A flow tripwire generation system and method

Abstract

The embodiment of the present specification provides a flow tripwire generation system and method, the system is deployed on any device in the intranet, and is used with a honeypot machine, and the system is characterized in that it comprises an environment scanner, a tripwire controller and a tripwire generator; the environment scanner is used to collect the live host information and server information in the intranet by actively scanning the network environment of the current intranet, and store the scanning results; the tripwire controller is used to construct a flow tripwire data packet according to the live host information and server information, and interact with the tripwire generator; the tripwire generator is used to generate a corresponding flow tripwire according to the flow tripwire data packet, and maintain communication with the opposite end. The present application can enhance the concealment of users and service machines in the network, interfere with the selection of attack targets by attackers, and ensure the security of the cyberspace.

Description

Technical Field

[0001] This document relates to the field of network security technology, and in particular to a traffic tripwire generation system and method. Background Technology

[0002] Passive network attacks refer to a type of attack that monitors or eavesdrops on computer and communication systems to obtain sensitive information undetected. Current passive attacks mainly manifest in the following ways: eavesdropping: eavesdropping is a very covert passive attack because the attacker does not modify the data stream, but only obtains information during transmission; data analysis: the goal of this passive attack is to identify various sensitive information such as account numbers, passwords, credit card numbers, and mobile phone numbers from the data stream; traffic analysis: attackers can obtain information about network communication patterns and network topology by monitoring the traffic patterns of data packets, enabling them to launch subsequent network attacks; passive phishing: the characteristic of this passive attack is that the attacker does not need to actively launch an attack, but simply waits for the victim to take the bait.

[0003] The main measures to deal with passive network attacks today are as follows: use encryption technology to protect sensitive information, such as SSL / TLS protocols; monitor and analyze network traffic to detect abnormal traffic in a timely manner; audit and monitor the system to detect any unusual behavior; raise employees' security awareness and educate them on how to avoid phishing attacks; and regularly update systems and applications to patch known vulnerabilities.

[0004] However, none of these measures take into account passive attacks arising from security vulnerabilities in the network protocol itself. The header of a network protocol data packet contains information related to both communicating parties, including source IP address, destination IP address, protocol type, port number, etc. This header information is transmitted in plaintext over the network because network devices along the path need to recognize this information to correctly forward the data packet to its destination. However, this information can easily be obtained by attackers through passive eavesdropping and used to track and locate users and service devices in the network, enabling them to launch precise subsequent network attacks. Summary of the Invention

[0005] This specification provides one or more embodiments of a traffic tripwire generation system, which is deployed on any device in an intranet and used in conjunction with a honeypot, including: an environment scanner, a tripwire controller, and a tripwire generator;

[0006] The environment scanner is used to: actively scan the current intranet network environment, collect information on live hosts and servers in the intranet, and store the scan results;

[0007] The tripwire controller is used to: construct traffic tripwire data packets based on the live host information and server information, and interact with the tripwire generator;

[0008] The tripwire generator is used to: generate corresponding traffic tripwires based on the traffic tripwire data packets, and maintain communication with the other end.

[0009] This specification provides one or more embodiments of a traffic tripwire generation method, including:

[0010] By actively scanning the current intranet network environment, information on live hosts and servers in the intranet is collected and the scan results are stored.

[0011] Construct a traffic tripping data packet based on the surviving host information and server information;

[0012] Based on the traffic trip data packet, a corresponding traffic trip is generated, and communication with the other end is maintained.

[0013] This specification provides one or more embodiments of an electronic device, including:

[0014] Processor; and,

[0015] A memory is configured to store computer-executable instructions, which, when executed, cause the processor to implement the steps of the aforementioned traffic tripping generation method.

[0016] This specification provides one or more embodiments of a storage medium for storing computer-executable instructions that, when executed, implement the steps of the traffic tripwire generation method described above.

[0017] This invention proposes a traffic tripwire generation system to resist passive attacks in network environments. By working in conjunction with honeypot-type devices in the network, it can quickly construct and generate a large number of traffic tripwires based on configuration or environmental information, producing a large amount of traffic simulating real business transactions. This confuses attackers who attempt to obtain sensitive information through passive eavesdropping. The system is simple to deploy. When attackers attempt to actively probe for more information, the system can help security personnel discover them during the information gathering phase, giving security personnel more time to develop specific security measures and promptly preventing impending network attacks.

[0018] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A schematic diagram illustrating the composition of a flow tripwire generation system provided in one or more embodiments of this specification;

[0021] Figure 2 This diagram illustrates the interaction between an environment scanner and a network environment in a traffic tripping generation system provided for one or more embodiments of this specification.

[0022] Figure 3 A schematic diagram of the interaction between the tripwire controller and one or more embodiments of this specification is provided for one or more embodiments of the traffic tripwire generation system.

[0023] Figure 4 A schematic diagram illustrating the interaction of a tripwire generator in a traffic tripwire generation system provided for one or more embodiments of this specification;

[0024] Figure 5 A flowchart illustrating a method for generating a traffic tripwire provided in one or more embodiments of this specification;

[0025] Figure 6 This is a schematic diagram of the structure of an electronic device provided for one or more embodiments of this specification. Detailed Implementation

[0026] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0027] System Implementation Examples

[0028] According to an embodiment of the present invention, a traffic tripwire generation system is provided. The system is deployed on any device within an intranet and is used in conjunction with a honeypot. Figure 1 This is a schematic diagram illustrating the composition of a traffic tripwire generation system provided in one or more embodiments of this specification, such as... Figure 1 As shown, the traffic tripwire generation system according to an embodiment of the present invention specifically includes: an environment scanner 10, a tripwire controller 20, and a tripwire generator 30;

[0029] The environment scanner 10 is used to: actively scan the current intranet network environment, collect information on live hosts and servers in the intranet, and store the scan results.

[0030] The purpose of the environment scanner 10 is to perceive the current state of the network environment and store it in memory in JSON format for use by the subsequent policy controller module.

[0031] like Figure 2 As shown, the environment scanner 10 is specifically used for:

[0032] Use ICMP probe packets to scan the network segment where the internal network is located to obtain the IP addresses of currently active hosts;

[0033] Based on the IP address of the currently active host, send SYN packets to each port of each active host to probe whether the port is open and the services running on these ports;

[0034] If the target returns a SYN / ACK packet, it means that the port is open; if the target returns an RST packet, it means that the port is closed.

[0035] The tripwire controller 20 is used to: construct traffic tripwire data packets based on the surviving host information and server information, and interact with the tripwire generator.

[0036] The tripwire controller 20 includes an ARP cache redirection module and a traffic construction module, such as... Figure 3 As shown;

[0037] The ARP cache redirection module is specifically used to: construct ARP packets based on the scan results or configuration file, and redirect the ARP cache of the peer honeypot or real host to other honeypot types of devices, in order to confuse attackers who are already on the peer honeypot or real host and are trying to view the ARP cache to find targets;

[0038] The traffic construction module is specifically used to: construct TCP handshake packets and simulate business data based on the scan results or configuration file, so as to successfully interact with the honeypot machine and thus successfully maintain the entire tripwire system.

[0039] The surviving host information includes the host IP address, and the server information includes the type of service currently running on the server and the open ports.

[0040] The tripwire generator 30 is used to: generate a corresponding traffic tripwire based on the traffic tripwire data packet, and maintain communication with the other end.

[0041] The interaction between Tripwire Generator 30 and Honeypots is as follows: Figure 4 As shown, the tripwire generator 30 is responsible for generating tripwire traffic connecting to the honeypot of the corresponding service and maintaining the entire communication process through threads; it interacts with the tripwire controller 20, at which time the tripwire controller 20 also manages and controls the tripwire traffic according to the response from the other end in the tripwire traffic, such as changing the business data in the current tripwire traffic or cutting off the tripwire.

[0042] The system also includes a configuration file 40 for storing tripwire configuration information, which is used to provide the tripwire controller with the tripwire configuration information of the current intranet network environment without scanning the intranet network environment through the environment scanner; the tripwire configuration information includes the source address, destination address, decoy information of the tripwire traffic, type of tripwire, and generation time and interval of tripwire, which are manually entered by the administrator.

[0043] When an administrator does not wish to scan the entire network environment, they can manually enter the environment information into configuration file 40. In this case, the scanner of the entire system will not work, and the tripwire controller will read the data in configuration file 40 to perform subsequent work.

[0044] The system also includes an application programming interface (API) for controlling the activation or deactivation of the traffic tripping generation system.

[0045] The beneficial effects of this invention are as follows:

[0046] This invention proposes a traffic tripwire generation system capable of resisting passive attacks in network environments. By working in conjunction with honeypot-type devices in the network, it can quickly construct and generate a large number of traffic tripwires based on configuration or environmental information, producing a large amount of traffic simulating real business transactions. This confuses attackers attempting to obtain sensitive information through passive eavesdropping. The system is simple to deploy. When attackers attempt to actively probe for further information, the system can help security personnel discover them during the information gathering phase, giving security personnel more time to develop specific security measures and promptly preventing impending network attacks.

[0047] Method Implementation Examples

[0048] According to an embodiment of the present invention, a method for generating traffic tripwires is provided. Figure 5 A flowchart illustrating a traffic tripwire generation method provided in one or more embodiments of this specification, such as... Figure 5As shown, the traffic tripwire generation method according to an embodiment of the present invention specifically includes:

[0049] S1. Actively scan the current intranet network environment, collect information on live hosts and servers in the intranet, and store the scan results;

[0050] S2. Construct a traffic tripping data packet based on the surviving host information and server information;

[0051] S3. Generate a corresponding traffic trip based on the traffic trip data packet, and maintain communication with the other end.

[0052] Specifically, the process of generating traffic tripwires when the traffic tripwire generation system is working is as follows:

[0053] First, the administrator needs to manually enter configuration information into the configuration file, such as the source and destination addresses of the tripwire traffic, the decoy information in the tripwire traffic, and the effective time and interval of the tripwire.

[0054] If the administrator has not written a configuration file, the system will run with the default configuration. The environment scanner will actively perform a simple scan of the current network segment to obtain information about currently active hosts, as well as the services running on the server and open ports.

[0055] The tripwire controller begins constructing the corresponding tripwire traffic data packets based on the results of the environment scanner or the contents of the configuration file. It also interacts with the tripwire generator to collaboratively generate tripwires and maintain the entire communication.

[0056] The tripwire generator generates corresponding tripwire traffic based on the data packets constructed by the controller and maintains the entire communication process. During this time, it also works in conjunction with the tripwire controller to jointly maintain all tripwire traffic.

[0057] The system can also provide an API for other services to enable or disable its functionality. If the system is disabled, all existing traffic interruptions can be immediately cut off.

[0058] Device Example 1

[0059] This invention provides an electronic device, such as... Figure 6 As shown, it includes: a memory 60, a processor 62, and a computer program stored in the memory 60 and executable on the processor 62. When the computer program is executed by the processor 62, it performs the following method steps:

[0060] S1. Actively scan the current intranet network environment, collect information on live hosts and servers in the intranet, and store the scan results;

[0061] S2. Construct a traffic tripping data packet based on the surviving host information and server information;

[0062] S3. Generate a corresponding traffic trip based on the traffic trip data packet, and maintain communication with the other end.

[0063] Device Example 2

[0064] This invention provides a computer-readable storage medium storing an information transmission implementation program. When executed by a processor 62, the program performs the following method steps:

[0065] S1. Actively scan the current intranet network environment, collect information on live hosts and servers in the intranet, and store the scan results;

[0066] S2. Construct a traffic tripping data packet based on the surviving host information and server information;

[0067] S3. Generate a corresponding traffic trip based on the traffic trip data packet, and maintain communication with the other end.

[0068] The computer-readable storage media described in this embodiment include, but are not limited to, ROM, RAM, disk, or optical disk.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A traffic tripping point generation system, said system being deployed on any device within an intranet and used in conjunction with a honeypot, characterized in that, include: Environmental scanner, tripwire controller, and tripwire generator; The environment scanner is used to: actively scan the current intranet network environment, collect information on live hosts and servers in the intranet, and store the scan results; The tripwire controller is used to: construct traffic tripwire data packets based on the live host information and server information, and interact with the tripwire generator; the tripwire controller includes an ARP cache redirection module and a traffic construction module; The ARP cache redirection module is specifically used to: construct ARP packets based on the scan results or configuration file, and redirect the ARP cache of the peer honeypot or real host to other honeypot types of devices to confuse attackers who are already located on the peer honeypot or real host; The configuration file is used to store tripwire configuration information, which is used to provide the tripwire controller with the tripwire configuration information of the current intranet network environment without scanning the intranet network environment through the environment scanner; the tripwire configuration information includes the source address, destination address, decoy information of the tripwire traffic, type of tripwire, and generation time and interval of tripwire; The traffic construction module is specifically used to: construct TCP handshake data packets and simulated business data based on the scan results or configuration file, in order to interact with the honeypot machine; The tripwire generator is used to: generate a corresponding traffic tripwire based on the traffic tripwire data packet, and maintain communication with the peer; specifically, the tripwire generator is used to: It generates tripped traffic to the honeypot of the corresponding service and maintains the entire communication process through threads; Interact with the tripwire controller to enable the tripwire controller to manage and control the tripwire flow based on the responses from the other end in the tripwire flow.

2. The system according to claim 1, characterized in that, The surviving host information includes the host IP address, and the server information includes the type of service currently running on the server and the open ports.

3. The system according to claim 2, characterized in that, The environmental scanner is specifically used for: Use ICMP probe packets to scan the network segment where the internal network is located to obtain the IP addresses of currently active hosts; Based on the IP address of the currently active host, send SYN packets to each port of each active host to probe whether the port is open and the services running on these ports; If the target returns a SYN / ACK packet, it means that the port is open; if the target returns an RST packet, it means that the port is closed.

4. The system according to claim 1, characterized in that, The system also includes an application programming interface (API) for controlling the activation or deactivation of the traffic tripping generation system.

5. A method for generating traffic tripwires, characterized in that, include: The environment scanner actively scans the current intranet network environment, collects information on live hosts and servers in the intranet, and stores the scan results. The tripwire controller constructs traffic tripwire packets based on the live host information and server information and interacts with the tripwire generator; the tripwire controller includes an ARP cache redirection module and a traffic construction module; The ARP cache redirection module constructs ARP packets based on the scan results or configuration file, and redirects the ARP cache of the peer honeypot or real host to other honeypot types of devices to confuse attackers who are already on the peer honeypot or real host. The configuration file is used to store tripwire configuration information and provides the tripwire configuration information of the current intranet network environment to the tripwire controller without scanning the intranet network environment through the environment scanner. The tripwire configuration information includes the source address and destination address of the tripwire traffic, the decoy information of the tripwire traffic, the type of tripwire, and the generation time and interval of the tripwire. The traffic construction module constructs TCP handshake packets and simulated business data based on the scan results or configuration file to interact with the honeypot machine. The tripwire generator generates corresponding traffic tripwires based on the traffic tripwire data packets and maintains communication with the other end; the specific method is as follows: It generates tripped traffic to the honeypot of the corresponding service and maintains the entire communication process through threads; Interact with the tripwire controller to enable the tripwire controller to manage and control the tripwire flow based on the response from the other end in the tripwire flow; Based on the traffic trip data packet, a corresponding traffic trip is generated, and communication with the other end is maintained.

6. An electronic device, characterized in that, include: processor; as well as, A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the steps of the traffic tripping generation method as described in claim 5.

7. A storage medium, characterized in that, Used to store computer-executable instructions, which, when executed, are the steps of the traffic tripping generation method as described in claim 5.

Images