and number of target network segments, other fusion configuration schemes can be configured, or the analysis and processing can be performed relatively independently, and can be adjusted according to actual conditions / actual needs.

[0112] Of course, in actual applications, in addition to the analysis and processing of the three dimensions of the number of session packets, payload length, and number of target network segments, you can continue to configure analysis and processing of other dimensions to further improve and enhance the analysis effect.

[0113] In the response (defense) phase after determining the existence of intranet segment detection behavior, this application also configures a specific implementation plan.

[0114] As another specific implementation scheme, a warning reminder may be involved. Specifically, step S103 responds to the target network traffic, which may include:

[0115] The relevant logs of the target network traffic within the preset time range are aggregated and displayed centrally to output alarm events.

[0116] It can be understood that the output of the alarm event here is mainly processed at the software level to trigger the alarm event on the system, so that the system can record the alarm event, facilitate event backtracking, and also help trigger the corresponding event response based on the alarm event.

[0117] As another specific implementation, more direct security defense may be involved. Specifically, step S103 responds to the target network traffic, which may include:

[0118] Dynamically generates and executes a scheduled DNAT policy for target network traffic to provide proactive defense through destination address translation.

[0119] As an example, after the source IP 192.168.225.148 triggers an intranet scan event, refer to Figure 4 A schematic diagram of a scenario of the DNAT strategy of the present application is shown, and a corresponding DNAT strategy can be generated.

[0120] DNAT, which stands for Destination Network Address Translation, is a term used to describe destination address translation.

[0121] Compared with traditional DOS protection solutions and other packet loss blocking solutions, before triggering packet loss / reaching the blocking threshold, the data response of the relevant surviving network segment has been received by the attacker, which has caused some information leakage. After using the dynamic DNAT policy set here, all data is converted to local, that is, all data initiated will be responded to. The scanning results obtained by the attacker will contain a large amount of interference data, making it impossible to determine the real network segment. In this way, the purpose of protecting sensitive information is achieved by increasing the attack cost.

[0122] like Figure 5 The diagram shows a scenario of the scanning results after the DNAT strategy is activated in this application. After the defense is enabled, the DANT strategy is dynamically generated, and a large amount of interference data exists in the scanning results.

[0123] in, Figure 5 In the scenario shown, the corresponding command is to automatically scan the active network segments in the ranges of 192.168.0.0-192.168.255.25, 172.16.0.0-172.31.255.25, and 10.0.0.0-10.255.255.255.

[0124] In addition, it is understandable that the so-called timed DNAT policy can also support the configuration of a dynamic DNAT policy aging time. After the specified time, the DNAT policy becomes invalid and returns to normal.

[0125] For example, you can configure a 10-minute policy aging time. After 10 minutes, if there is no further analysis of abnormal network segment detection traffic, the dynamic DNAT policy can be invalidated.

[0126] In addition, to understand the above solutions (including exemplary solutions and example solutions) more vividly, you can also refer to Figure 6 The overall architecture diagram of the defense method for intranet segment detection of the present application is shown. Figure 6In the figure, we can see the acquisition and processing of the target network traffic for the 5-minute session statistics mentioned above, as well as the three-layer analysis architecture formed by the analysis and processing of the three dimensions of the number of session packets, payload length, and number of target network segments, and two different response / defense solutions.

[0127] The above is an introduction to the defense method for intranet segment detection provided by this application. In order to better implement the defense method for intranet segment detection provided by this application, this application also provides a defense device for intranet segment detection from the perspective of functional modules.

[0128] See Figure 7 , Figure 7 This is a schematic diagram of a structure of a defense device for detecting intranet segments in the present application. In the present application, the defense device 700 for detecting intranet segments may specifically include the following structure:

[0129] An acquisition unit 701 is configured to acquire target network traffic with a traffic direction of a preset intranet segment from different network traffic;

[0130] An analysis unit 702 is configured to analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to determine whether there is any intranet segment detection behavior in the target network traffic, and trigger a response unit if so.

[0131] The response unit 703 is configured to respond to target network traffic.

[0132] In an exemplary implementation, the analyzing unit 702 is specifically configured to:

[0133] Count the number of one-way sessions of the target network traffic based on the source IP within a preset time range to see if it exceeds the corresponding threshold;

[0134] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0135] In another exemplary implementation, the analyzing unit 702 is specifically configured to:

[0136] Count the proportion of target network traffic with the same payload length within a preset time range to see if it exceeds the corresponding threshold;

[0137] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0138] In another exemplary implementation, the analyzing unit 702 is specifically configured to:

[0139] Count the number of C segments to which the target IP belongs within the preset time range of the target network traffic to see if it exceeds the corresponding threshold;

[0140] If so, it is determined that the target network traffic has intranet segment detection behavior.

[0141] In another exemplary implementation, the analyzing unit 702 is specifically configured to:

[0142] Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to see if there is any intranet segment detection behavior.

[0143] If the analysis result of the dimension of the number of target network segments contains the behavioral characteristics of the intranet network segment detection behavior, it is determined that the target network traffic contains the intranet network segment detection behavior.

[0144] In another exemplary implementation, the response unit 703 is specifically configured to:

[0145] The relevant logs of the target network traffic within the preset time range are aggregated and displayed centrally to output alarm events.

[0146] In another exemplary implementation, the response unit 703 is specifically configured to:

[0147] Dynamically generates and executes a scheduled DNAT policy for target network traffic to provide proactive defense through destination address translation.

[0148] This application also provides a processing device from the perspective of hardware structure, see Figure 8 , Figure 8 The schematic diagram of the structure of the processing device of the present application is shown. Specifically, the processing device of the present application may include a processor 801, a memory 802 and an input / output device 803. The processor 801 is used to execute the computer program stored in the memory 802 to implement the following Figure 1 The steps of the defense method for detecting an intranet segment in the corresponding embodiment; or, when the processor 801 is used to execute the computer program stored in the memory 802, the following is implemented Figure 7 The memory 802 is used to store the functions of each unit in the embodiment corresponding to the processor 801. Figure 1 The computer program required for the defense method of intranet segment detection in the corresponding embodiment.

[0149] For example, the computer program may be divided into one or more modules / units, one or more of which are stored in the memory 802 and executed by the processor 801 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in a computer device.

[0150] The processing device may include, but is not limited to, a processor 801, a memory 802, and an input / output device 803. Those skilled in the art will appreciate that the illustrations are merely examples of processing devices and do not limit the processing device. The processing device may include more or fewer components than shown, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 801, the memory 802, the input / output device 803, etc. are connected via a bus.

[0151] The processor 801 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. The processor is the control center of the processing device and connects various parts of the entire device using various interfaces and lines.

[0152] The memory 802 can be used to store computer programs and / or modules. The processor 801 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 802 and accessing the data stored in the memory 802. The memory 802 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, at least one application required for a function, etc.; the data storage area may store data created based on the use of the processing device, etc. In addition, the memory may include high-speed random access memory and non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0153] When the processor 801 is used to execute the computer program stored in the memory 802, it can specifically implement the following functions:

[0154] Obtain target network traffic with a traffic direction of a preset intranet segment from different network traffic;

[0155] Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to see if there is any intranet segment detection behavior.

[0156] If it exists, respond to the target network traffic.

[0157] Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working process of the above-described intranet segment detection defense device, processing equipment and its corresponding units can refer to the following. Figure 1 The description of the defense method for intranet segment detection in the corresponding embodiment will not be repeated here.

[0158] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0159] To this end, the present application provides a computer-readable storage medium, which stores a plurality of instructions, which can be loaded by a processor to execute the present application as follows: Figure 1 For the steps of the defense method for detecting the intranet segment in the corresponding embodiment, the specific operations can be referred to as follows: Figure 1 The description of the defense method for intranet segment detection in the corresponding embodiment will not be repeated here.

[0160] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0161] Due to the instructions stored in the computer readable storage medium, the present application can be executed as follows: Figure 1 The steps of the defense method for detecting the intranet segment in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the defense method for intranet segment detection in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0162] The above is a detailed introduction to the defense method, device, processing equipment and computer-readable storage medium for intranet segment detection provided by this application. Specific examples are used in this article to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method of this application and its core idea; at the same time, for technical personnel in this field, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. A defense method for intranet segment detection, characterized in that: The method comprises: Obtain target network traffic with a traffic direction of a preset intranet segment from different network traffic; Analyze the target network traffic based on the number of session packets, payload length, and number of target network segments to determine whether there is any intranet segment detection behavior. If so, respond to the target network traffic; The target network traffic is analyzed based on the number of session packets, payload length, and number of target network segments to determine whether the target network traffic contains intranet segment detection behavior, including: For the target network traffic, the target network traffic is analyzed based on the three dimensions of the number of session packets, the payload length, and the number of target network segments to determine whether there is intranet segment detection behavior, wherein the first analysis step of the dimension of the number of session packets is first performed, and when it is preliminarily determined that the intranet segment detection behavior exists, the second analysis step of the dimension of the payload length is continued to be performed, and when it is determined that the intranet segment detection behavior exists, the third analysis step of the dimension of the number of target network segments is continued to be performed; If the analysis result of the target network segment quantity dimension contains the intranet segment detection behavior, then determining that the target network traffic contains the intranet segment detection behavior; The analyzing, based on the dimension of the number of session packets, whether the target network traffic contains the intranet segment detection behavior includes: Counting the number of one-way sessions of the target network traffic based on the source IP within a preset time range to determine whether it exceeds a corresponding threshold; If so, determining that the target network traffic has the intranet segment detection behavior; The analyzing, based on the dimension of the payload length, whether the target network traffic contains the intranet segment detection behavior includes: Counting the proportion of target network traffic with the same load length within a preset time range to determine whether it exceeds a corresponding threshold; If so, determining that the target network traffic has the intranet segment detection behavior; The analyzing, based on the dimension of the number of target network segments, whether the target network traffic contains the intranet segment detection behavior includes: Count the number of C segments to which the target IP of the target network traffic belongs within a preset time range, and whether it exceeds the corresponding threshold; If so, it is determined that the target network traffic has the intranet segment detection behavior.

2. The method according to claim 1, characterized in that The responding to the target network traffic includes: The relevant logs of the target network traffic are aggregated and displayed centrally within a preset time range to output alarm events.

3. The method according to claim 1, characterized in that The responding to the target network traffic includes: For the target network traffic, a timed DNAT policy is dynamically generated and executed to provide active defense through destination address translation.

4. A defense device for detecting intranet segments, characterized in that: The device comprises: An acquisition unit, configured to acquire target network traffic with a traffic direction of a preset intranet segment from different network traffic; an analyzing unit configured to analyze, based on the number of session packets, payload length, and number of target network segments, whether the target network traffic contains any intranet segment probing behavior, and trigger a responding unit if so; The response unit is configured to respond to the target network traffic; The analysis unit is specifically used for: The target network traffic is analyzed based on the number of session packets, payload length, and number of target network segments to determine whether the target network traffic contains intranet segment detection behavior, including: For the target network traffic, the target network traffic is analyzed based on the three dimensions of the number of session packets, the payload length, and the number of target network segments to determine whether there is intranet segment detection behavior, wherein the first analysis step of the dimension of the number of session packets is first performed, and when it is preliminarily determined that the intranet segment detection behavior exists, the second analysis step of the dimension of the payload length is continued to be performed, and when it is determined that the intranet segment detection behavior exists, the third analysis step of the dimension of the number of target network segments is continued to be performed; If the analysis result of the target network segment quantity dimension contains the intranet segment detection behavior, then determining that the target network traffic contains the intranet segment detection behavior; The analyzing, based on the dimension of the number of session packets, whether the target network traffic contains the intranet segment detection behavior includes: Counting the number of one-way sessions of the target network traffic based on the source IP within a preset time range to determine whether it exceeds a corresponding threshold; If so, determining that the target network traffic has the intranet segment detection behavior; The analyzing, based on the dimension of the payload length, whether the target network traffic contains the intranet segment detection behavior includes: Counting the proportion of target network traffic with the same load length within a preset time range to determine whether it exceeds a corresponding threshold; If so, determining that the target network traffic has the intranet segment detection behavior; The analyzing, based on the dimension of the number of target network segments, whether the target network traffic contains the intranet segment detection behavior includes: Count the number of C segments to which the target IP of the target network traffic belongs within a preset time range, and whether it exceeds the corresponding threshold; If so, it is determined that the target network traffic has the intranet segment detection behavior.

5. A processing device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method according to any one of claims 1 to 3 is executed.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 3.

Images