A server protection method and device based on dynamic IP switching

Abstract

The application discloses a server protection method and device based on dynamic IP switching, and receives a user access request by using a dynamic IP address, analyzes the user IP address, requests a DNS server by using different IP addresses, and enables malicious attack flow to be unable to be directly connected with a real server, and simultaneously, the IP address is periodically broadcasted, the real server changes the IP address according to the change, and the malicious attack flow is effectively avoided from being directly positioned to the real server address to cause normal business information data to be leaked; by dynamic IP address conversion, the malicious attack flow is introduced into a honeypot server, and the attack flow is avoided from judging the honeypot server to bypass the behavior capture of the honeypot system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electronic information security, and in particular to a server protection method and device based on dynamic IP switching. BACKGROUND

[0002] With the continuous development of emerging technologies, network hackers have now turned attacks into services, launching so-called Haas (hacker as a service), making the threat of hackers exist forever. In the prior art, the main method to deal with such stealthy and persistent attack means is network deception defense, also known as honeypot technology. Honeypot technology is essentially a means of deceiving attackers. Honeypots can be deployed on devices or honeypot servers to collect network node attack information, share attacks on servers in the same network segment, and increase the attack cost of malicious traffic and capture attack behavior to understand attack means, methods and intentions by setting up decoy hosts, information and services to lure attackers into traps. However, the prior art still has the following defects: due to the lack of regular business access, attackers can distinguish a honeypot system based on behavior patterns, thereby bypassing the behavior of the honeypot system and trapping, and the honeypot system has no business association with the real business server to be protected, and cannot change the defense mechanism of the protected server itself. If the attacker locates the real business server, the honeypot will not have any defense effect. SUMMARY

[0003] The purpose of the present application is to provide a server protection method and device based on dynamic IP switching to solve the problem of the risk of the honeypot system being discovered in the existing honeypot technology network defense method, and thus the problem of failing to trap malicious attack traffic into the honeypot system.

[0004] An embodiment of the present application provides a server protection method based on dynamic IP switching, specifically: obtaining a business request sent by a user, and parsing a user IP address of the business request;

[0005] When it is determined that the user IP address is within a preset whitelist, a first real-time IP address of a real server is requested from a DNS server; wherein the first real-time IP address is determined by the DNS server according to a current round-robin period;

[0006] According to the first real-time IP address, the business request is sent to a real server in a server group to make the real server respond to the business request and generate first business request feedback information; wherein the server group includes at least one real server and at least one honeypot server; the IP addresses of the servers in the server group are dynamically switched by the DNS server according to the round-robin period and a preset IP address set;

[0007] send the first service request feedback information to the user;

[0008] when it is determined that the user IP address is in the preset blacklist, request a second real-time IP address of any honeypot server from a DNS server; the second real-time IP address is determined by the DNS server according to other broadcasting periods;

[0009] according to the second real-time IP address, send the service request to the corresponding honeypot server, so that the honeypot server generates second service request feedback information in response to the service request;

[0010] send the second service request feedback information to the user.

[0011] The embodiment of the application receives a user access request, parses a user IP address, requests a DNS server with different IP addresses, so that malicious attack traffic cannot be directly connected with a real server, and simultaneously broadcasts IP addresses in cycles, so that the real server changes IP addresses according to changes, effectively avoids that malicious attack traffic is directly positioned to a real server address to cause normal service information data leakage; through dynamic IP address conversion, malicious attack traffic is introduced into a honeypot server, so that the attack traffic is avoided to distinguish the honeypot server, and behavior capture of the honeypot system is bypassed.

[0012] As an improvement of the above scheme, the first real-time IP address of the real server requested from the DNS server is specifically: according to a preset first network card, the first real-time IP address of the real server is requested from the DNS server; the second real-time IP address of any honeypot server requested from the DNS server is specifically: according to a preset second network card, the second real-time IP address of any honeypot server is requested from the DNS server.

[0013] As an improvement of the above scheme, the first real-time IP address, the service request is sent to a real server in a server group, specifically:

[0014] determine whether the first real-time IP address is the same as a stored real server IP address;

[0015] if the same, continue to use an existing connection channel to perform data transmission with the real server, and send received service feedback to the user;

[0016] if not the same, close an old connection channel, establish a new connection channel with the real server and perform data transmission, and send received service feedback to the user.

[0017] The improved scheme has the beneficial effect that the connection of normal service request is only affected by the resolution speed of the DNS server and the reestablishment of the connection, and the normal state does not affect the connection data transmission.

[0018] As an improvement of the above-mentioned scheme, the IP address of each server in the server group is dynamically switched by the DNS server according to a round-robin period and a preset IP address set, specifically:

[0019] The DNS server determines the IP address of the real server and the IP address of each honeypot server in the current round-robin period according to the round-robin period and the mapping relationship of each IP address in the IP address set, and the IP address of the real server and the IP address of each honeypot server are different in the same round-robin period.

[0020] The DNS server sends the IP address of the real server in the current round-robin period to the real server, so that the real server performs address switching according to the received IP address.

[0021] The DNS server sends the IP address of each honeypot server in the current round-robin period to each honeypot server, so that each honeypot server performs address switching according to the received IP address.

[0022] The improved scheme has the beneficial effect that when malicious attack traffic directly attacks the real server, the IP address of the real server will change with the DNS server round-robin, and the connection will be invalid in the next period, effectively preventing long-term latent attacks by malicious attack traffic.

[0023] As an improvement of the above-mentioned scheme, the real server is configured to prohibit external users from directly accessing through the IP address.

[0024] As an improvement of the above-mentioned scheme, the second real-time IP address is determined by the DNS server according to other round-robin periods, and the DNS server is requested to return any honeypot server IP address in the server group.

[0025] As an improvement of the above-mentioned scheme, the honeypot server generates second service request feedback information in response to the service request, specifically:

[0026] After receiving the service request, the honeypot server triggers the deployed honeypot analysis module to generate second service request feedback information; wherein the second service request feedback information includes simulated response and sub-blacklist.

[0027] As an improvement of the above-mentioned scheme, the second service request feedback information is sent to the user, specifically:

[0028] Receiving second service request feedback information, forwarding simulation response to the access user, establishing user and honeypot server connection; updating black list information based on sub-black list.

[0029] The improved beneficial effect is: make up for the defect that only black list IP address can be limited to access, can cooperate with honeypot server to trap malicious attack traffic, prolong the time of honeypot server analyzing malicious attack behavior, and improve protection ability.

[0030] Another embodiment of the application provides a kind of server protection device, comprising: analysis module, request module, sending module and response module;

[0031] Wherein, analysis module is used to obtain the service request sent by user, and the user IP address in the service request is parsed;

[0032] When the analysis module determines that the user IP address is in the preset white list, the request module is used to request the first real-time IP address of real server returned to DNS server;Wherein, first real-time IP address is determined by DNS server according to current round cycle;

[0033] The sending module according to the first real-time IP address, the service request is sent to real server in server group, so that the real server responds to the service request, generates first service request feedback information;Wherein, the server group includes at least one real server and at least one honeypot server;The IP address of each server in the server group is dynamically switched by DNS server according to round cycle and preset IP address set;

[0034] The response module is used to send the first service request feedback information to the user;

[0035] When the analysis module determines that the user IP address is in the preset black list, the request module is used to request the second real-time IP address of any honeypot server returned to DNS server;The second real-time IP address is determined by DNS server according to other round cycle;

[0036] The sending module is also used to send the service request to the corresponding honeypot server according to the second real-time IP address, so that the honeypot server responds to the service request, generates second service request feedback information;

[0037] The response module is also used to send the second service request feedback information to the user.

[0038] As the improvement of the above scheme, the first real-time IP address of the real server is requested from the DNS server, specifically, the first real-time IP address of the real server is requested from the DNS server according to the preset first network card.

[0039] The second real-time IP address of any honeypot server is requested from the DNS server, specifically, the second real-time IP address of any honeypot server is requested from the DNS server according to the preset second network card. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 is a flowchart of a server protection method based on dynamic IP switching provided by an embodiment of the present application;

[0041] Figure 2 is a structural diagram of an embodiment of a double network card request mechanism provided by an embodiment of the present application;

[0042] Figure 3 is a structural diagram of an embodiment of the first information interaction provided by an embodiment of the present application;

[0043] Figure 4 is a structural diagram of an embodiment of the second information interaction provided by an embodiment of the present application;

[0044] Figure 5 is a structural diagram of an embodiment of the network segment connection provided by an embodiment of the present application;

[0045] Figure 6 is a structural diagram of an embodiment of the round broadcast function provided by an embodiment of the present application;

[0046] Figure 7 is a structural diagram of an embodiment of the dynamic IP switching method based on network card start and stop provided by an embodiment of the present application;

[0047] Figure 8 is a flowchart of an embodiment of the dynamic IP switching method based on network card start and stop provided by an embodiment of the present application;

[0048] Figure 9 is a flowchart of an embodiment of the IP direct access prohibition provided by an embodiment of the present application;

[0049] Figure 10 is a flowchart of an embodiment of the malicious attack user access provided by an embodiment of the present application;

[0050] Figure 11 is a structural diagram of a server protection device based on dynamic IP switching provided by an embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application. Embodiment one

[0053] With reference to Figure 1 FIG. 1 is a flowchart of a server protection method based on dynamic IP switching provided by an embodiment of the present application, comprising S10-S30.

[0054] S10: obtaining a service request sent by a user and analyzing a user IP address in the service request.

[0055] As an example of the embodiment, a proxy server is set to receive a service request sent by a user, and a data connection required by the service request needs to be established through the proxy server, thereby reducing direct positioning attacks on a real server and protecting the safety of normal service and data information of the real server.

[0056] S20: judging whether the user IP address is in a blacklist.

[0057] The blacklist is used to store information of IP addresses of malicious access users, and setting the blacklist can effectively block access of malicious attacks and improve safety.

[0058] S21: when it is determined that the user IP address is in a preset whitelist, requesting a DNS server to return a first real-time IP address of a real server.

[0059] The first real-time IP address is specifically an IP address currently obtained by the real server according to the DNS server. Since the real server dynamically switches IP addresses, the proxy server needs to obtain the first real-time IP address information, so as to send the service request to the real server in a server group, so that the real server responds to the service request and generates first service request feedback information.

[0060] The first service request feedback information is a normal service response. The real server can only respond after receiving a request of the proxy server, thereby avoiding an attacker from initiating an attack after connecting the real server for hidden service connection, and reducing the threat of hidden attacks.

[0061] In the embodiment, the first real-time IP address is determined by the DNS server according to the current round-robin period. The server group comprises at least one real server and at least one honeypot server; and the IP address of each server in the server group is dynamically switched by the DNS server according to the round-robin period and a preset IP address set.

[0062] The honeypot analysis module is deployed in the honeypot server, and the honeypot analysis module is a kind of decoy, which can be deployed on equipment or honeypot server, and is used to collect network node attack information, while sharing the attack on the same network segment server resource.

[0063] In the embodiment, the first real-time IP address of the real server is requested from the DNS server, specifically: according to the preset first network card, the first real-time IP address of the real server is requested from the DNS server.

[0064] As an example of the embodiment, refer to Figure 2 , Figure 2 The structure diagram of one embodiment of the double network card request mechanism provided by the application is shown in the figure, the proxy server is preset with double network cards, the first network card and the second network card, the first network card is used to request the first real-time IP address of the real server, and the second network card is used to request the second real-time IP address of any honeypot server. Since the proxy server has identified the IP address of the access user, the double network card request mechanism is used to cooperate with the DNS server to lure malicious attack traffic into the honeypot server, without flow diversion, so that the ability to deceive attackers is improved, and the attacker cannot easily identify the behavior business, so that the security performance is improved.

[0065] In the embodiment, the service request is sent to the real server in the server group according to the first real-time IP address, specifically:

[0066] It is judged whether the first real-time IP address is the same as the stored real server IP address;

[0067] If the same, continue to use the existing connection channel to transmit data to the real server, and send the received service feedback to the user;

[0068] Reference Figure 3 , Figure 3 The structure diagram of one embodiment of the first information interaction provided by the embodiment of the application is shown in the figure, a method for transmitting data to the real server using the existing connection channel is provided, as shown in Figure 3 When the proxy server has a new request, the address is requested to be parsed, if the parsed IP address is the same as the server IP address connected by the existing connection, the reverse proxy will continue to use the existing connection for data transmission, instead of establishing a new connection.

[0069] If not, the old connection channel is closed, a new connection channel with the real server is established and data transmission is carried out, and the received service is fed back to the user. Referring to Figure 4 , Figure 4 is a structural schematic diagram of an embodiment of the second information interaction provided by the embodiment of the application. If the first real-time IP address obtained from the DNS server and the server IP address connected by the existing connection are not the same, as shown in Figure 4 , the proxy server will close the old connection and establish a new connection, and then continue data transmission by establishing a new connection. The performance of this design will only be affected by the speed of DNS resolution and the re-establishment of the connection. Since both use the DNS server, the connection data transmission will not be affected under normal circumstances.

[0070] Further, the IP addresses of the servers in the server group are dynamically switched by the DNS server according to a rotation period and a preset IP address set, specifically:

[0071] The DNS server determines the IP address of the real server and the IP addresses of the honeypot servers under the current rotation period according to the rotation period and the mapping relationship of each IP address in the IP address set; wherein the IP address of the real server and the IP addresses of the honeypot servers are all different under the same rotation period.

[0072] As a specific example of the embodiment of the application, the IP address set is determined by the number of specifically set servers, which can be referred to Figure 5 , Figure 5 is a structural schematic diagram of an embodiment of the network segment connection provided by the application, specifically a server and three honeypot servers, then each server is equipped with four network cards, each server has the same number of network cards, which are respectively connected to the same number of switches to form the same corresponding network segments. At the same time, each server only uses one network card, and the network segments of each server do not overlap.

[0073] The DNS server sends the IP address of the real server under the current rotation period to the real server, so that the real server performs address switching according to the received IP address;

[0074] The DNS server sends the IP addresses of the honeypot servers under the current rotation period to the honeypot servers respectively, so that the honeypot servers perform address switching according to the received IP addresses.

[0075] The embodiment provides a specific way, which can be referred to Figure 6 , Figure 6 is a structural schematic diagram of an embodiment of the rotation function provided by the application, as shown inFigure 6 As shown, the DNS server randomly selects a set IP address as the first real-time IP address after the script is started, and starts to cycle the broadcast according to the set period, and the mapping result of each broadcast is sent to the real server, and the real server performs address switching according to the received IP address; the honeypot server also performs address switching according to the received IP address, to avoid the conflict between the current IP address and the first real-time IP address.

[0076] Further, the embodiment provides a specific way, referring to Figure 7 and Figure 8 , Figure 7 a structural schematic diagram of an embodiment of the dynamic IP switching method based on the start and stop of the network card provided by the application, Figure 8 a flowchart of an embodiment of the dynamic IP switching method based on the start and stop of the network card provided by the application, the real server judges whether the current IP address is the same as the received IP address, and if yes, the original network card is kept on; if not, the original network card is closed, and the specified network card is started; the honeypot server closes the current network card, and starts the network card with the same IP address as the real server at the previous moment, and the network cards of the remaining honeypot servers remain unchanged, the dynamic switching of the IP address is achieved through the start and stop of the corresponding network card, the attack cost of the attacker is increased, and the risk that the flow redirection in the prior art may be found is effectively avoided.

[0077] Further, the real server is configured to prohibit the direct access of external users through the IP address.

[0078] As a specific example of the embodiment of the application, referring to FIG. Figure 9 a flowchart of an embodiment of the IP direct access prohibition provided by the application, if the attacker has the IP of the real server and does not select the domain name access but directly accesses the IP address, the real server is set to refuse the IP access, and directly returns the 403 access page, if the user tries again, because the IP address in the hand of the user does not stay on the real server for a long time, but is like Figure 9 As shown, the real server is replaced with the IP address of any honeypot server after a period. After a period, the IP in the hand of the user has been used by the honeypot server, and the real server uses another IP address, so that even if the real server is attacked by a malicious user, it will not last for a long time, and the malicious user can be led to the honeypot server without flow redirection, and the reliability of the protection method is improved.

[0079] S31: sending the first service request feedback information to the user.

[0080] As a specific example of an embodiment provided by the present invention, after receiving the feedback of the first business request, the proxy server forwards it to the accessing user and responds to the user's request, thus ensuring the security of business transmission under normal circumstances.

[0081] S22: When it is determined that the user's IP address is in the preset blacklist, request the DNS server to return the second real-time IP address of any honeypot server;

[0082] Based on the second real-time IP address, the service request is sent to the corresponding honey point server, so that the honey point server responds to the service request and generates a second service request feedback message.

[0083] As a specific example of an embodiment of the present invention, such as Figure 10 As shown, Figure 10 This is a flowchart illustrating an embodiment of malicious user access provided by the present invention. The proxy server resolves the user's IP address information, and when it determines that the user's IP address is within a preset blacklist, it can be judged that the accessing user is a malicious attacker. Figure 9 As shown, this invention does not directly disconnect the malicious user's connection, but instead employs deception to request a second real-time IP address, causing the malicious user's service requests to be forwarded to the honeypot server. In this embodiment, the second real-time IP address is determined by the DNS server based on other round-robin cycles. Specifically, requesting the DNS server to return the second real-time IP address of any honeypot server involves requesting the DNS server to return the second real-time IP address of any honeypot server based on a preset second network interface card.

[0084] This embodiment provides a specific method to add two bits to the network segment of the current round-robin address of the DNS server, i.e., the first real-time address, and return it as the resolution result, i.e., the second real-time address.

[0085] In this embodiment, the honeypot server responds to the business request and generates second business request feedback information. Specifically, after receiving the business request, the honeypot server triggers the deployed honeypot analysis module to generate second business request feedback information. This second business request feedback information includes a simulated response and a sub-blacklist. Since most attackers have the ability to identify regular business behavior, the second business request feedback information needs to include a simulated response to confuse attackers and make them appear to be attacking the real server, thus giving the honeypot system sufficient time for analysis. The sub-blacklist is configured on each honeypot server. After the honeypot analysis module analyzes the attack behavior, it adds the IP address information of the accessing user to the sub-blacklist.

[0086] Further, the second service request feedback information is sent to the user, specifically: receiving second service request feedback information, forwarding the simulation response to the access user, establishing the user and the honeypot server connection; according to the sub blacklist, updating the stored blacklist.

[0087] The embodiment provides a specific way, receiving a sub blacklist, traversing the sub blacklist, comparing the information in the sub blacklist with whether it is contained in the blacklist, if not, the blacklist increases the IP address information.

[0088] S32: the second service request feedback information is sent to the user.

[0089] The embodiment of the application receives user access request by using dynamic IP address, parses user IP address, requests DNS server with different IP address, so that malicious attack flow cannot be directly connected with real server, and at the same time, IP address is broadcasted periodically, and real server changes IP address according to the change, so that malicious attack flow is directly positioned to real server address, thereby effectively avoiding normal service information data leakage; by dynamic IP address conversion, malicious attack flow is introduced into honeypot server, so as to avoid attack flow to distinguish honeypot server and bypass the behavior capture of honeypot system. Specific embodiment two

[0091] In addition to the above method, the embodiment of the application also discloses a server protection device. Figure 11 , another embodiment provides a structure diagram of a server protection device based on dynamic IP switching, which comprises: an analysis module 201, a request module 202, a sending module 203 and a response module 204;

[0092] The analysis module 201 is used to obtain the service request sent by the user, and analyze the user IP address in the service request;

[0093] When the analysis module 201 determines that the user IP address is in the preset whitelist, the request module 202 is used to request the DNS server to return the first real-time IP address of the real server; wherein the first real-time IP address is determined by the DNS server according to the current broadcast period;

[0094] The sending module 203 sends the service request to the real server in the server group according to the first real-time IP address, so that the real server responds to the service request and generates the first service request feedback information; wherein the server group comprises at least one real server and at least one honeypot server; the IP addresses of the servers in the server group are dynamically switched by the DNS server according to the broadcast period and the preset IP address set;

[0095] The response module 204 is configured to send the first service request feedback information to the user.

[0096] When the analysis module 201 determines that the user IP address is in the preset blacklist, the request module 202 is configured to request the DNS server to return a second real-time IP address of any honeypot server; the second real-time IP address is determined by the DNS server according to other round-robin periods;

[0097] The sending module 203 is further configured to send the service request to the corresponding honeypot server according to the second real-time IP address, so that the honeypot server generates second service request feedback information in response to the service request;

[0098] The response module 204 is further configured to send the second service request feedback information to the user.

[0099] In this embodiment, the DNS server is requested to return the first real-time IP address of the real server, specifically: according to the preset first network card, the DNS server is requested to return the first real-time IP address of the real server;

[0100] The DNS server is requested to return the second real-time IP address of any honeypot server, specifically: according to the preset second network card, the DNS server is requested to return the second real-time IP address of any honeypot server.

[0101] In this embodiment, it further includes that the first real-time IP address is used to send the service request to the real server in the server group, specifically: it is judged whether the first real-time IP address is the same as the stored real server IP address;

[0102] If they are the same, the existing connection channel is used to perform data transmission with the real server, and the received service feedback is sent to the user;

[0103] If they are not the same, the old connection channel is closed, a new connection channel with the real server is established and data transmission is performed, and the received service feedback is sent to the user.

[0104] In this embodiment, the IP addresses of the servers in the server group are dynamically switched by the DNS server according to the round-robin period and the preset IP address set, specifically:

[0105] The DNS server determines the IP address of the real server and the IP addresses of the honeypot servers in the current round-robin period according to the round-robin period and the mapping relationship of each IP address in the IP address set; wherein the IP address of the real server and the IP addresses of the honeypot servers are all different in the same round-robin period.

[0106] The DNS server sends the IP address of the real server in the current round-robin period to the real server, so that the real server performs address switching according to the received IP address.

[0107] The DNS server sends the IP address of each honeypot server in the current round-robin period to each honeypot server, so that each honeypot server performs address switching according to the received IP address.

[0108] In this embodiment, the real server also performs address switching according to the received IP address, specifically:

[0109] The real server determines whether the current IP address is the same as the received IP address, and if so, keeps the original network card open; if not, performs network card switching with the honeypot server occupying the IP address specified by the DNS server at the current time.

[0110] In this embodiment, the real server is configured to prohibit external users from directly accessing through the IP address.

[0111] In this embodiment, the honeypot server generates second business request feedback information in response to the business request, specifically:

[0112] After receiving the business request, the honeypot server triggers the deployed honeypot analysis module to generate second business request feedback information; wherein the second business request feedback information includes simulated response and sub-blacklist.

[0113] The detailed working principle and process steps of the application can be but not limited to the related description in embodiment 1.

[0114] As can be seen from the above, the embodiment of the application uses dynamic IP addresses to receive user access requests, parses user IP addresses, requests DNS servers with different IP addresses, so that malicious attack traffic cannot be directly connected to real servers, and at the same time, the IP addresses are periodically broadcasted, and the real server changes the IP address according to the change, effectively avoiding the situation that malicious attack traffic directly locates the real server address to cause normal business information data leakage; through dynamic IP address conversion, malicious attack traffic is introduced into the honeypot server, and the behavior of bypassing the honeypot system to avoid attack traffic to judge the honeypot server is avoided.

[0115] The technology dynamically specifies IP through a DNS server, schedules the start and pause of network cards of real servers and honeypot servers, realizes IP switching between the real servers and the honeypot servers, thereby guiding malicious requests into the honeypot servers, and simultaneously solves the risk of traffic redirection being discovered; the connection of normal business requests is only affected by the resolution speed of the DNS server and the reestablishment of the connection, and the connection data transportation is not affected in a normal state; when malicious attack traffic directly attacks the real servers, the IP addresses of the real servers will change following the DNS server rotation, and the connection will be invalid in the next cycle, effectively preventing long-term latent attacks of malicious attack traffic; the defects of only being able to limit blacklisted IP addresses to access are remedied, malicious attack traffic can be cooperatively trapped with the honeypot servers, the time for the honeypot servers to analyze malicious attack behavior is prolonged, and the protection capability is improved.

[0116] Wherein, the unit integrated with the modification device, if realized in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. When the processor executes the computer program, the steps of each method embodiment can be implemented. The computer program includes computer program code, which can be in the form of source code, object code, executable file or some intermediate form, etc. The computer readable medium can include any entity or device, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. that can carry the computer program code. It should be noted that the content included in the computer readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable medium does not include electric carrier signals and telecommunication signals.

[0117] It should be noted that the apparatus embodiments described above are merely illustrative, and the units described as separate units can or can not be physically separate, and the units displayed as units can or can not be physical units, i.e. can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to the actual needs. In addition, the connection relationship between the units in the apparatus embodiment provided by the application indicates that there is a communication connection between them, which can be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement it without creative labor.

Claims

1. A server protection method based on dynamic IP switching, characterized by, The method comprises the following steps: acquiring a service request sent by a user and parsing an IP address of the user in the service request; when it is determined that the IP address of the user is in a preset whitelist, requesting a DNS server to return a first real-time IP address of a real server; wherein the first real-time IP address is determined by the DNS server according to a current round-robin period; sending the service request to a real server in a server group according to the first real-time IP address, so that the real server responds to the service request and generates first service request feedback information; wherein the server group comprises at least one real server and at least one honeypot server; and the IP addresses of the servers in the server group are dynamically switched by the DNS server according to a round-robin period and a preset IP address set; sending the first service request feedback information to the user; when it is determined that the IP address of the user is in a preset blacklist, requesting the DNS server to return a second real-time IP address of any honeypot server; wherein the second real-time IP address is determined by the DNS server according to a round-robin period thereof; sending the service request to the corresponding honeypot server according to the second real-time IP address, so that the honeypot server responds to the service request and generates second service request feedback information; sending the second service request feedback information to the user; wherein the IP addresses of the servers in the server group are dynamically switched by the DNS server according to a round-robin period and a preset IP address set, specifically as follows: the DNS server determines the IP address of the real server and the IP addresses of the honeypot servers in the current round-robin period according to a round-robin period and a mapping relationship of the IP addresses in the IP address set; wherein the IP address of the real server and the IP addresses of the honeypot servers are all different in the same round-robin period; the DNS server sends the IP address of the real server in the current round-robin period to the real server, so that the real server performs address switching according to the received IP address; and the DNS server sends the IP addresses of the honeypot servers in the current round-robin period to the honeypot servers respectively, so that the honeypot servers perform address switching according to the received IP addresses; wherein the real server performs address switching according to the received IP address, specifically as follows: the real server determines whether the current IP address is the same as the received IP address; if yes, the original network card is kept on; if not, the original network card is turned off and a specified network card is turned on; the honeypot server turns off the current network card and turns on the network card with the same IP address as the real server IP address at the previous time, and the network cards of the remaining honeypot servers remain unchanged.

2. The server protection method based on dynamic IP switching according to claim 1, wherein the step of requesting the DNS server to return the first real-time IP address of the real server comprises the following steps: requesting the DNS server to return the first real-time IP address of the real server according to a preset first network card. The second real-time IP address of any honeypot server is requested from the DNS server, specifically, the second real-time IP address of any honeypot server is requested from the DNS server according to a preset second network card.

3. The server protection method based on dynamic IP switching according to claim 1, characterized in that, The service request is sent to a real server in the server group according to the first real-time IP address, specifically, It is judged whether the first real-time IP address is the same as the stored real server IP address; If the same, continue to use the existing connection channel to perform data transmission with the real server, and send the received service feedback to the user; If not the same, close the old connection channel, establish a new connection channel with the real server and perform data transmission, and send the received service feedback to the user.

4. The server protection method based on dynamic IP switching according to claim 1, characterized in that, The real server is configured to prohibit external users from directly accessing by IP address.

5. The server protection method based on dynamic IP switching according to claim 1, characterized in that, The honeypot server generates second service request feedback information in response to the service request, specifically, After receiving the service request, the honeypot server triggers the deployed honeypot analysis module to generate second service request feedback information; wherein the second service request feedback information includes simulated response and sub-blacklist.

6. The server protection method based on dynamic IP switching according to claim 5, characterized in that, The second service request feedback information is sent to the user, specifically, The second service request feedback information is received, the simulated response is forwarded to the access user, the user and the honeypot server connection is established; according to the sub-blacklist, the stored blacklist is updated.

7. A server protection apparatus characterized by comprising: It includes: Analysis module, request module, sending module and response module; The analysis module is used to obtain the service request sent by the user and analyze the user IP address in the service request; When the analysis module determines that the user IP address is in the preset whitelist, the request module is used to request the DNS server to return the first real-time IP address of the real server; wherein the first real-time IP address is determined by the DNS server according to the current round cycle; The sending module sends the service request to the real server in the server group according to the first real-time IP address, so that the real server responds to the service request to generate first service request feedback information; wherein the server group includes at least one real server and at least one honeypot server; the IP address of each server in the server group is dynamically switched by the DNS server according to the round cycle and the preset IP address set; The response module is used to send the first service request feedback information to the user; When the analysis module determines that the user IP address is in the preset blacklist, the request module is used to request the DNS server to return the second real-time IP address of any honeypot server; the second real-time IP address is determined by the DNS server according to other round cycle; The sending module is also used to send the service request to the corresponding honeypot server according to the second real-time IP address, so that the honeypot server responds to the service request to generate second service request feedback information; The response module is further configured to send the second service request feedback information to the user; The IP addresses of the servers in the server group are dynamically switched by the DNS server according to a rotation cycle and a preset IP address set, specifically: the DNS server determines the IP address of the real server and the IP addresses of the honeypot servers in the current rotation cycle according to the rotation cycle and the mapping relationship of each IP address in the IP address set; the IP address of the real server and the IP addresses of the honeypot servers are different in the same rotation cycle; the DNS server sends the IP address of the real server in the current rotation cycle to the real server, so that the real server performs address switching according to the received IP address; the DNS server sends the IP addresses of the honeypot servers in the current rotation cycle to the honeypot servers respectively, so that the honeypot servers perform address switching according to the received IP addresses; The real server performs address switching according to the received IP address, specifically: the real server judges whether the current IP address is the same as the received IP address, if yes, the original network card is kept on; if not, the original network card is closed and a specified network card is opened; the honeypot server closes the current network card and opens the network card with the same IP address as the real server IP address at the previous moment, and the network card states of the remaining honeypot servers remain unchanged.

8. The server protection device of claim 7, wherein, The first real-time IP address of the real server is requested from the DNS server, specifically: the first real-time IP address of the real server is requested from the DNS server according to a preset first network card; The second real-time IP address of any honeypot server is requested from the DNS server, specifically: the second real-time IP address of any honeypot server is requested from the DNS server according to a preset second network card.

Images