Network defense system based on decoy technology

Abstract

The invention relates to the technical field of network defense systems, and discloses a decoy technology-based network defense system, which comprises a false node setting system, a sensitive port setting system and a trapping isolation system, the false node setting system comprises a false node selection module, a false node construction module, a false node behavior simulation module and a false node data analysis module, and the sensitive port setting system comprises a sensitive port construction module, a sensitive port behavior simulation module and a sensitive port data analysis module. The trapping isolation system comprises a trapping and analysis module, a response and blocking module and a real-time alarm module; the system can actively attract attackers, so that potential threats can be discovered and dealt with in advance, conversion from passive defense to active defense is realized, and based on collected attack data, an attack mode can be analyzed, an existing defense strategy can be optimized, and the overall security protection capability can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network defense systems, and in particular relates to a network defense system based on deception technology. Background Art

[0002] With the rapid development of information technology and the widespread popularity of the Internet, cyber attacks have become a global security issue. Cyber ​​attacks not only threaten personal privacy and property security, but may also have a serious impact on national security, social stability and economic development. Therefore, in-depth understanding of the current situation of cyber attacks is of great significance for formulating effective defense strategies and protecting the security of cyberspace. The current situation of cyber attacks shows the characteristics of continuous growth in the number of attacks, diversification of attack methods, and concentration of threat targets. The targets of cyber attacks are mainly concentrated in economically developed regions and important industries. These regions and industries have high-value data resources, so they have become the focus of attackers. The impact of cyber attacks is also multifaceted, including personal privacy leakage, property loss, business interruption, reputation damage, etc. In serious cases, cyber attacks may also pose a threat to national security and social stability.

[0003] Traditional firewalls mainly work at the network layer and transport layer. As a key device in the network, once a firewall fails or is attacked, it may cause the entire network to lose protection, and there is a risk of single point failure. The ability to detect attacks at the application layer is limited, and it is difficult to deeply analyze application layer data. With the continuous advancement of hacker technology, new and complex threat forms emerge in an endless stream. Traditional defense methods often lag behind the development of attack technology and are difficult to respond effectively.

[0004] To this end, we propose a network defense system based on deception technology. Summary of the invention

[0005] The purpose of the present invention is to actively attract attackers, thereby discovering and responding to potential threats in advance and realizing the transition from passive defense to active defense. Based on the collected attack data, the attack mode can be analyzed, the existing defense strategy can be optimized, and the overall security protection capability can be improved. The present application provides a network defense system based on deception technology.

[0006] The technical solution adopted by the present invention is as follows:

[0007] A network defense system based on deception technology, comprising a false node setting system, a sensitive port setting system and a trapping isolation system, wherein the false node setting system and the trapping isolation system are non-electrically and wirelessly connected, the sensitive port setting system and the trapping isolation system are non-electrically and wirelessly connected, and the trapping isolation system is electrically connected to the security protection enhancement module;

[0008] The false node setting system includes a false node selection module, a false node construction module, a false node behavior simulation module and a false node data analysis module; the sensitive port setting system includes a sensitive port construction module, a sensitive port behavior simulation module and a sensitive port data analysis module; the trapping and isolation system includes a trapping and analysis module, a response and blocking module and a real-time alarm module.

[0009] In a preferred embodiment of the invention, the false node selection module is used to select appropriate nodes for false deployment according to the network topology and historical attack data; the false node construction module is used to construct a virtual environment that appears to be real on each selected node.

[0010] In a preferred embodiment of the invention, the fake node behavior simulation module is used to simulate the behavior of a real node and interact with the attacker to a certain extent; the fake node data analysis module is used to monitor and analyze data from the fake node in real time in the background, so as to detect potential security threats in a timely manner.

[0011] In a preferred embodiment of the invention, the sensitive port construction module is used to construct and open high-risk sensitive ports as bait to attract attackers; the sensitive port behavior simulation module is used to simulate the behavior of real ports and introduce attackers into the simulation environment.

[0012] In a preferred embodiment of the invention, the sensitive port data analysis module is used to prevent any unauthorized access attempts when the port interacts appropriately with the attacker, and by analyzing the data of the fake port, it can help identify different types of network attacks and their characteristics.

[0013] In a preferred embodiment of the invention, the trapping and analysis module is used to trap the attacker into an isolated environment when the attacker triggers the bait, and to record and analyze the attacker's attack behavior, tools and techniques in detail.

[0014] In a preferred embodiment of the invention, the response and blocking module is used to automatically or manually locate and block attackers based on the analysis results of the trapping and analysis module to prevent them from causing damage to the real system.

[0015] In a preferred invention mode, the real-time alarm module is used to determine whether to trigger the alarm mechanism based on the analysis results of the trapping and analysis module data. When the alarm mechanism is triggered, the alarm information is promptly notified to relevant personnel through various methods such as sound, text message, email, push notification, etc.

[0016] In a preferred embodiment of the invention, the security protection enhancement module is used to analyze the entire process of the attack event, including the trigger time, processing results, etc., and adjust the defense strategy according to the attacker's behavior pattern, optimize the deception environment, and improve the defense effect.

[0017] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0018] 1. In the present invention, fake nodes and fake sensitive ports are used to lure attackers into attacking, actively attract attackers, so as to discover and respond to potential threats in advance, and realize the transformation from passive defense to active defense; the deception system can record the attacker's behavior, tools and techniques, understand the attacker's strategies and intentions, and discover new attack methods and techniques by constantly interacting with the attacker. Based on the collected attack data, the attack mode can be analyzed, the existing defense strategy can be optimized, and the overall security protection capability can be improved.

[0019] 2. In the present invention, the attacker is lured into an isolated environment, and his attack behavior, tools and techniques can be recorded and analyzed in detail. The attacker can be located and blocked based on the analysis results to prevent him from causing damage to the real system and ensure network security. By deceiving the system, the attacker's time and resources can be consumed, reducing the risk of the real system being attacked. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a system diagram of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The following will be combined Figure 1 A network defense system based on deception technology according to an embodiment of the present invention is described in detail.

[0023] Example:

[0024] Reference Figure 1A network defense system based on deception technology includes a false node setting system, a sensitive port setting system and a trapping isolation system, wherein the false node setting system and the trapping isolation system are non-electrically and wirelessly connected, the sensitive port setting system and the trapping isolation system are non-electrically and wirelessly connected, and the trapping isolation system is electrically connected to the security protection enhancement module; the false node setting system includes a false node selection module, a false node construction module, a false node behavior simulation module and a false node data analysis module, and the false node selection module is used to select appropriate nodes for false deployment according to the network topology and historical attack data; specifically, by setting nodes that the attacker may think are of high value or easy to penetrate, such as database servers, file servers, etc., it is possible to more effectively attract the attacker's attention and mislead their behavior; the false node construction module is used to build a seemingly real virtual environment on each selected node; specifically, the module first simulates the real environment characteristics of the selected node, including network protocols, service responses, etc., so that it is difficult for attackers to distinguish between the true and the false.

[0025] Reference Figure 1 The fake node behavior simulation module is used to simulate the behavior of the real node and interact with the attacker to a certain extent; specifically, when the attacker attempts to interact, the module provides preset or dynamically generated data, and the fake node is isolated from other parts of the network to avoid affecting the actual business; the fake node data analysis module is used to monitor and analyze the data from the fake node in real time in the background to timely discover potential security threats; specifically, the module can record the attacker's behavior, including access time, attempted service type, etc., and analyze its behavior pattern in order to lure it into the trapping and analysis module.

[0026] Reference Figure 1 The sensitive port setting system includes a sensitive port construction module, a sensitive port behavior simulation module and a sensitive port data analysis module, and the trapping and isolation system includes a trapping and analysis module, a response and blocking module and a real-time alarm module; the sensitive port construction module is used to construct and open high-risk sensitive ports as bait to attract attackers; specifically, it is used to construct high-risk sensitive SSH port 22 and MySQL port 3306; the sensitive port behavior simulation module is used to simulate the behavior of the real port and introduce the attacker into the simulation environment; specifically, the constructed fake will be opened during interaction, but the corresponding service is not actually run, but a simulation environment is deployed to deceive the attacker.

[0027] Reference Figure 1The sensitive port data analysis module is used to prevent any unauthorized access attempts when the port interacts appropriately with the attacker, and by analyzing the data of the false port, it can help identify different types of network attacks and their characteristics; specifically, the sensitive port data analysis module is used to record all attempts to access these ports, including IP addresses, access time, attempted service types, etc. Through analysis, the attacker's behavior patterns and attack methods can be understood.

[0028] Reference Figure 1 The trapping and analysis module is used to trap the attacker into an isolated environment when the bait is triggered, and to record and analyze the attacker's attack behavior, tools and techniques in detail; the response and blocking module is used to automatically or manually locate and block the attacker according to the analysis results of the trapping and analysis module to prevent the attacker from causing damage to the real system. Specifically, the trapping and analysis module can highly simulate the real network environment, configure real network equipment, host environment, etc., build a rich and dynamically changing environment, induce attackers to explore and implement attacks, effectively trap attackers, and record their attack behaviors, and collect all attack behavior data in the false network environment, including network data, host data, etc., for complete, hidden and real records, so as to analyze the attacker's behavior, tools and techniques later; use false nodes and false sensitive ports to lure the attacker's attack, actively attract the attacker, so as to discover and respond to potential threats in advance, and realize the transformation from passive defense to active defense; the deception system can record the attacker's behavior, tools and techniques, understand the attacker's strategies and intentions, and discover new attack methods and techniques by constantly interacting with the attacker. Based on the collected attack data, the attack mode can be analyzed, the existing defense strategy can be optimized, and the overall security protection capability can be improved.

[0029] Reference Figure 1 The real-time alarm module is used to determine whether to trigger the alarm mechanism based on the analysis results of the trapping and analysis module data. When the alarm mechanism is triggered, the alarm information is promptly notified to relevant personnel through various methods such as sound, SMS, email, and push notifications. Specifically, after the attacker is trapped in an isolated environment, the real-time alarm module will use a preset rule set and machine learning algorithm to determine whether these behaviors constitute a real attack threat, which includes checking the source IP of the request, access frequency, request type and other dimensions; if the analysis results show that there is an attack behavior, the real-time alarm module will immediately trigger the alarm mechanism. The alarm information will record the attacker's IP address, attack time, attack type and other key information in detail, and send it to the security team through a preset communication channel.

[0030] Reference Figure 1The security protection enhancement module is used to analyze the entire process of the attack event, including the trigger time, processing results, etc., and adjust the defense strategy according to the attacker's behavior pattern, optimize the deception environment, and improve the defense effect; specifically, the security protection enhancement module records and analyzes the attacker's behavior, and the module can further adjust the simulation environment to more accurately lure the attacker into in-depth exploration and improve the entire network defense system.

[0031] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0032] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network defense system based on deception technology, including a false node setting system, a sensitive port setting system and a trapping isolation system, Features: The false node setting system is connected to the trapping isolation system in a non-electrical wireless manner, the sensitive port setting system is connected to the trapping isolation system in a non-electrical wireless manner, and the trapping isolation system is electrically connected to the security protection enhancement module; The false node setting system includes a false node selection module, a false node construction module, a false node behavior simulation module and a false node data analysis module; the sensitive port setting system includes a sensitive port construction module, a sensitive port behavior simulation module and a sensitive port data analysis module; the trapping and isolation system includes a trapping and analysis module, a response and blocking module and a real-time alarm module.

2. A network defense system based on deception technology as claimed in claim 1, Features: The false node selection module is used to select appropriate nodes for false deployment according to the network topology and historical attack data; the false node construction module is used to construct a virtual environment that looks real on each selected node.

3. A network defense system based on deception technology as claimed in claim 1, Features: The fake node behavior simulation module is used to simulate the behavior of real nodes and interact with attackers to a certain extent; the fake node data analysis module is used to monitor and analyze data from fake nodes in real time in the background to detect potential security threats in a timely manner.

4. A network defense system based on deception technology as claimed in claim 1, Features: The sensitive port construction module is used to construct and open high-risk sensitive ports as bait to attract attackers; The sensitive port behavior simulation module is used to simulate the behavior of the real port and introduce the attacker into the simulation environment.

5. A network defense system based on deception technology as claimed in claim 1, Features: The sensitive port data analysis module is used to prevent any unauthorized access attempts when the port interacts appropriately with the attacker, and can help identify different types of network attacks and their characteristics by analyzing the data of the fake port.

6. A network defense system based on deception technology as claimed in claim 1, Features: The trapping and analysis module is used to trap the attacker into an isolated environment when the attacker triggers the bait, and to record and analyze the attacker's attack behavior, tools and techniques in detail.

7. A network defense system based on deception technology as claimed in claim 1, Features: The response and blocking module is used to automatically or manually locate and block attackers according to the analysis results of the trapping and analysis module to prevent them from causing damage to the real system.

8. A network defense system based on deception technology as claimed in claim 1, Features: The real-time alarm module is used to determine whether to trigger the alarm mechanism based on the analysis results of the trapping and analysis module data. When the alarm mechanism is triggered, the alarm information is promptly notified to relevant personnel through various methods such as sound, text message, email, push notification, etc.

9. A network defense system based on deception technology as claimed in claim 1, Features: The security protection enhancement module is used to analyze the entire process of the attack event, including the trigger time, processing results, etc., and adjust the defense strategy according to the attacker's behavior pattern, optimize the deception environment, and improve the defense effect.

Images