Network attack processing methods, devices, systems, equipment and media

Abstract

The present disclosure provides a method for handling network attacks, which relates to the field of information security. The method comprises: obtaining a traceability information table, wherein the traceability information table includes N access information, wherein each access information includes a device identifier, a public IP address, and a public port of a terminal device, and N is greater than or equal to 1; when a network attack is detected, obtaining the public IP address and public port involved in the network attack; based on the public IP address and public port involved in the network attack, retrieving a matching public IP address and public port from the traceability information table; and based on the matching public IP address and public port, determining the device identifier in the same access information. The present disclosure also provides a network attack handling apparatus, device, storage medium, and program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and more specifically, to a network attack processing method, apparatus, system, device, medium, and program product. Background Art

[0002] Some companies provide network services that allow terminal devices (such as personal terminals, mobile terminals, or POS machines) to access the intranet. If a terminal device with access to the intranet is compromised, it can be used as a springboard for attacks on the company's business, causing significant impact.

[0003] Because the NAT (Network Address Translation) protocol cannot effectively locate compromised terminal devices based on public IP addresses, existing troubleshooting methods typically rely on manual inspection of access point logs. However, the short session aging time in the NAT table often makes effective troubleshooting difficult and prevents accurate source tracing. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a network attack processing method, apparatus, system, device, medium and program product.

[0005] One aspect of an embodiment of the present disclosure provides a method for handling network attacks, including: obtaining a traceability information table, wherein the traceability information table includes N access information, wherein each access information includes a device identification, a public IP address, and a public port of a terminal device, and N is greater than or equal to 1; when a network attack is detected, obtaining the public IP address and public port involved in the network attack; based on the public IP address and public port involved in the network attack, retrieving a matching public IP address and public port from the traceability information table; and based on the matching public IP address and public port, determining the device identification in the same access information.

[0006] According to an embodiment of the present disclosure, an intrusion detection and protection device deployed in an intranet is configured to detect the network attack. After determining the device identifier in the same access information, the method further includes: determining the device identifier in the same access information as a malicious device identifier; performing designated monitoring of the access information of the malicious device identifier; pushing the designated monitored public IP address and public port to the intrusion detection and protection device, and the intrusion detection and protection device is configured to block traffic based on the pushed public IP address and public port.

[0007] According to an embodiment of the present disclosure, obtaining the traceability information table includes: obtaining a first network information table, the first network information table includes N first network information, wherein each first network information includes a private network IP address and a device identifier; obtaining a second network information table, the second network information table includes N second network information, wherein each second network information includes a private network IP address, a public network IP address and a public network port; with the same private network IP address as the merging condition, the N first network information and the N second network information are merged one-to-one to obtain the N access information to form the traceability information table.

[0008] According to an embodiment of the present disclosure, the specified monitoring of the access information of the malicious device identifier includes: specifying the acquisition of first network information including the malicious device identifier; extracting a private network IP address from the specified first network information; specifying the acquisition of second network information including the extracted private network IP address; and merging the specified first network information and the second network information to obtain attack prevention information.

[0009] According to an embodiment of the present disclosure, the specified monitoring of the access information identified by the malicious device includes: specifying the acquisition of second network information including the matching public IP address; extracting the private IP address from the specified second network information; specifying the acquisition of first network information including the extracted private IP address; merging the specified first network information and the second network information to obtain attack access information.

[0010] According to an embodiment of the present disclosure, after determining the device identifier in the same access information, the method further includes: obtaining the private IP address in the same access information; obtaining network attack information based on the malicious device identifier and the private IP address in the same access information, and forming a network attack information table; wherein, the network attack information also includes network attack status information, and when the network attack status information is in a specific state, the access information of the malicious device identifier is specifically monitored.

[0011] According to an embodiment of the present disclosure, the method further includes: if no network attack is detected within a first predetermined time period, updating the specific state to a first state; if the network attack threat involved in the malicious device identification is lifted, updating the specific state to a second state.

[0012] According to an embodiment of the present disclosure, after pushing the designated monitored public IP address and public port to the intrusion detection and protection device, the method further includes: receiving blocking information of the intrusion detection and protection device to execute the traffic blocking; if the blocking is successfully triggered, and the designated monitored public IP address and public port do not change within the second predetermined time period, and the blocking information is not received within the second predetermined time period, updating the specific state to the third state.

[0013] According to an embodiment of the present disclosure, obtaining the first network information table includes: obtaining the first network information table based on log information of running the dynamic host configuration protocol; and / or obtaining the second network information table includes: obtaining the second network information table based on log information of running the network address translation technology.

[0014] According to an embodiment of the present disclosure, before obtaining the traceability information table, the method further includes: providing a unified Internet access point, wherein the unified Internet access point is used to provide intranet access services for M terminal devices, where M is greater than or equal to 1.

[0015] Another aspect of an embodiment of the present disclosure provides a network attack processing device, including: a tracing information module, used to obtain a tracing information table, wherein the tracing information table includes N access information, wherein each access information includes a device identification, a public IP address and a public port of a terminal device, and N is greater than or equal to 1; an information acquisition module, used to obtain the public IP address and public port involved in the network attack when a network attack is detected; an information matching module, used to retrieve a matching public IP address and public port from the tracing information table based on the public IP address and public port involved in the network attack; an attack tracing module, used to determine the device identification in the same access information based on the matching public IP address and public port.

[0016] Another aspect of an embodiment of the present disclosure provides a network attack processing system, including: a DHCP device, deployed in a local area network outside the intranet, for providing a first network information table, wherein the first network information table includes N first network information items, wherein each first network information item includes a private network IP address and a device identifier; a NAT device, deployed in the local area network, for providing a second network information table, wherein the second network information table includes N second network information items, wherein each second network information item includes a private network IP address, a public network IP address and a public network port; an intrusion detection and protection device, deployed in the intranet, for detecting network attacks and performing traffic blocking; a network attack processing device, respectively communicatively connected to the DHCP device, the NAT device and the intrusion detection and protection device, for executing the network attack processing method as claimed in any one of the above claims.

[0017] Another aspect of an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method described above.

[0018] Another aspect of the embodiments of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method described above.

[0019] Another aspect of the embodiments of the present disclosure further provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0020] One or more of the above embodiments have the following beneficial effects: N pieces of access information can be determined through the traceability information table, including the device identification, public IP address, and public port of the terminal device. When a network attack is detected, the matching public IP address and public port involved in the network attack can be retrieved from the traceability information table to determine the device identification of the terminal device involved in the network attack. Therefore, it is possible to quickly trace the source of the compromised terminal device and automatically locate the unique identification information of the compromised terminal device, thus overcoming the problem that the manual flow investigation method cannot effectively locate the compromised terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0022] Figure 1 The following schematically shows an architecture diagram of a network attack processing system according to an embodiment of the present disclosure;

[0023] Figure 2 The following schematically shows a flow chart of a method for processing network attacks according to an embodiment of the present disclosure;

[0024] Figure 3 Schematically shows a flow chart of blocking protection according to an embodiment of the present disclosure;

[0025] Figure 4 Schematically shows a flow chart for obtaining a traceability information table according to an embodiment of the present disclosure;

[0026] Figure 5 Schematically shows a flow chart of designated monitoring according to an embodiment of the present disclosure;

[0027] Figure 6 Schematically shows a flow chart of designated monitoring according to another embodiment of the present disclosure;

[0028] Figure 7 Schematically shows a flow chart of forming a network attack information table according to an embodiment of the present disclosure;

[0029] Figure 8 The flowchart of network attack tracing according to an embodiment of the present disclosure is schematically shown;

[0030] Figure 9 The following schematically shows a flowchart of network attack protection according to an embodiment of the present disclosure;

[0031] Figure 10 The following schematically shows a structural block diagram of a network attack processing device according to an embodiment of the present disclosure;

[0032] Figure 11 Schematically shows a structural block diagram of a traceability information module according to an embodiment of the present disclosure; and

[0033] Figure 12 A block diagram of an electronic device suitable for implementing a network attack processing method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0034] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0035] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0036] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0037] When expressions such as "at least one of A, B and C, etc." are used, they should generally be interpreted in accordance with the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0038] For example (but not limited to) testing scenarios, companies with testing responsibilities often provide a centralized internet access point (e.g., corporate Wi-Fi, hotspot access points, etc.) for testing devices to connect to and conduct business tests. For testing purposes, this access point typically has access to all business systems and backend management systems.

[0039] When a terminal device connected to a unified internet access point is attacked and compromised, using it as a springboard for attacks against enterprise services can have a significant impact. Because the NAT protocol cannot effectively locate the compromised host based on its public IP address, existing troubleshooting methods typically rely on manual review of access point logs. However, due to the short aging time of sessions in the NAT table, effective troubleshooting is often difficult and accurate tracing of the source is impossible. Furthermore, current protection methods block malicious attack source IP addresses, which directly impacts other terminal devices that share the same public IP address as the compromised terminal, significantly impacting services.

[0040] Some embodiments of the present disclosure provide a method for handling network attacks, which can determine N pieces of anti-questioning information through a traceability information table, including the device identification, public IP address, and public port of the terminal device. When a network attack is detected, the matching public IP address and public port involved in the network attack can be retrieved from the traceability information table to determine the device identification of the terminal device involved in the network attack. Therefore, it is possible to quickly trace the source of the compromised terminal device and automatically locate the unique identification information of the compromised terminal device, thus overcoming the problem that the manual flow and investigation method cannot effectively locate the compromised terminal device.

[0041] In addition, other embodiments of the present disclosure provide a method for handling network attacks, which identifies the device identifier in the same access information as a malicious device identifier, monitors the access information of the malicious device identifier, and pushes the designated monitored public IP address and public port to the intrusion detection and protection device for traffic blocking. This achieves precise blocking protection from specific compromised terminals to enterprise services, without directly blocking the public source IP address, and without affecting the access of other terminal users who share the public IP address with the compromised host to enterprise services, thus ensuring the continuity of enterprise business to the greatest extent possible.

[0042] Figure 1The following schematically shows the architecture of the network attack processing system according to an embodiment of the present disclosure. Figure 1 What is shown are merely examples to which the embodiments of the present disclosure may be applied, to help those skilled in the art understand the technical content of the present disclosure, but does not mean that the embodiments of the present disclosure cannot be used in other architectures or in other devices, systems, environments or scenarios.

[0043] like Figure 1 As shown, the network attack processing system 100 of this embodiment may include a DHCP device 110 , a NAT device 120 , an intrusion detection and protection device 130 , and a network attack processing apparatus 140 .

[0044] The DHCP device 110 is deployed in a local area network outside the intranet, and is used to provide a first network information table, wherein the first network information table includes N first network information items, wherein each first network information item includes a private network IP address and a device identifier. The NAT device 120 is deployed in the local area network, and is used to provide a second network information table, wherein the second network information table includes N second network information items, wherein each second network information item includes a private network IP address, a public network IP address, and a public network port. The intrusion detection and protection device 130 is deployed in the intranet, and is used to detect network attacks and perform traffic blocking. The network attack processing device 140 is respectively connected to the DHCP device, the NAT device, and the intrusion detection and protection device for executing the network attack processing method provided in some embodiments of the present disclosure.

[0045] DHCP device 110 is a Dynamic Host Configuration Protocol device that runs the Dynamic Host Configuration Protocol and is responsible for allocating private IP addresses to terminal devices 1 to M in the local area network and providing other network configuration information, where M is greater than or equal to 1. NAT (Network Address Translation) device 120 is used to convert private IP addresses into external network global displacement IP addresses, i.e., public IP addresses. It can also perform port translation and convert transmission data from the Internet into private IP addresses. Intrusion detection and protection device 130 includes, for example, IPS (Instrusion Prevention System) devices and WAF (Web Application Firewall) devices.

[0046] It should be understood that Figure 1 The number of DHCP devices 110, NAT devices 120, intrusion detection and prevention devices 130, and network attack processing apparatuses 140 is merely illustrative. Any number of DHCP devices 110, NAT devices 120, intrusion detection and prevention devices 130, and network attack processing apparatuses 140 may be provided as required.

[0047] The following will be based on Figure 1 The network attack processing system 100 described, by Figures 2 to 9 The network attack processing method of the embodiment of the present disclosure is described in detail.

[0048] Figure 2 The flowchart of the network attack processing method according to the embodiment of the present disclosure is schematically shown. Figure 2 As shown, this embodiment includes:

[0049] In operation S210 , a traceability information table is obtained, where the traceability information table includes N pieces of access information, each piece of access information includes a device identifier, a public IP address, and a public port of a terminal device, and N is greater than or equal to 1.

[0050] In some embodiments, the mapping relationship between the terminal device, the public IP address, and the public port can be predetermined and formed into a traceability information table, which can be obtained locally or from the network in operation S210. In other embodiments, the device identifier and related network information of the terminal device can be obtained in real time to obtain the traceability information table. Exemplarily, the access information includes various information about the terminal device accessing the network.

[0051] In operation S220, when a network attack is detected, a public IP address and a public port involved in the network attack are obtained.

[0052] For example, a cyberattack includes any type of attack targeting an intranet's computer information systems, infrastructure, computer networks, or personal computer devices. For computers and computer networks, any attempt to destroy, disclose, modify, or disable software or services, or to steal or access data from any computer without authorization, is considered an attack. Attack detection involves the use of network technologies that can detect abnormal or illegal activity on a network.

[0053] Under a public IP address, there may be multiple public ports corresponding to multiple terminal devices. Therefore, it is necessary to determine the public IP address and public port involved in the network attack to identify the corresponding terminal device.

[0054] In operation S230, a matching public IP address and public port are retrieved from the tracing information table according to the public IP address and public port involved in the network attack.

[0055] In operation S240 , the device identifier in the same access information is determined according to the matched public IP address and public port.

[0056] An access message includes the terminal device's device ID, public IP address, and public port. Once the public IP address and public port are determined, the terminal device's device ID can be obtained. The device ID is used to identify the terminal device and can be a MAC address, device number, device name, globally unique identifier (GUID), or device serial number.

[0057] According to the embodiments of the present disclosure, matching public IP addresses and public ports are retrieved from the traceability information table to determine the device identifier of the terminal device involved in the network attack. This allows for rapid tracing of the compromised terminal device and automated location of its unique identifier, overcoming the inability of manual investigation to effectively locate the compromised terminal device.

[0058] In some embodiments, before obtaining the traceability information table, it also includes: providing a unified Internet access point, wherein the unified Internet access point is used to provide intranet access services for M terminal devices.

[0059] Reference Figure 1 An enterprise's business intranet is a private network built using network technology, utilizing the company's internal computers, servers, and network hardware. To facilitate testing or other functions, a unified access point can be provided to allow terminal devices to access the intranet.

[0060] According to the embodiments of the present disclosure, accurate tracing of network attacks can be achieved on the basis of satisfying the intranet access requirements of terminal devices.

[0061] In other embodiments, it is not limited to a unified Internet access point. For example, terminal devices of other enterprises have the authority to access the intranet, and the traceability information table can also be determined to enable accurate traceability when a network attack is detected.

[0062] Figure 3 The flowchart of the blocking protection according to the embodiment of the present disclosure is schematically shown. Figure 3 As shown, the network attack processing method of this embodiment includes:

[0063] In operation S310 , the device identification in the same piece of access information is determined to be a malicious device identification.

[0064] A specific tag can be set to represent the malicious device identity, or the device identity in the same access information can be extracted and placed in a dedicated data table. The data table is used to store one or more malicious device identities.

[0065] In operation S320 , designated monitoring is performed on access information identified by the malicious device.

[0066] Exemplarily, designated monitoring is used to continuously obtain the public IP address and public port of a specific terminal device.

[0067] In operation S330 , the designated monitored public IP address and public port are pushed to the intrusion detection and protection device, and the intrusion detection and protection device is configured to block traffic according to the pushed public IP address and public port.

[0068] For example, using a malicious device identifier as a benchmark, real-time data changes in its access information are monitored. When the public IP address and public port number associated with the malicious device identifier change, these changes are immediately reported to the intrusion detection and prevention device, which then blocks traffic to the public port associated with the latest public IP address used by the malicious device identifier. This allows other devices to continue accessing the public IP address, as only one public port is blocked. This prevents the other devices from being affected and ensures business continuity.

[0069] According to the embodiments of the present disclosure, terminal devices that have been confirmed to be compromised are continuously monitored, and the public IP address and public port of the device on the NAT table are synchronized in real time to the blocking function of the intrusion detection and protection device, so that the intrusion detection and protection device can accurately block a device connected to the Internet under the shared public IP without affecting the device's access to its network, thereby achieving accurate blocking.

[0070] Figure 4 The flowchart of obtaining the traceability information table according to the embodiment of the present disclosure is schematically shown. Figure 4 As shown, this embodiment is one of the embodiments of operation S210, including:

[0071] In operation S410 , a first network information table is obtained, wherein the first network information table includes N pieces of first network information, wherein each piece of first network information includes a private network IP address and a device identifier.

[0072] In some embodiments, obtaining the first network information table includes: obtaining the first network information table according to log information of running the Dynamic Host Configuration Protocol.

[0073] Log information of DHCP devices or other devices that can run the Dynamic Host Configuration Protocol can be obtained, which may include DHCP table information. The first network information table is shown in Table 1, which is a correspondence table of the device number, private network IP and corresponding unique device identifier (such as MAC address) of the terminal device.

[0074] Table 1

[0075] Equipment Number Private IP address Device identification …… …… ……

[0076] In operation S420 , a second network information table is obtained, wherein the second network information table includes N pieces of second network information, wherein each piece of second network information includes a private network IP address, a public network IP address, and a public network port.

[0077] In some embodiments, obtaining the second network information table includes: obtaining the second network information table according to log information of running a network address translation technology.

[0078] Log information of a NAT device or other device capable of running network address translation technology can be obtained. The log information may include NAT session table information. The second network information table is shown in Table 2, which is a mapping relationship table of private network IP addresses, private network ports to public network IP addresses, public network ports, and services (network servers or protocols bound to the ports) in the current NAT session table.

[0079] Table 2

[0080] Serial number Private IP address Private network port Public IP address Public network port Service (optional) …… …… …… …… …… ……

[0081] In operation S430 , N pieces of first network information are merged with N pieces of second network information in a one-to-one correspondence based on having the same private IP address, to obtain N pieces of access information and form a traceability information table.

[0082] For example, the first network information table and the second network information table can be obtained in real time, and the two tables can be associated and merged based on their latest table contents and using private network IP addresses as keywords to form a traceability information table, such as Table 3.

[0083] Table 3

[0084] Private IP address Device identification Public IP address Public network port Service (optional) Serial number …… …… …… …… …… ……

[0085] According to the embodiments of the present disclosure, the first network information table and the second network information table are linked into a new table. This allows the device identification, private IP address, public IP address, public port, and service of each connected terminal device to be matched. Based on the public IP address and public port involved in a network attack, the device identification can be traced back to the corresponding terminal device, thereby confirming the corresponding terminal device and achieving accurate tracing.

[0086] Figure 5 Schematically shows a flow chart of designated monitoring according to an embodiment of the present disclosure. Figure 5 As shown, this embodiment is one of the embodiments of operation S320, including:

[0087] In operation S510 , first network information including a malicious device identifier is obtained.

[0088] For example, specify a DHCP device to push private IP addresses that identify malicious devices.

[0089] In operation S520 , a private network IP address is extracted from the designated first network information.

[0090] In operation S530 , second network information including the extracted private network IP address is designated to be acquired.

[0091] For example, based on the extracted private IP address, the NAT device is designated to push the public IP address, public port, and service in the NAT session table information.

[0092] In operation S540, the first network information and the second network information are merged to obtain attack access information. The attack access information is in the form shown in Table 3.

[0093] According to the embodiments of the present disclosure, the access information of malicious devices can be continuously tracked, and their private IP addresses, public IP addresses and public ports can be obtained in real time. Even if the access information of the malicious devices changes, accurate blocking effects can be achieved in a timely manner.

[0094] Figure 6 A flowchart of designated monitoring according to another embodiment of the present disclosure is schematically shown. Figure 6 As shown, this embodiment is one of the embodiments of operation S320, including:

[0095] In operation S610 , second network information including a matching public IP address is acquired.

[0096] For example, the NAT device is designated to push the second network information of the public IP address involved in the network attack.

[0097] In operation S620, a private network IP address is extracted from the designated acquired second network information.

[0098] In operation S630 , first network information including extracting a private network IP address is specified and obtained.

[0099] For example, based on the extracted private IP addresses, the DHCP device is designated to push the device identifier corresponding to each private IP address in the DHCP table information.

[0100] In operation S640, the first network information and the second network information are merged to obtain attack access information. The attack access information is in the form shown in Table 3.

[0101] According to an embodiment of the present disclosure, the difference from operations S510 to S540 is that: Figure 5 The illustrated embodiment continuously monitors access information based on malicious device identification. Figure 6The illustrated embodiment uses the public IP address involved in a cyberattack as a basis to obtain the mapping between private IP addresses, device identifiers, public ports, and services in real time. Considering that a cyberattack has already occurred under this public IP address and that a terminal device has been compromised, it is possible that other private IP addresses or terminal devices may also be hijacked. Therefore, continuous monitoring can improve the efficiency of tracing subsequent cyberattacks.

[0102] Figure 7 The flowchart of forming the network attack information table according to the embodiment of the present disclosure is schematically shown. After determining the device identification in the same access information, such as Figure 7 As shown, this embodiment includes:

[0103] In operation S710, the private network IP address in the same piece of access information is obtained.

[0104] In operation S720, network attack information is obtained according to the malicious device identifier and the private network IP address in the same access information, and a network attack information table is formed, as shown in Table 4.

[0105] The network attack information also includes network attack status information. When the network attack status information is in a specific state, access information identified by the malicious device is specifically monitored.

[0106] Table 4

[0107]

[0108] As shown in Table 4, it may include the last registration time, malicious device identification, network attack status information (malicious, released, under protection, expired) and private network IP address, etc.

[0109] Based on the network attack status information in the network attack information table, the conditions for starting specified monitoring can be provided, and the identification of malicious devices can be easily managed for easy tracing and statistics.

[0110] In some embodiments, if no network attack is detected within a first predetermined time period, the specific state is updated to the first state. If the network attack threat associated with the malicious device identification is resolved, the specific state is updated to the second state. The first predetermined time period can be flexibly set.

[0111] For example, if no network attack occurs within 30 minutes (just an example) from the last registration time, the specific status is modified to the expired state, i.e., the first state. If a network attack occurs, the last registration time is updated with the time point when the network attack is detected.

[0112] Criteria for determining whether a network attack threat has been resolved include whether network traffic remains stable at normal levels, whether there have been no attack events in system logs for an extended period, and whether a rescan of the network reveals no vulnerabilities. If the threat has been resolved, the specific status is changed to the resolved state, the second state. When the specific state changes to another state, the specified monitoring is no longer performed, reducing the computing resources and costs associated with running the specified monitoring and pushing information.

[0113] In some embodiments, after pushing the designated monitored public IP address and public port to the intrusion detection and protection device, the process further includes receiving a blocking message from the intrusion detection and protection device to execute traffic blocking. If blocking is successfully triggered, and the designated monitored public IP address and public port do not change within the second predetermined time period, and no blocking message is received within the second predetermined time period, the specific state may be updated to an expired state, i.e., a third state.

[0114] If the block is successfully triggered, and the public IP address and public port remain unchanged, and no block information is received within the second predetermined time period, it indicates that the malicious device has not initiated access through the designated monitored public IP address and public port, i.e., no network traffic has been generated. Therefore, the specific status can be updated to an expired state, i.e., the third state. When the specific status changes to the third state, the designated monitoring is no longer required, reducing the computing resources and costs consumed by running the designated monitoring and pushing information.

[0115] In some embodiments, if the blocking is not successfully triggered, the push continues, or a manual process is notified.

[0116] In some embodiments, designated monitoring and normal monitoring can be performed in parallel. Normal monitoring refers to the step of operation S210, which obtains all current access information, rather than access information limited to designated monitoring.

[0117] The following is combined with the network attack processing system and reference Figure 8 and Figure 9 , further illustrating the network attack processing method of the embodiment of the present disclosure.

[0118] Figure 8 The flowchart of network attack tracing according to an embodiment of the present disclosure is schematically shown.

[0119] In operation S810, NAT and DHCP device logs are received normally, and based on the latest log tables of each, the two tables are associated and merged with the private network IP as a keyword to form a tracing information table.

[0120] In operation S820, the threat log of the intrusion detection and protection device is received, the public IP address and public port involved in the network attack are obtained, the mapping relationship of the traceability information table is retrieved, the MAC address in the data entry is extracted and marked as malicious and the registration time is recorded to form a network attack information table.

[0121] In operation S830, it is determined whether the network attack information table contains an entry of "malicious, under protection". If not, the process returns to operation S810. If yes, the process proceeds to operation S840.

[0122] In operation S840, if a MAC address with a "Malicious, Protected" network attack status is found in the network attack information table, the log push mechanism for the NAT and DHCP devices is modified to a special push mechanism. Specifically, the NAT device is assigned a public address for push, and the NAT mapping table is pushed in real time based on the public address involved in the attack. The DHCP device's push mechanism is changed to a specific push mechanism, pushing the MAC address corresponding to the private IP in the NAT mapping table. The process then returns to operation S810.

[0123] In operation S850 , if the threat log of the intrusion detection and protection device is not received within a timeout period, the state corresponding to the host is changed to an expired state.

[0124] In operation S860, after the host is freed from the threat, the state of the corresponding host is modified to be freed.

[0125] This allows for automated and rapid tracing of compromised devices behind NAT, accurately locating the unique device identifier. This prevents manual troubleshooting, which can be ineffective in locating compromised devices due to frequent NAT table aging.

[0126] Figure 9 The flowchart of network attack protection according to an embodiment of the present disclosure is schematically shown.

[0127] In operation S910, the private IP address corresponding to the device identifier (such as MAC address) in a specific state in the network attack information table is pushed in real time to its public IP, public port, and service triplet, and data changes are pushed in real time. The service in the above triplet is optional.

[0128] In operation S920 , the intrusion prevention device blocks traffic from the source address triplet.

[0129] In operation S930, the intrusion prevention device feeds back blocking information, and modifies the status of the compromised host (ie, terminal device) to "protection status" or "expired status" according to the fed-back intrusion blocking log.

[0130] It achieves precise blocking protection from specific compromised terminals to corporate services, does not directly ban the public source IP, and does not affect other terminal users who share the public IP address with the compromised host to access corporate services, thus ensuring corporate business continuity to the greatest extent.

[0131] Based on the above network attack processing method, the present disclosure also provides a network attack processing device. Figure 10 The device is described in detail.

[0132] Figure 10 The structural block diagram of the network attack processing device according to an embodiment of the present disclosure is schematically shown.

[0133] like Figure 10 As shown, the network attack processing device 1000 of this embodiment includes a tracing information module 1010 , an information acquisition module 1020 , an information matching module 1030 and an attack tracing module 1040 .

[0134] The traceability information module 1010 can perform operation S210 to obtain a traceability information table, wherein the traceability information table includes N access information, each access information including a device identifier, a public IP address and a public port of a terminal device, and N is greater than or equal to 1.

[0135] In some embodiments, the traceability information module 1010 may further perform operations S410 to S430, which will not be described in detail here.

[0136] The information acquisition module 1020 may perform operation S220 to acquire a public IP address and a public port involved in a network attack when a network attack is detected.

[0137] The information matching module 1030 may perform operation S230 to retrieve a matching public IP address and public port from the tracing information table according to the public IP address and public port involved in the network attack.

[0138] The attack tracing module 1040 may perform operation S240 to determine the device identifier in the same access information according to the matched public IP address and public port.

[0139] Figure 11 The structural block diagram of the traceability information module according to an embodiment of the present disclosure is schematically shown.

[0140] like Figure 11 As shown, the tracing information module 1010 of this embodiment includes a DHCP device log pushing unit 1021 , a NAT device log pushing unit 1022 , and an intrusion detection and protection device log pushing unit 1023 .

[0141] The source tracing information module 1010 pushes customized logs from three types of devices: DHCP and NAT devices in enterprise internet access, and intrusion detection and protection devices in the enterprise's business intranet. The attack source tracing module 1040 correlates and calculates the logs, locating the MAC address of the compromised terminal using the public IP and port information of the attack source, enabling precise tracing.

[0142] The DHCP device log push unit 1021 pushes the DHCP table information of the DHCP device in the enterprise network device. The default push content is the correspondence table between the private network IP of the device and the corresponding unique identifier (MAC address), as shown in Table 1.

[0143] Since the DHCP aging time (default 14 days) is usually much longer than the NAT session aging time (xxx seconds), the default push time period is synchronized with the push period of the NAT device log push unit 1022. The optional push mode is specified push, which can only push the MAC address of a specific IP device, and the push period is synchronized with the NAT device log push unit 1022.

[0144] The NAT device log push unit 1022 pushes the NAT session table information of the NAT device in the enterprise network device. The default push content is the mapping relationship table of private network IP, private network port to public network IP, public network port, and service in the current NAT table, as shown in Table 2.

[0145] The default push time period is threshold 1, which must be less than or equal to the minimum aging time of the existing protocols in the NAT table. (For example, by default, most NAT devices have the following protocols in the NAT table, with aging times: DNS (120 seconds), FTP (120 seconds), FTP-data (120 seconds), HTTP (120 seconds), and TCP (600 seconds). Therefore, threshold 1 can be set to 120 seconds.)

[0146] The optional push modes are: 1. Push by designated private network address: For a designated private network IP address, monitor its public network IP, public network port, and service triplet and push data changes in real time. 2. Push by designated public network address: For a designated public network address, monitor all changes in the NAT table under the public network address and push its private network address in real time.

[0147] The intrusion prevention device log push unit 1023 is responsible for logging devices that provide intrusion detection, prevention, and blocking functions in the enterprise's access network. When an intrusion detection and prevention device triggers an alarm with a specified threat level or name, it pushes deduplicated network quintuple information related to the alarm, as shown in Table 5.

[0148] Table 5

[0149] Source IP Source Port Destination IP Destination port Agreement / Service …… …… …… …… ……

[0150] The source IP and source port in Table 5 are the public IP addresses and public ports involved in network attacks respectively.

[0151] The attack source tracing module 1040 receives all logs from the source tracing information module 1010 and associates the DHCP table information with the NAT table information into a new table. This allows the MAC address, private IP address, public IP address, public egress IP address, and service of each access device to be matched. Based on the five-tuple information of key alerts pushed by the intrusion prevention device log push unit 1023, the attack's source IP address and source port can be precisely traced back to the MAC address of the machine connected to the enterprise wireless hotspot, achieving precise tracing.

[0152] In some embodiments, the network attack processing device 1000 may also include an attack protection module, which is responsible for continuously monitoring devices that have been confirmed as compromised terminals, and synchronizing the public network port of the device on the NAT table in real time to the blocking function of intrusion detection and protection, so that intrusion detection and protection can accurately block a device connected to the Internet under a shared public network IP without affecting the device's access to its network, thereby achieving accurate blocking.

[0153] In some embodiments, the attack protection module further includes a designated monitoring unit, which can perform operations S310 to S330, S510 to S540, S610 to S640, and S710 to S720, which are not described in detail here.

[0154] It should be noted that the network attack processing device 800 includes a Figures 1 to 9 The modules or units of each step of the method of each embodiment. The implementation methods, technical problems solved, functions realized, and technical effects achieved of each module / unit / sub-unit in the apparatus part embodiment are the same or similar to the implementation methods, technical problems solved, functions realized, and technical effects achieved of each corresponding step in the method part embodiment, and are not repeated here.

[0155] According to embodiments of the present disclosure, any of the tracing information module 810, information acquisition module 820, information matching module 830, and attack tracing module 840 can be combined into a single module, or any of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module.

[0156] According to an embodiment of the present disclosure, at least one of the traceability information module 810, the information acquisition module 820, the information matching module 830, and the attack tracing module 840 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the traceability information module 810, the information acquisition module 820, the information matching module 830, and the attack tracing module 840 can be at least partially implemented as a computer program module, which, when executed, can perform the corresponding function.

[0157] Figure 12 A block diagram of an electronic device suitable for implementing a network attack processing method according to an embodiment of the present disclosure is schematically shown.

[0158] like Figure 12 As shown, the electronic device 1200 according to an embodiment of the present disclosure includes a processor 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1202 or a program loaded from a storage part 1208 into a random access memory (RAM) 1203. The processor 1201 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1201 may also include an onboard memory for caching purposes. The processor 1201 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0159] Various programs and data required for the operation of the electronic device 1200 are stored in the RAM 1203. The processor 1201, the ROM 1202, and the RAM 1203 are connected to each other via a bus 1204. The processor 1201 performs various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 1202 and / or the RAM 1203. It should be noted that the programs may also be stored in one or more memories other than the ROM 1202 and the RAM 1203. The processor 1201 may also perform various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0160] According to an embodiment of the present disclosure, the electronic device 1200 may further include an input / output (I / O) interface 1205, which is also connected to the bus 1204. The electronic device 1200 may further include one or more of the following components connected to the I / O interface 1205: an input portion 1206 including a keyboard, a mouse, etc.; an output portion 1207 including a cathode ray tube (CRT), a liquid crystal display (LCD), a speaker, etc.; a storage portion 1208 including a hard disk, etc.; and a communication portion 1209 including a network interface card such as a LAN card or a modem. The communication portion 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the I / O interface 1205 as needed. A removable medium 1211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 1210 as needed, so that a computer program read therefrom can be installed into the storage portion 1208 as needed.

[0161] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments. Alternatively, the computer-readable storage medium may exist independently, without being incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the methods according to the embodiments of the present disclosure.

[0162] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1202 and / or RAM 1203 described above and / or one or more memories other than ROM 1202 and RAM 1203.

[0163] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiments of the present disclosure.

[0164] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 1201 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0165] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 1209, and / or installed from the removable medium 1211. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0166] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1209 and / or installed from the removable medium 1211. When the computer program is executed by the processor 1201, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0167] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0169] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0170] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for handling network attacks, comprising: Obtain a traceability information table, wherein the traceability information table includes N access information, wherein each access information includes a device identifier, a public IP address, and a public port of a terminal device, and N is greater than or equal to 1; When a network attack is detected, obtain the public IP address and public port involved in the network attack; Retrieving a matching public IP address and public port from the tracing information table based on the public IP address and public port involved in the network attack; Determine the device identifier in the same access information based on the matched public IP address and public port; An intrusion detection and protection device deployed in the intranet is configured to detect the network attack. After determining the device identifier in the same access information, the method further includes: Determining the device identifier in the same piece of access information as a malicious device identifier; Performing designated monitoring on access information identified by the malicious device; Pushing the designated monitored public IP address and public port to the intrusion detection and protection device, wherein the intrusion detection and protection device is configured to block traffic based on the pushed public IP address and public port; Based on the malicious device identification, the real-time data changes of its access information are monitored. When the public IP address and public port of the malicious device identification change, they are pushed to the intrusion detection and protection device in real time, and the traffic is blocked at the public port under the latest public IP address used by the malicious device identification.

2. The method according to claim 1, wherein The traceability information table includes: Obtain a first network information table, where the first network information table includes N pieces of first network information, wherein each piece of first network information includes a private network IP address and a device identifier; Obtain a second network information table, where the second network information table includes N pieces of second network information, where each piece of second network information includes a private network IP address, a public network IP address, and a public network port; The N pieces of first network information and the N pieces of second network information are merged one-to-one with the condition that they have the same private network IP address, to obtain the N pieces of access information and form the traceability information table.

3. The method according to claim 2, wherein: The designated monitoring of the access information of the malicious device identification includes: Specifying to obtain first network information including the malicious device identifier; Extracting a private network IP address from the specified first network information; Specifying to obtain second network information including the extracted private network IP address; The first network information and the second network information obtained are merged to obtain attack access information.

4. The method according to claim 1, wherein The designated monitoring of the access information of the malicious device identification includes: Specifying to obtain second network information including the matching public IP address; Extracting a private network IP address from the specified acquired second network information; Specifying to obtain first network information including extracting a private network IP address; The first network information and the second network information obtained are merged to obtain attack access information.

5. The method according to claim 1, wherein After determining the device identifier in the same piece of access information, the method further includes: Obtain the private IP address in the same access information; Obtain network attack information based on the malicious device identifier and private network IP address in the same access information, and form a network attack information table; The network attack information also includes network attack status information. When the network attack status information is in a specific state, the access information of the malicious device identifier is specifically monitored.

6. The method according to claim 5, wherein: The method further comprises: If no network attack is detected within the first predetermined time period, updating the specific state to the first state; If the network attack threat involved in the malicious device identification is eliminated, the specific state is updated to the second state.

7. The method according to claim 5, wherein: After pushing the designated monitored public IP address and public port to the intrusion detection and protection device, the method further includes: receiving blocking information from the intrusion detection and protection device for executing the traffic blocking; If the blocking is successfully triggered, and the designated monitored public IP address and public port do not change within the second predetermined time period, and the blocking information is not received within the second predetermined time period, the specific state is updated to the third state.

8. The method according to claim 2, wherein: The obtaining of the first network information table comprises: obtaining the first network information table according to log information of running the Dynamic Host Configuration Protocol; and / or The obtaining of the second network information table includes: obtaining the second network information table according to log information of running the network address translation technology.

9. The method according to any one of claims 1 to 8, wherein Before obtaining the traceability information table, the method further includes: A unified Internet access point is provided, wherein the unified Internet access point is used to provide intranet access services for M terminal devices, where M is greater than or equal to 1.

10. A network attack processing device, comprising: A traceability information module is used to obtain a traceability information table, wherein the traceability information table includes N access information, wherein each access information includes a device identifier, a public IP address, and a public port of a terminal device, and N is greater than or equal to 1; An information acquisition module is used to obtain the public IP address and public port involved in the network attack when a network attack is detected; An information matching module is used to retrieve a matching public IP address and public port from the tracing information table based on the public IP address and public port involved in the network attack; An attack tracing module is configured to determine a device identifier in the same access information based on the matched public IP address and public port, wherein an intrusion detection and protection device deployed in the intranet is configured to detect the network attack. After determining the device identifier in the same access information, the apparatus further comprises: Determining the device identifier in the same piece of access information as a malicious device identifier; Performing designated monitoring on access information identified by the malicious device; Push the specified monitored public IP address and public port to the intrusion detection and protection device, and the intrusion detection and protection device is configured to block traffic based on the pushed public IP address and public port. Based on the malicious device identification, the real-time data changes of its access information are monitored. When the public IP address and public port of the malicious device identification change, they are pushed to the intrusion detection and protection device in real time, and the traffic is blocked at the public port under the latest public IP address used by the malicious device identification.

11. A network attack processing system comprising: A DHCP device, deployed in a local area network outside the intranet, configured to provide a first network information table, wherein the first network information table includes N pieces of first network information, wherein each piece of first network information includes a private network IP address and a device identifier; a NAT device, deployed in the local area network, configured to provide a second network information table, wherein the second network information table includes N pieces of second network information, wherein each piece of second network information includes a private network IP address, a public network IP address, and a public network port; Intrusion detection and protection equipment, deployed in the intranet, for detecting network attacks and performing traffic blocking; A network attack processing device is respectively connected to the DHCP device, the NAT device and the intrusion detection and protection device for executing the network attack processing method according to any one of claims 1 to 9.

12. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to perform the method according to any one of claims 1 to 9.

13. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to perform the method according to any one of claims 1 to 9.

14. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images