A public network port, protocol detection and tracking method and system suitable for the securities industry

Abstract

The application relates to the technical field of network security, in particular to a public network port, protocol detection and tracking method and system suitable for the securities industry, and the method is as follows: a public network boundary device configuration file is collected, and configuration file changes are monitored to determine whether there are configuration changes; data results obtained by analyzing the configuration file are comprehensively analyzed in combination with data results obtained by analyzing traffic protocols to analyze open ports and protocol data; whether there are changes is determined by comparing open ports and protocol changes according to the above comprehensive analysis results, and the comparison results are matched with alarm strategies; if the matching strategies are hit, alarms are triggered, and the values of a public network open port benchmark list B and a protocol list P are updated. Compared with the prior art, the application has the advantages that protocol information corresponding to open ports is supplemented, and the situation that configuration file open ports and actual open port information do not match due to the fact that the configuration file is not loaded into the memory is solved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for detecting and tracking public network ports and protocols applicable to the securities industry. Background Technology

[0002] Ports open and exposed to the public internet are a major avenue for hacker intrusion. Continuously monitoring and tracking the dynamic status of open ports at the border is one of the important protective measures to ensure border network security. Detecting the protocols used by assets exposed to the public internet is the first step in subsequent asset vulnerability detection.

[0003] The existing technical solution involves using an external scanner's scanning node to initiate probe requests to ports 1-65535 of publicly accessible IPs. The returned network packets are used to determine whether the ports are open. Information about open public network ports is obtained by monitoring and parsing the configuration files of border public network devices.

[0004] Existing tracking methods have the following drawbacks: 1. The existing method of detecting public network open port information based on the configuration file of public network boundary network device does not determine the protocol corresponding to the open port, and cannot provide a basis for subsequent port vulnerability detection.

[0005] 2. If the network device configuration file is modified but not restarted to load the configuration file into memory, the corresponding configuration will not take effect, resulting in a situation where the information obtained from the configuration file does not match the actual port information. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a method for detecting and tracking public network ports and protocols applicable to the securities industry.

[0007] To achieve the above objectives, a method for detecting and tracking public network ports and protocols applicable to the securities industry is designed. The method is as follows: S1. Collect configuration files of public network boundary devices and monitor changes to these files to determine if there are any configuration changes. Parse the collected configuration files to obtain open public network ports, and simultaneously collect public network traffic protocol analysis data; S2. Perform a comprehensive port and protocol correlation analysis between the parsed data and the traffic protocol analysis data; S3. Store the open port and protocol data obtained in step S2. The first time the parsing and storage action is performed, a public network open port baseline list B and a corresponding port open protocol list P will be generated; S4. Compare the changes in open ports and protocols based on the above comprehensive analysis results to determine if there are any changes; S5. Match the comparison results in step S4 with the alarm policy; S6. If the matching policy is matched, an alarm is triggered, and the values ​​of the public network open port baseline list B and the protocol list P are updated.

[0008] Preferably, the monitoring method in step S1 is as follows: monitoring configuration file DMZ zone configuration, including security policy and internal / external network mapping policy.

[0009] Preferably, the specific method for parsing the configuration file in step S1 is as follows: periodically obtain the IP address, port, and protocol information mapped to the public network on the border device via SSH, API, or agent, and store it as the configuration file of the corresponding device and the file hash value corresponding to the configuration file. If the content of the configuration file changes, the file hash value will be different, which can determine that there is a change in the open mapped IP address, mapped port, and protocol. The configuration file is parsed using Grok, which uses text fragment segmentation to segment the configuration file.

[0010] Preferably, the data collection method in step S1 is as follows: Each boundary device has one or more device ports corresponding to public IP addresses. The traffic of each port is copied in real time to a dedicated traffic analysis port for analysis and monitoring through traffic mirroring technology. Through network traffic mirroring, the communication data packets of the public port, including request and response data, can be obtained in real time. The main data collection involves communication content mapped to public addresses and ports. The collected data is network communication six-element data, including request direction, source IP, source port, protocol, destination IP, and destination port.

[0011] Preferably, step S2 is as follows: using the public IP address extracted from the configuration file as the keyword, match the destination IP in the traffic mirror. After a match, compare the protocol field in the configuration file with the protocol field value captured in the traffic mirror. Usually, they will be the same. Only when the configuration file is modified but not loaded into the device memory will the configuration file content and the actual open protocol, IP, and port be inconsistent.

[0012] Preferably, steps S3 and S4 are as follows: When the parsing and storage action is executed for the first time, the public network open port baseline list B and the hash value B-hash of the public network open port baseline list B are generated. The new public network open port baseline list B-new and the hash value B-new-hash of the new public network open port baseline list B-new are obtained. If B-hash is not equal to B-new-hash, it is considered that the configuration has changed.

[0013] Preferably, steps S5 and S6 are as follows: After the alarm is triggered, the new public network open port baseline list B-new will replace the public network open port baseline list B, becoming the new public network open port baseline list.

[0014] A system employing a public network port and protocol detection and tracking method suitable for the securities industry includes a configuration acquisition and monitoring module: managing the source of public network boundary device configuration files and the scope of configuration file acquisition, and collecting public network traffic protocol parsing data; a parsing strategy management module: adding, deleting, modifying, and querying configuration file parsing rules; a storage and display module: storing the parsed results in a database, and displaying the number of open public network ports, their changing trends, and open port traceability queries in chart form according to scenario needs; and an alarm strategy management module: formulating and configuring different detection strategies according to the monitoring alarm needs of operation and management personnel, triggering alarms when a strategy is triggered, and distributing alarms to different objects or object groups through different channels according to alarm classification and grading.

[0015] Compared with the prior art, the advantages of this invention are: 1. Supplemented the protocol information corresponding to the open ports; 2. Resolved the issue where the configuration file was not loaded into memory, causing a mismatch between the open ports in the configuration file and the actual open ports. Attached Figure Description

[0016] Figure 1 This is a flowchart of the method and system provided by the present invention. Detailed Implementation

[0017] The invention will be further described below with reference to the accompanying drawings. The structure and principle of the invention are very clear to those skilled in the art. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention.

[0018] like Figure 1 As shown, this invention discloses a method and system for detecting and tracking public network ports and protocols applicable to the securities industry.

[0019] The specific steps are as follows: S1. Collect configuration files of public network boundary devices, monitor changes to the configuration files, determine if there are any configuration changes, parse the collected configuration files to obtain open public network ports, and collect public network traffic protocol analysis data.

[0020] The configuration file includes security policies and internal / external network mapping policies, as follows: Configure two servers in the DMZ area to publish NAT-Server, providing FTP (192.168.0.2 21) service and web service (192.168.0.3) respectively (using the public network 100.2.2.9 / 29 allocated by the ISP).

[0021] Configure security policies: [USG6000V1-policy-security]rule name todmz [USG6000V1-policy-security-rule-todmz]source-zone untrust [USG6000V1-policy-security-rule-todmz]destination-zone dmz [USG6000V1-policy-security-rule-todmz]destination-address 192.168.0.024 [USG6000V1-policy-security-rule-todmz]service ftp [USG6000V1-policy-security-rule-todmz]service http [USG6000V1-policy-security-rule-todmz]action permit.

[0022] Configure internal and external network mapping policies: [USG6000V1]nat server ftp protocol tcp global 100.2.2.9 21 inside192.168.0.2 21 [USG6000V1]nat server http protocol tcp global 100.2.2.9 80 inside192.168.0.3 80 The specific monitoring method is as follows: monitoring configuration file for DMZ zone configuration, including security policies and internal / external network mapping policies.

[0023] The specific method for collecting files is as follows: Each border device (firewall, router, load balancer, etc.) has one or more device ports corresponding to public IP addresses. The traffic of each port is copied in real time to a dedicated traffic analysis port for analysis and monitoring through traffic mirroring technology. Through network traffic mirroring, communication data packets of the public port can be obtained in real time, including request and response data. The main data collected involves communication content mapped to public IP addresses and ports. The collected data consists of six network communication primitives: request direction, source IP, source port, protocol, destination IP, and destination port.

[0024] The specific parsing method is as follows: Periodically obtain the IP address, port, and protocol information mapped to the public internet via SSH, API, or agent on a border device, such as a firewall, and store it as a configuration file for the corresponding device, along with the file's hash value. If the configuration file content changes, the file hash value will be different, indicating a change in the open mapped IP address, port, or protocol. The configuration file is parsed using Grok, which uses text segmentation to split the configuration file. The syntax is: (?<field_ name> The pattern is here.

[0025] Assuming the text segment to be matched is a hexadecimal value of length 10 or 11, the following syntax can be used to retrieve the segment and assign the value to queue_id: (3 <queue. 10)10-9-F10,11)。

[0026] Similarly, the grok syntax can be used to extract the corresponding fields and field values ​​in the form of key:value for the configuration files of border network devices (firewalls, routers, load balancers, etc.).

[0027] S2. Perform a comprehensive port and protocol correlation analysis on the data results parsed from the configuration file and the data results obtained from the traffic protocol analysis.

[0028] Specifically, the public IP address extracted from the configuration file is used as the keyword to match the destination IP in the traffic mirror. After a match, the protocol field in the configuration file is compared with the protocol field value captured in the traffic mirror. Usually, they will be the same. Only when the configuration file is modified but not loaded into the device memory will the configuration file content and the actual open protocol, IP, and port be inconsistent.

[0029] Take the following configuration file as an example: [USG6000V1]nat server ftp protocol tcp global 100.2.2.9 21 inside192.168.0.2 21 [USG6000V1]nat server http protocol tcp global 100.2.2.9 80 inside192.168.0.3 80.

[0030] The data parsed from the configuration file is as follows:

[0031] The parsed and filtered data after mirroring public network traffic is as follows: When the IP address and port exposed to the public network are used for a requested service, the public IP address and port are the requested service, and the fields are dest_ip and dest_port.

[0032]

[0033] The matching logic is: Based on the keyword "openip" extracted from the configuration file, the `dest_ip` in the traffic mirror is matched. If a match is found, the `protocol` field in the configuration file is compared with the `protocol_trap` field value in the traffic mirror. Normally, they will match. Inconsistencies only occur when the configuration file has been modified but not yet loaded into the device memory, resulting in discrepancies between the configuration file content and the actual open protocol, IP address, and port.

[0034] S3. Store the open port and protocol data obtained in step S2. When the parsing and storage action is executed for the first time, a public network open port baseline list B and a corresponding port open protocol list P will be formed.

[0035] S4. Based on the above comprehensive analysis results, compare the changes in open ports and protocols to determine whether there are any changes.

[0036] Specifically, when the parsing and storage action is executed for the first time, it will parse and generate the public network open port baseline list B, and the hash value B-hash of the public network open port baseline list B, obtain the new public network open port baseline list B-new, and the hash value B-new-hash of the new public network open port baseline list B-new. If B-hash is not equal to B-new-hash, it is considered that the configuration has changed.

[0037] S5. In step S4, the comparison results are matched with the alarm policy.

[0038] S6. If the matching policy is matched, an alarm is triggered, and the values ​​of the public open port baseline list B and protocol list P are updated.

[0039] Specifically, when the parsing and storage action is executed for the first time, a public network open port baseline list B and its hash value B-hash will be generated. A new public network open port baseline list B-new and its hash value B-new-hash will be obtained. After an alarm is triggered, the new public network open port baseline list B-new will replace the public network open port baseline list B and become the new public network open port baseline list.

[0040] The present invention also provides a system that employs a public network port and protocol detection and tracking method suitable for the securities industry, including a configuration acquisition and monitoring module, a parsing strategy management module, a storage and display module, and an alarm strategy management module.

[0041] Configure the data acquisition and monitoring module: manage the source of public network boundary device configuration files, manage the scope of configuration file acquisition, and collect public network traffic protocol parsing data.

[0042] The parsing strategy management module allows for the creation, deletion, modification, and querying of configuration file parsing rules.

[0043] Storage and Display Module: Stores the parsed results in the database and displays the number of public network open ports, their changing trends, and open port traceability queries in chart form, depending on the scenario requirements.

[0044] Alarm policy management module: Different detection policies can be formulated and configured according to the monitoring and alarm needs of operation and management personnel. When the policy is triggered, an alarm is triggered and distributed to different objects or object groups through different channels according to the alarm classification and level.

[0045] The above description is merely a specific embodiment of the invention, but the scope of protection of the invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in this invention, based on the technical solutions and novel concepts of the invention, should be covered within the scope of protection of this invention.

Claims

1. A method for detecting and tracing public network ports and protocols applicable to the securities industry, characterized in that... The method is as follows: S1. Collect configuration files from public network boundary devices, monitor changes to these files to determine if there are any configuration changes, parse the collected configuration files to obtain open public network ports, and simultaneously collect public network traffic protocol analysis data; S2. Perform a comprehensive port and protocol correlation analysis on the data results parsed from the configuration file and the data results obtained from traffic protocol analysis; S3. Store the open port and protocol data obtained in step S2. When the parsing and storage action is executed for the first time, a public network open port baseline list B and a corresponding port open protocol list P will be formed. S4. Based on the comprehensive analysis results above, compare the changes in open ports and protocols to determine whether any changes have occurred; S5. Match the comparison results from step S4 with the alarm policy; S6. If the matching policy is matched, an alarm is triggered, and the values ​​of the public open port baseline list B and protocol list P are updated.

2. The method for detecting and tracking public network ports and protocols applicable to the securities industry as described in claim 1, characterized in that... The monitoring method in step S1 is as follows: monitoring configuration file DMZ zone configuration, including security policy and internal / external network mapping policy.

3. The method for detecting and tracking public network ports and protocols applicable to the securities industry as described in claim 1, characterized in that... The specific method for parsing the configuration file in step S1 is as follows: periodically obtain the IP address, port, and protocol information mapped to the public network on the border device via SSH, API, or agent, and store it as the configuration file of the corresponding device and the file hash value corresponding to the configuration file. If the content of the configuration file changes, the file hash value will be different, which indicates that there is a change in the open mapped IP address, mapped port, and protocol. The configuration file is parsed using Grok, which uses text fragment segmentation to segment the configuration file.

4. The method for detecting and tracking public network ports and protocols applicable to the securities industry as described in claim 1, characterized in that... The specific data collection method in step S1 is as follows: Each boundary device has one or more device ports corresponding to public IP addresses. The traffic of each port is copied in real time to a dedicated traffic analysis port for analysis and monitoring through traffic mirroring technology. Through network traffic mirroring, the communication data packets of the public port are obtained in real time, including request and response data. The data collection involves communication content mapped to public addresses and ports. The collected data is the six primitive data of network communication, including request direction, source IP, source port, protocol, destination IP, and destination port.

5. The method for detecting and tracking public network ports and protocols applicable to the securities industry as described in claim 1, characterized in that... The specific steps of step S2 are as follows: using the public IP address extracted from the configuration file as the keyword, match the destination IP in the traffic mirror. After a match, compare the protocol field in the configuration file with the protocol field value captured in the traffic mirror. If the configuration file is modified but not loaded into the device memory, the configuration file content may be inconsistent with the actual open protocol, IP, and port.

6. The method for detecting and tracking public network ports and protocols applicable to the securities industry as described in claim 1, characterized in that... Steps S3 and S4 are as follows: When the parsing and storage action is executed for the first time, a public network open port baseline list B and its hash value B-hash will be generated; a new public network open port baseline list B-new and its hash value B-new-hash will be obtained; if B-hash is not equal to B-new-hash, it is considered that the configuration has changed.

7. The method for detecting and tracking public network ports and protocols applicable to the securities industry as described in claim 6, characterized in that... Steps S5 and S6 are as follows: After the alarm is triggered, the new public network open port baseline list B-new will replace the public network open port baseline list B and become the new public network open port baseline list.

8. A system employing the public network port and protocol detection and tracing method as described in any one of claims 1-7, characterized in that... include Configure the data acquisition and monitoring module: manage the source of public network boundary device configuration files, manage the scope of configuration file collection, and collect public network traffic protocol parsing data; The parsing strategy management module allows users to add, delete, modify, and query configuration file parsing rules. Storage and Display Module: Stores the parsed results in the database and displays the number of public network open ports, their changing trends, and open port traceability queries in chart form, depending on the scenario requirements; Alarm policy management module: Different detection policies can be formulated and configured according to the monitoring and alarm needs of operation and management personnel. When the policy is triggered, an alarm is triggered and distributed to different objects or object groups through different channels according to the alarm classification and level.

Images